Comment by kasabali | Hacker News Reader

Comment by kasabali | Hacker News Reader

    Microsoft Windows: 5 bugs
    Microsoft IE 11: 4 bugs
    Mozilla Firefox: 3 bugs
    Adobe Reader: 3 bugs
    Adobe Flash: 3 bugs
    Apple Safari: 2 bugs
    Google Chrome: 1 bug
    $442,500 paid out to researchers

Looking at these figures, am I the only one who think competitions are not the most effective method for finding bugs? Of course, 21 bugs is not small and $442,500 is not much, but when you think those researches spend months of their time for finding those bugs, wouldn't it be more appropriate to use that money on proper security audits? (I know it will cost more but would be more effective overall?)

It's not 21 bugs. Anyone can find 21 bugs. It's 21 bugs that enable/facilitate Remote Code Execution. These are some of the worse of the worse. $442,000 is a steal to get these identified and fixed.

Additionally those 21 bugs are probably worth way more than a measly $442k if sold on the blackmarket or to the NSA, etc.

Are there actually reliably numbers/analyses on that? I heard the sentiment many times, but I have seen no proof of it.

Finding bugs is easy, exploiting them is a magnitude harder. This competition is about exploitation.

I consider the purpose of competitions like this to be as much about finding bugs as the purpose of running a marathon is to get people from point A to point B. That is competitions like this are mainly about public relations in the form of what is intended to be enjoyable community involvement, finding bugs is a pleasant side effect, like the transportation aspect of a marathon.

Proper audits don't get much publicity.

Reply on news.ycombinator.com