Sounds like he’s gotten bug bounties from MS in the past. Might be forward thinking to keep the relationship amicable going forward.

Giving the benefit of the doubt to Microsoft it seems like a pretty complete write up. If the changes weren’t material that might have been part of it too.

And he’s 16. Parents might have had a say.

Also he's 16. I'd definitely be less willing to push back (especially on something like this) at his age

Not getting your life ruined by getting sued by a trillion dollar company sounds like a pretty good motivation

Speaking of being sue, I once found a hole in a healthcare system. I solicited legal advice and the response was overwhelmingly against reporting. The company didn’t not have a bounty program. So I shut up knowing my info is sitting there exposed. I wonder what’s the consensus on this? Do people normally report it or not?

On some forms I was advised to report hippa complaint. I can’t remember if I did. This was 10 or more years ago.

i think the answer is simple: they're a kid, and microsoft bullied them.

Would love to hear more.

[dead]

This is correct. I've made well over six figures over the last couple of years through bug bounty programs. I wouldn't spend months finding one bug. It's usually days or a week or two max.

$5,000 is actually pretty normal for a critical. I think the most I received for one bug was around $10,000, but this is the exception.

AI has also ruined the market. I'm a security consultant (where I make most of my money) and stopped bug bounty once AI slop reports made it impossible to actually get anything triaged in a timely manner.

Something else many don't know is that with all of the major platforms, customers can see the bugs before they are even triaged by the platform team. Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.

thats the true market value of bug bounty awards

the unilaterally set awards by the affected corporation are far lower and based on the price of the researcher’s liability

Try 10-20 million USD for a zero click iPhone exploit.

Per their market cap...

3.85 billion is actually closer to a "penny" for Microsoft.

Some do pay that kind of money. You just don’t hear about those, and there’s certainly no blog posts about them.

many of these people want to work in security, selling to the black market will legally and professionally screw you.

> quite literally peanuts

If I have an income of $250k/yr and a pack of peanuts costs $2 or very roughly 0.001% of my annual income, the equivalent peanut money for ~$130 billion a year microsoft would be more like $2 million.

"all he did was scrape PDFs for mostly public funded / tax funded papers"

He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.

We shouldn't support theft and he should have gotten some jail time/punishment for it.

"There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."

Too many 'security researchers' demand money or threaten to release the vulnerabilities.

I don't know anyone that got into trouble going through a legit bug bounty program.

His comment didn’t assume that at all.

Physical security vendors usually stop exactly there. I can't count how many vendors responsible for badge systems shut off the Windows Firewall just because it’s easier than adding a rule.

Honestly that series of blog posts that came across here semi-recently about what an utter disaster the Azure team is (through little fault of their own, mind you), combined with a lot of things I've read about the development behind Halo Infinite, have convinced me Microsoft is to avoided whenever possible. It's not even that they're too big to care, though that is an issue. It's that organizationally they are SO reliant on short-term contractors and junior devs plugging away with copilot, along with an ever more exhausted group of seniors who actually work for them but are continually disempowered, that I think it's safe to say anything they manage to ship is a minor miracle if it works at all, and it's certainly not going to have any guarantee at all of solid software engineering fundamentals.

And to be clear, this is not an issue with them using contractors, overseas or otherwise, or with their senior dev staff, or even with AI really. It's an issue with them organizationally being so incredibly penny-pinching, and so dedicated to shipping new shit versus fixing anything long term, constantly chasing new revenue and letting their existing offerings rot.

If a Microsoft product is good nowadays, it is literally a miracle.

You assume there is any actual reason to care more than that in this case.

And all of that is definitely happening.

That being said, just last night I observed that the identity team is now opening up agent-assisted PRs against individual service team repos to force MISE adoption and upgrade to the latest version and best practices. I think that's a great thing because many individual service teams simply lack the bandwidth or knowledge. Prior to GenAI availability I wasted many cycles on this kind of work. While GenAI made it easier - internal source documentation still does not unambiguously address every use case. So having the identity team drive this now with the help of agent sessions initiated by them is great.

They did verify the signature, and it was correct according to the "none" algorithm.

JWT is complicated.

Complexity is a spec failure in security issues.

It's that simple.

Pretty confusing, there is a Cisco Antares small language model... https://blogs.cisco.com/ai/introducing-antares-the-most-effi...

Guess everything is just going to be named after stars for awhile.

Well college isn’t worth it according to the Thiel crowd so maybe this will be better.

Great way to use up that 6-10 years of vacation and sabbatical time.

Prefixing saying something with "Two quick notes first" is extremely common AI meta commentary. You may be right that it is something Microsoft insisted he put at the top, which would also explain the weird style.

It's not a "normal" sentence and is quite clearly produced by an LLM, it's a typical Claudeism so probably that. The entire post is also flagged by Pangram, so OP is correct.

  > microsoft authored post
  > clickbait headline
  > slop writing
  > some kid

He’s fine to use the AI for bug hunting but nobody wants to read AI’s bullshit slop and tone

I pasted the thread into ChatGPT and here is what it would like to tell you:

The comment explicitly says, “I am the last person to judge someone for using AI to help them write a blog post.” The criticism is about the quality of the published prose and whether anyone reviewed it before putting their name on it.

You can dispute whether that sentence is bad or whether it indicates AI authorship. But “why criticize unedited AI prose when HN talks about AI so much?” doesn’t identify a contradiction. Discussing a technology doesn’t imply endorsing every use of it, and criticizing its output isn’t the same as vilifying someone for using it.

— GPT-6.1 Sol

Now some blackhat somewhere can't afford their monthly Lamborghini payment.