Sign in with
Sign up | Sign in

Google Increases Rewards for Bug Catchers...Again

By - Source: Zdnet | B 10 comments

Google sees a significant drop-off in reported security issues and hopes to increase efforts by introducing more bonuses.

Earlier this year Google increased its bug bounty drastically, offering an award of up to $20,000 in comparison to its previous top reward of $3,133.70.

Now, the company is giving even more incentives to crafty bug catchers out there.

On Tuesday, Chrome software engineer Chris Evans (not to be confused with Captain America) stated in the Chromium Blog, "Recently, we've seen a significant drop-off in externally reported Chromium security issues. This signals to us that bugs are becoming harder to find."

According to the engineer, Google will be awarding researchers additional bonuses starting from $1,000 and increasing based on the severity of the bugs. The bonuses will be added to the current base payments, which range anywhere from $500 to $3,133 for "particularly exploitable" bugs found in Chrome's code and for vulnerabilities that affect additional browsers.

The bug bounty program changes were immediately put into effect, but the company graciously gave $1,000 and $3,000 bonuses to recent bug reporters who were eligible under the new program. In addition to the bonuses for bug reporting, Google also hopes to increase activity in the Chromium community by offering additional bonuses of $500 to $1000 to any bug catcher who joins the community and provides a peer-reviewed patch.

 

Contact Us for News Tips, Corrections and Feedback

Discuss
Display all 10 comments.
This thread is closed for comments
  • 9 Hide
    freggo , August 16, 2012 5:55 PM
    Actually a clever tactic as it is far less expensive to pay the bug catchers than setting aside employees for the task. Think about it, the employee costs money, no matter if he/she finds a bug or not.
    An outsider will think 'outside the box'; and get paid only if he/she finds something.
  • 4 Hide
    AznCracker , August 16, 2012 6:47 PM
    It's outsourcing to freelancers.
  • 0 Hide
    A Bad Day , August 16, 2012 6:57 PM
    I could imagine a Google employee purposely slipping in bugs and informing his/her partner about it. Imagine the extra salary.
  • 9 Hide
    dalethepcman , August 16, 2012 7:57 PM
    A Bad DayI could imagine a Google employee purposely slipping in bugs and informing his/her partner about it. Imagine the extra salary.

    Then you can imagine the google employee being terminated, having their benifits revoked for defrauding / embezzling, then going to "federal pound you in the ass" prison...

    This is crowd sourcing at its finest.

  • 3 Hide
    house70 , August 16, 2012 8:55 PM
    A Bad DayI could imagine a Google employee purposely slipping in bugs and informing his/her partner about it. Imagine the extra salary.

    Dude, just reading your comments makes me ROFL. You are pretty good with catching every negative side and slapping it on the forums. I guess you picked your name pretty well. I usually thumb you up just for the negative spin.
    On this one, however, I have to give the point to dalethepcman. Just because this system is so much in the open nobody can expect to do that and get away with it. And we all know by now how sweet is to be a Google employee.....
  • 2 Hide
    Chainzsaw , August 16, 2012 9:35 PM
    Actually - putting a bounty on bugs is a pretty damn good idea. Kind of like the old west with outlaws.

    Why don't more companies do this? Of course I also see the flip side of how a relesed product shouldn't have major bugs (hah!).
  • -4 Hide
    back_by_demand , August 16, 2012 9:39 PM
    ChainzsawWhy don't more companies do this?

    Most companies don't release a product with a billion dollars worth of bugs in it
  • 4 Hide
    cepheid , August 16, 2012 11:15 PM
    More along the lines of "most companies don't care if they release a bugged product or not".
  • 3 Hide
    A Bad Day , August 16, 2012 11:17 PM
    back_by_demandMost companies don't release a product with a billion dollars worth of bugs in it


    Or, they're so cheap that they couldn't bother bug-checking in the first place.
  • 1 Hide
    eddieroolz , August 16, 2012 11:42 PM
    This tactic is something I can applaud from Google. There are legions of talented hackers, so why not use them for your benefit?