Facebook bug bounty: secondary damage bugs and fairness (opens in new tab)

I'd say the biggest impact is that it encourages a behavior that a lot of people people tend to show anyways: If we find a bug, most of us are inclined to report it, not abuse it. I'd assume that a lot of people tend not to report bugs when they have the feeling that it only costs them time for no benefit. Now, with a bug bounty you're shifting the equation towards the desired outcome: Taking an hour of your time to write a bug report can actually pay off for you, even if only one in five bugs get the minimum reward. Granted, you could sell a critical exploit for much more money, but most humans are intrinsically biased to do "the right thing" and by rewarding people for doing the right thing and making that reward public, you're reinforcing that bias.

It's still a cheap way to get bug reports, but I don't think it's about replacing QA. It's about creating a climate where bugs missed by QA have an increased likelyhood to end up on your desk since no QA could ever find all bugs.

Are bug bounty programs really all that much less work? My impression is that the offer of money tends to attract a ton of hard-to-decipher half-baked submissions, and someone's got to dig through them all to separate the wheat from the chaff.

(I mean, I used to work on a product that was used exclusively by engineers, and some of the bug reports I got were nearly impossible to decipher. Open that to the general public, on a product used by bored teenagers who like to prank each other, and offer money on top of it, and it seems like hell on earth.)

I agree with this - yet BB programs are still very successful. Why? Because not everyone who knows about websec has a job in the field. The second thing is, $500 as a minimum reward may seem small in 1st world countries, but in the rest it is close to the average monthly pay.

In my experience, the bugs that get bug bounties are not the kind that QA departments find. Unless you have an extremely technical QA department.

Still, if they make everyone happy, both the person finding the bug and the company, I don't see why they would be a problem.