Hacker News Reader

Not bad for 2 days of work.

The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs.

It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market.

[0] http://www.snopes.com/business/genius/where.asp

He says that it took him about 2 days total

https://news.ycombinator.com/item?id=7106482

The 10 years before those 2 days helped a lot too...

So would you rather pay a master $33,500 for 2 days of work or a novice $33,500 for a year of work (and possibly no results)?

You pay for results, not for time. And you can use an existing market to define a price.

Time is often used to measure compensation – lawyers are well known for being paid in hourly fees –, however, in the long run, only results counts. And concerning the market, for how much could this bug have been sold, for example to the NSA?

Reply on news.ycombinator.com