Seth Rosenblatt wrote:

 

http://asset2.cbsistatic.com/cnwk.1d/i/tim/2012/01/03/howto-virusScan.jpg

 

Two million bucks doled out in increments of a few hundred to a few thousand dollars is no quick way to make a fortune. But if you're a security researcher who enjoys finding holes in code, Google's Vulnerability Rewards Program is a way to add some profit to your fun.

The company announced Monday that the program has been so successful that it is "significantly"

The pair also notes that the initiative has resulted in "leading standards" (PDF) in security response time. It's been a key component in Google's Chrome pitch: that the browser is not only faster, but more secure.

Google's bug bounty program is actually two programs, both started in 2010. The Chromium VRP serves the open-source foundation of Google Chrome, while the second is for Google's other Web sites. Each has netted researchers some extra beer money to the tune of more than $1 million each.

Bonuses for detailed reporting or patching a critical bug will continue to be offered. The program also has inspired, or at least predates, similar programs at other major Web sites. Facebook recently announced that its two-year-old bug bounty program, launched in 2011, has scored 329 security researchers more than $1 million.

Bug bounty programs are mutually beneficial to researchers and the companies they're helping. Not only are researchers getting paid for their work, but the companies are also keeping potentially severely damaging bugs off of the vulnerability black market.