This is how you create people like Nightmare Eclipse.

These people are going out of their way to responsibly disclose vulnerabilites to the bug bounty programs and being treated poorly as a result. Granted, AMD technically didn't have to pay since it was a MITM attack, but they could have at least handled the whole interaction better.

$10k is nothing to AMD. The middle-management bean counters making these decisions are actively harming their company's (and user's security.

Nightmare Eclipse 2.0 incoming. 10K for such a thing is absolutely nothing for companies like AMD. Why promise rewards if at the end, you don't intend to pay? This has been a growing trend in the bug bounty space. Many times a bug is marked as duplicate and is fixed secretly. Other times, they're straightaway rejected..

Didn't Microsoft just pull this same thing and now there's all these 0-days getting released publicly as vengeance? I swear, all these companies are sharing the same brain cell...

Nothing quite like creating a specific incentive for researchers to seek "alternative" sources of income as payment for their research efforts.

Microsoft tried this .. seems to be working out for them .. not.

Well the next time someone finds a bug in their software they will have to find other ways to monetize it.

My favourite part was when they rejected the flaw saying it's out of scope for their bounty program but still wanted him to keep it secret because of the rules of the bounty program. The same bounty program that didn't cover it.

They really do be stepping over dollars to pick up pennies.

Or in this case, to save them.

AMD told MrBruh that all update communications now use HTTPS and that updates undergo signature verification. The researcher says he verified the HTTPS claim, but found only a CRC32 check on the downloaded executable, which is not considered a cryptographic signature.

This is the most shocking part. You’d think that AMD as a high-tech company has some smart people working for them. These are very basic things that any half decent programmers should get right. If at no part of the process of implementing this anyone brought up that this is not secure, that is extremely worrying and indicative of a very broken development process. It’s not like a proper cryptographic signature costs extra. This is just pure incompetence.

Advertising that you stiff smart people who know your architecture? Good luck AMD.

This is going to work out really well for AMD. Any future vulnerabilities will most certainly be reported to them, responsibly. Right?

Have they not understood what currently is happening with Microsoft?

A long time ago I felt like bug bounty programs would be an amazing way forward... Now I'm firmly in the camp of fuck it, sell it to the highest bidder.

I swear, AMD and Microsoft are two brain cells competing for third place

Again that means they don't want anyone to report or fix security plot flaws.

I don't have all the facts but based on the article I don't see the problem everyone seems upset about.

They received the report, decided it was valid but didn't match a bounty. Then asked him to follow standard responsible disclosure processes giving him credit in the final release. All very standard.

Should there have been a bounty? AMD has the budget, probably yes. But nothing in the communications seems any different from what I've seen and have received similar from companies in the past.