44
AMD changes rules, denies researcher $10,000 bounty after taking 124 days to patch security flaw (www.techspot.com)
submitted 2 months ago by to c/cybersecurity@infosec.pub
5 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 21 points 2 months ago (1 child)

$10k is nothing to AMD. The middle-management bean counters making these decisions are actively harming their company's (and user's security.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 4 points 2 months ago

    The flaw of not using HTTPS for the downloads is so basic it's shocking they didn't have internal tooling to raise this before it was shipped. I'm not familiar with AMD's bug bounty policy but they should have at least paid $1337 to the researcher for raising this to them.

  • permalink
  • fedilink
  • source
  • parent