A few reward options come to mind....

1) Skill Points for small things. Hell, this would work great for reporting bots (at 1,000 SP for each verified bot report, you may just introduce a new profession....) but for the "small things", I think SP would be appropriate.

2) PLEX, but in 1-week increments....not only the 30-day version.

3) For people who actually use AUR (meaning they ask for this reward type), a deposit into their AUR account. Since the items aren't game changing anyway, this would let those who want to use it to have a way to increase what they have now.

Just what comes to mind...

That's pretty much essentially what we'd consider enabling, but as you so eloquently pointed out there are significant moving parts that need to be coordinated in order for that to happen, which is why I haven't firmly committed to it.

Screegs


YOU BEEN HAZED!

Sounds interesting. Or at least allow people to easily get permissions to poke around a little, basically a mechanism where I could say "I'd like to do some weird things to your forums and, if I find anything, I'll report it back to you. In turn, you won't ban me for trying" would be cool.

That said, I'm glad you are trying to get the community involved. Nice devblog.

Posting on the forums about it - This is also a bad idea. A really really bad idea as it is essentially an open disclosure, which leaves the system vulnerable to exploitation via the detailed method for the window it takes us to notice your post on the forums.

Filing a bug report - This suffers from a similar malady to the first. A lot of information comes into both of these systems and we wouldn't be doing anyone a service by spending our days weeding through bug reports.

not like the system is already vulnerable to exploitation before the vulnerability is discovered & reported, amirite?

I don't have a set position on responsible vs immediate (full) disclosure but I think it needs to be acknowledged that while immediate disclosure may increase the probability of the vulnerability being actually exploited it also tends to minimize the time that the system is vulnerable (by applying maximum pressure to the developers) and gives users the ability to take precautions much faster/earlier than any company could issue them an advisory.

The vulnerability does not start to exist when it is reported for the first time - if anything it becomes much less threatening once it has been reported and is known about (as users can then start to take precautions/use workarounds).

Assume I experience a bug "visiting website xyz in the IGB does sometimes make the browser "hang" (have to restart client to fix this) and leads in rare cases to a BSoD".
I file a bug report describing this behavior and expressing mild annoyance at CCP for releasing such a shoddy product, the bug gets verified by volunteers or CCP staff, gets assigned to CCP's IGB team, gets prioritized ("only one website of over 9000 is known to cause this issue, telemetry says only three users experienced client crashes due to it in the last month") and some CCP dev will grab the bug report and look into it whenever he gets around to doing so.

My guess would be that many users experience glitchy behavior due to accidentally triggering vulnerabilities and (if you are lucky) report it as a bug without thinking of it as more than a harmless but annoying glitch.

Shouldn't there be some process of screening incoming bug reports for signs of potential vulnerabilities and fast-track those that might point towards a security issue?

All code that is written is peer reviewed and subject to rounds of internal testing. Prior to publication of the code, a reputable third party performs a vulnerability analysis of the codebase that will be published.

Given how things played out with the first release of the new forums, I can conclude one of several things:

1. The procedures (above) were not in place at the time, and thus the peer and 3rd party reviews did not occur.
2. The procedures were in place but were not followed.
3. The "peers" and "reputable third parties" were incompetent.
4. The peers and/or 3rd parties reported the blatant security problems but CCP chose to do nothing.

Care to tell us which it was?

MDD

Yeah let me get right on that.

incentivizing

I cant decide if you got that from The Buzzword Dictionary or The Dictionary of Corporate Bullsh!t.


Both available on Amazon if anyone is interested.

Report one significant issue: how much time was invested by the player in researching the exploit? How much time was invested in internal research to verify the exploit? If released publicly, how much damage could have been caused? Math: (Invested time * damage multiplier) / 20% fairness = reward in PLEX rounded up

Asking the EVE community for help in fixing security issues after banning Helicity Bonson for doing exact this could only be some kind of a hilarious troll.

You guys have some strange humor...

//off topic
The new forum is less useful/handy/effective than the old one.