Google pays bugbusters

Pay for monkies?

The issue seems to be the amounts involved. Both companies are paying a bounty of $500 for anyone who finds a bug, although if it's a big one the cash can be better.

A number of Stateside commentators, however, are complaining that this isn't high enough. Staking a company's future on expertise that's going to work out at such a low day rate is a bad idea, they reckon.

In principle they're right. In practice there are so many hackers out there testing vulnerabilities for the hell of it, it's difficult to see the flaw in the plan. Many people try to break systems just for kicks. In fact a game writer I met once suggested the economy should be designed by gamers, because they understood that people will always try to find a weak point in a system.

So, how much?

The objectors don't seem to be coming up with an alternative pay structure, mind you. What sort of rate you should pay someone for finding out your system is vulnerable is up for debate – if you've hacked into the Pentagon, for example, you tend to get threatened with extradition rather than paid.

What this exposes is that various software companies have for some time been getting leads on how to improve their offerings for nothing. On the one hand this is great use of the social media ethic – on the other, it's a lot of effort that ends up boosting someone's share price for free.

Microsoft, meanwhile, isn't going to join in the fun. It's not that it believes its Internet Explorer browser is impregnable, far from it; it just thinks offering to pay saboteurs (effectively) inhibits a healthy ecosystem.

Links (open new windows)

Google
Microsoft
Mozilla