If you're offering bug bounties you need to think about them as your bid in an active marketplace. It's true that part of your bid is non-monetary: many researchers and engineers prefer to sell their knowledge to vendors and others who will use it defensively (i.e., to fix the bug). But that non-monetary component has only so much value, which differs from one person to the next -- some may be indifferent and will simply accept the highest monetary bid on offer -- and you cannot rely on it to carry the day over potentially much larger bids offered by criminals (a group that includes state actors, who have the ability to literally print money to pay for knowledge they can weaponise). As with any auction, you have to ask yourself up front how important it is to win.

A genuine P1 bug (security-related or otherwise) is a drop-everything moment for however many engineers are needed to analyse and fix it. The type, scope, and scale of the impact that qualifies a bug as P1 depends on your business, but for a major Internet-facing service it's going to be something that is highly likely to compromise your customers' personal information, your own databases, or take out your service. Such incidents are at best costly to fix and come with reputational damage that may never be overcome. In the limit, they can threaten the very existence of your company. With that in mind, $5000 seems like a paltry bid. I'm pretty sure I'd want to reconsider that if I were in their shoes; it's easy to imagine nefarious actors offering a healthy multiple, and the cost of cleaning up from an exploit of a P1 security bug in your service is surely many times that as well.

This is part of the cost of doing business: you can invest up front in better systems and software, and you will have fewer and less severe bugs to address later. Or you can defer that investment and either suffer the consequences of malicious exploitation or pay others more to find your bugs for you. Those are, unfortunately, the only three choices you have. Deferring investment and then demanding that others do your work for far less than it would have cost you up front is not one of your options.

*Jumps up & down enthusiasticly on the upvote button*

Damn my inability to upvote the hell out of your post!

*Hands you a pint* Drink up & congratulations for nailing the issue in the very first post. =-)

Something to remember is that the kids who graduated Uni/College and got into the corporate computer and networking world back when computers started becoming ubiquitous on desktops all over the corporate world are now roughly in their mid 50s.

Note this is managers, users, coders, programmers, systems folks, everyone.

They started commercial computer work with DOS 4.0 and Windows 2.x (or thereabouts), and have become conditioned to the Redmond Way ... In their minds (and the generations following) it's supposed to be shoddy code, it's supposed to not be secure, it's supposed to break at the least convenient time, it will crash at random, updates will make things worse, over time it gets bigger and worse, if you turn it off and back on again it might fix it (maybe; try flicking the switch again) ... these are all enshrined in the corporate attitude.

What would be the point in building clean, elegant program code that just works when the underlying OS doesn't support such a concept?

Those of us who started coding in the 60s or earlier are just left shaking our heads. Can you imagine what the reaction in Corporate America would have been if DEC or Burroughs or Sperry or IBM had made just one release that was as buggy as the code that is run as a matter of course on modern computers? Or worse, the drek in "the cloud"? The company's stock would have tanked, they would never have been trusted again, heads would have rolled ... ugly wouldn't even begin to describe it.

But these days? Navigating through crap, buggy, crash-prone bullshit has become business as usual. Because THAT'S HOW COMPUTERS ARE SUPPOSED TO WORK! Ask any manager. Or coder under 50. (Thankfully there are still a few real programmers out there in each generation.)

So why bother paying money to fix it? The shareholders will just bitch about the expense.

I have no answers. I'm not sure there are any. It's probably too late.

Nice rant

Worth pointing out that things are several orders of magnitude more complex than back then

Also super cars are better engineered than mass production cars, but a daily runner is a lot more useful...

Odd timing that both Facebook and Twitch went down at the same due to "server configuration changes"?

Not really both are "move fast and break things" companies

In other words meet kpis and hope for best, then when it blows up and new managers come in, test until quarterly bonus is threatened, get sloppy, break it again and jump ship to do same shit elsewhere

Divide by ten and that's your bug bounty reward.

from the richest corporation on Planet Earth.

As someone in an episode of The Simpsons said "I didn't get rich by writing checks".

"It is easier to get money from poor people" Gunilla Goodmountain.

"There's a sucker born every minute." —David Hannum

(Probably. Supposedly in reference to PT Barnum's roll in the Cardiff Giant hoax. Or so the story goes. My gut feeling is that the very same phrase was in widespread use long before humans invented writing.)