| I'd be curious to know what those same folks think regular security staff should be paid. From another thread here, the author talking about the time involved: >Two to three hours discovering and writing the initial report, couple more hours (unsuccessfully) trying to escalate it using pre-approved apps. I'll round his estimate up to 6-8 hours, or basically a normal work day: $5000 / 8 = $625 an hour $625 * 40(hour work-week) * 50(weeks) = $1,250,000 annually Let's say it took an entire week's worth of time (comes out at $125/hour): $5000 * 50 = $250,000 Is that range wildly out of line for what Facebook would potentially be paying for a full-time employee? The actual salary number would probably be lower, this would be including the cost taxes/insurance/perks/etc. Even as a contractor, where the "expect to bill ~1000 hours a year" rule of thumb is/was common, puts the range at $125,000-$625,000. Seems as though if you can reliably find organizations willing to pay these amounts and have the skill/luck/grit to grind out vulnerabilities at those companies you'll make a decent living. Or, put another way, these company's are paying bounties comparable to what the same research would have cost coming from a staff member. |