[resonious]

I'm kind of curious: do these bug bounty "spray and pray" tactics actually make money? I can't help but wonder if people are doing it because it works, or if it just looks like it should work and people are desperate.

[bombcar]

It’s incredibly low effort and for the people doing it even one hit in ten thousand could be multiple years’ wages.

[kstrauser]

Exactly. It's basically spam: there's nearly no cost to send it, so even an abysmal success rate is likely to return a fat profit.

I've heard that the average reward is about $500. You can afford a lot of rejections per success at that rate.

Never mind that you're destroying the effectiveness of those programs, driving staff nuts, and generally making the world less secure; that's their problem, right? (Sarcasm, obv.)