MS: No bucks for bugs

Unlike its peers, Microsoft will not pay security researchers a reward for bringing bugs to its attention.

Mozilla recently said it was raising its bug bounty to USD 3,000, and Google followed suite, jacking its top price up to USD 3,133.7.

In a blog post, however, Microsoft said that it regularly tackles questions about whether it should pay rewards when people point them out to it, but explained that it chooses to reward them in non-monetary ways.

"Throughout the years we've seen researchers saying that, if vendors really valued their work, we'd compensate them directly for the vulnerabilities they discover. That's a trend that's continued in recent weeks. We absolutely value the researcher ecosystem, and show that in a variety of ways."

One of the firm's arguments is that they could not afford to pay out on all the bugs that people report. And indeed, the team posted about the sheer weight of emails it gets on the subject. The Microsoft Security Response Center (MSRC) receives more than 100,000 email messages per year, according to the post. That is roughly 275 a day or 11 an hour. Although some of these will be found to be unproved, the team explained that it filters these reports down to 1,000 investigations a year.

Source: V3.co.uk.