They get recognition in the hotfix documentation and the security bulletin. Often this recognition goes to those individuals/organizations that actually try to work with MS in resolving the flaw, instead of seeking publicity by going public with full information on how to perform the exploit after sending MS notification only a week earlier.
Some people don't understand that it takes time for MS to regression test the fixes they create to see if the fix breaks something. Then, more time must be taken to backport the fix from the latest affected platform/application to all previous supported platforms, and regression test those platforms as well. Plus, there is most likely a backlog of other security issues/bugs they are currently working on. The submitted bug isn't the only bug they have to work on. This is a lot of work and often cannot always be accomplished within a week's (or month's) time. Though MS is large, it devides its workers into small, focused teams with limitations. And with flaws, such as the SSL problem, the bug finders thought the problem was with IE, when, in fact, it was an OS problem. Things like this take time to assess. MS has clients that would rather have a tested, supported fix, than a quickly compiled patch that breaks the OS or other applications.
I don't think cash is a good idea. It creates a situation where the people may report anything (not to mention the quality-level of the reports possibly deminishing) in hopes of getting "free" cash. Then there will be arguments and bad PR over who reported a flaw/exploit first. MS may provide some type(s) of reward other than recognition for organizations, etc. that help them, but if they do, it is good that it isn't publicized.
This post was edited by n4cer on Saturday, August 17, 2002 at 12:47.
|