[salem]

Makes you wonder if they could have made more money by pretending to find them and reporting them to the respective bug bounty programs.

[wcummings]

Bug bounties almost never pay market value for exploits. Only reason to participate in them is charity.

[kbenson]

And legality. I'm not sure why people seem to entirely discount that portion. There's more reward by selling on the black market, but there's also more risk associated with that.

[schoen]

> Only reason to participate in them is charity.

Maybe believing that it's good when fewer vulnerabilities exist and when attackers are less able to exploit things? Does that count as charity?

[dtemp]

Getting a CVE on your resume isn't bad either.