Michael Sutton
Michael Sutton
code free information model pay quite researcher review wants
The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it.
credited encourage looking reporting
In 2005, we were credited with reporting 3 'critical' vulnerabilities to Microsoft, and we want to encourage our contributors to keep looking in that direction.