{"id":"https://openalex.org/W2513442265","doi":"https://doi.org/10.1093/cybsec/tyx008","title":"Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs","display_name":"Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs","publication_year":2017,"publication_date":"2017-06-01","ids":{"openalex":"https://openalex.org/W2513442265","doi":"https://doi.org/10.1093/cybsec/tyx008","mag":"2513442265"},"language":"en","primary_location":{"id":"doi:10.1093/cybsec/tyx008","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyx008","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/3/2/81/23721621/tyx008.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://academic.oup.com/cybersecurity/article-pdf/3/2/81/23721621/tyx008.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074585208","display_name":"Thomas Maillart","orcid":"https://orcid.org/0000-0002-5747-9927"},"institutions":[{"id":"https://openalex.org/I114457229","display_name":"University of Geneva","ror":"https://ror.org/01swzsf04","country_code":"CH","type":"education","lineage":["https://openalex.org/I114457229"]}],"countries":["CH"],"is_corresponding":true,"raw_author_name":"Thomas Maillart","raw_affiliation_strings":["Graduate School of Economics and Management, University of Geneva, Campus Biotech, 9 chemin des Mines, 1202 Geneva, Switzerland;"],"raw_orcid":"https://orcid.org/0000-0002-5747-9927","affiliations":[{"raw_affiliation_string":"Graduate School of Economics and Management, University of Geneva, Campus Biotech, 9 chemin des Mines, 1202 Geneva, Switzerland;","institution_ids":["https://openalex.org/I114457229"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041526853","display_name":"Mingyi Zhao","orcid":"https://orcid.org/0000-0002-2884-0736"},"institutions":[{"id":"https://openalex.org/I4210142583","display_name":"Snap (United States)","ror":"https://ror.org/04dgkhg68","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142583"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mingyi Zhao","raw_affiliation_strings":["Snap Inc., 63 Market St, Venice, CA 90291, USA;"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Snap Inc., 63 Market St, Venice, CA 90291, USA;","institution_ids":["https://openalex.org/I4210142583"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063714878","display_name":"Jens Gro\u00dfklags","orcid":"https://orcid.org/0000-0003-1093-1282"},"institutions":[{"id":"https://openalex.org/I62916508","display_name":"Technical University of Munich","ror":"https://ror.org/02kkvpp62","country_code":"DE","type":"education","lineage":["https://openalex.org/I62916508"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Jens Grossklags","raw_affiliation_strings":["Technical University of Munich, Department of Informatics, Chair for Cyber Trust, Boltzmannstrasse 3, 85748 Garching, Germany and"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Munich, Department of Informatics, Chair for Cyber Trust, Boltzmannstrasse 3, 85748 Garching, Germany and","institution_ids":["https://openalex.org/I62916508"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5048767056","display_name":"John Chuang","orcid":"https://orcid.org/0000-0003-4348-6226"},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"John Chuang","raw_affiliation_strings":["School of Information, University of California at Berkeley, 102 South Hall #4600, Berkeley, CA 94720-4600, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information, University of California at Berkeley, 102 South Hall #4600, Berkeley, CA 94720-4600, USA","institution_ids":["https://openalex.org/I95457486"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5074585208"],"corresponding_institution_ids":["https://openalex.org/I114457229"],"apc_list":{"value":1864,"currency":"USD","value_usd":1864},"apc_paid":{"value":1864,"currency":"USD","value_usd":1864},"fwci":20.0451,"has_fulltext":false,"cited_by_count":90,"citation_normalized_percentile":{"value":0.9908209,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"3","issue":"2","first_page":"81","last_page":"90"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9925000071525574,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.9925000071525574,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.989799976348877,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11675","display_name":"Open Source Software Innovations","score":0.9868000149726868,"subfield":{"id":"https://openalex.org/subfields/1706","display_name":"Computer Science Applications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.3849378824234009}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.3849378824234009}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1093/cybsec/tyx008","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyx008","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/3/2/81/23721621/tyx008.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:1608.03445","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1608.03445","pdf_url":"https://arxiv.org/pdf/1608.03445","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:escholarship.org/ark:/13030/qt8zf66456","is_oa":false,"landing_page_url":"https://escholarship.org/uc/item/8zf66456","pdf_url":null,"source":{"id":"https://openalex.org/S4306400115","display_name":"eScholarship (California Digital Library)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I2801248553","host_organization_name":"California Digital Library","host_organization_lineage":["https://openalex.org/I2801248553"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1093/cybsec/tyx008","is_oa":true,"landing_page_url":"https://doi.org/10.1093/cybsec/tyx008","pdf_url":"https://academic.oup.com/cybersecurity/article-pdf/3/2/81/23721621/tyx008.pdf","source":{"id":"https://openalex.org/S2735156331","display_name":"Journal of Cybersecurity","issn_l":"2057-2085","issn":["2057-2085","2057-2093"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":"cc-by-nc","license_id":"https://openalex.org/licenses/cc-by-nc","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2104930031","display_name":null,"funder_award_id":"P300P2_158462 and P3P3P2_167694","funder_id":"https://openalex.org/F4320320924","funder_display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung"},{"id":"https://openalex.org/G5078892146","display_name":null,"funder_award_id":"CCF-0424422","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5570108748","display_name":null,"funder_award_id":"PA00P2_145368","funder_id":"https://openalex.org/F4320320924","funder_display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320320924","display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung","ror":"https://ror.org/00yjd3n13"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":60,"referenced_works":["https://openalex.org/W37678429","https://openalex.org/W299061568","https://openalex.org/W1427242644","https://openalex.org/W1484422664","https://openalex.org/W1492833693","https://openalex.org/W1494498837","https://openalex.org/W1544461401","https://openalex.org/W1600918568","https://openalex.org/W1603565383","https://openalex.org/W1685057348","https://openalex.org/W1715448033","https://openalex.org/W1970005004","https://openalex.org/W1973414482","https://openalex.org/W1980215929","https://openalex.org/W1990768402","https://openalex.org/W2000042664","https://openalex.org/W2002934700","https://openalex.org/W2015715755","https://openalex.org/W2015930340","https://openalex.org/W2020831675","https://openalex.org/W2021348304","https://openalex.org/W2043284163","https://openalex.org/W2079729471","https://openalex.org/W2085659299","https://openalex.org/W2094104200","https://openalex.org/W2095402301","https://openalex.org/W2102785651","https://openalex.org/W2107449619","https://openalex.org/W2108960318","https://openalex.org/W2110617809","https://openalex.org/W2113585710","https://openalex.org/W2117405938","https://openalex.org/W2144072724","https://openalex.org/W2155597028","https://openalex.org/W2162373348","https://openalex.org/W2255889910","https://openalex.org/W2295069226","https://openalex.org/W2408364966","https://openalex.org/W2468300721","https://openalex.org/W2478595286","https://openalex.org/W2520816865","https://openalex.org/W2602737734","https://openalex.org/W2767122007","https://openalex.org/W2911307284","https://openalex.org/W2962945386","https://openalex.org/W3022734214","https://openalex.org/W3048960967","https://openalex.org/W3103362336","https://openalex.org/W3122442489","https://openalex.org/W3123365097","https://openalex.org/W4212853637","https://openalex.org/W4238219287","https://openalex.org/W4246026233","https://openalex.org/W4255589644","https://openalex.org/W4299432073","https://openalex.org/W6632695618","https://openalex.org/W6662276169","https://openalex.org/W6674428577","https://openalex.org/W6692059664","https://openalex.org/W6745623247"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Bug":[0,151],"bounty":[1,37,65,74,83,152,176,233,247],"programs":[2,38,153,189,234,253],"offer":[3],"a":[4,80,93,101,105,123,128,183,210],"modern":[5],"way":[6],"for":[7,15,22,79,171,230,254,269],"organizations":[8],"to":[9,18,91,104,138,149,226,262,272],"crowdsource":[10],"their":[11],"software":[12,126],"security,":[13],"and":[14,44,61,133,235,241,251,256,265],"security":[16,86,120,165,244,270],"researchers":[17,166,191,245,271],"be":[19,147],"fairly":[20],"rewarded":[21],"the":[23,32,55,59,70,139,157,193,198,207,275],"vulnerabilities":[24],"they":[25,41],"find.":[26],"However,":[27,178],"little":[28],"is":[29,136],"known":[30],"on":[31,110,218,274],"incentives":[33,268],"set":[34],"by":[35,72,111],"bug":[36,46,64,73,82,175,232],"\u2013":[39],"how":[40],"drive":[42],"engagement":[43,158],"new":[45],"discoveries.":[47],"This":[48,98,115],"article":[49],"provides":[50],"an":[51],"empirical":[52],"investigation":[53],"of":[54,63,96,125,131,141,159,162,195,200,209,243],"strategic":[56],"interactions":[57],"among":[58],"managers":[60],"participants":[62],"programs,":[66,248],"as":[67,69,204],"well":[68],"intermediation":[71],"platforms.":[75],"We":[76],"find":[77,180],"that":[78,118,143,181],"given":[81],"program,":[84,211],"each":[85,119],"researcher":[87,121],"can":[88],"only":[89],"expect":[90],"discover":[92],"bounded":[94],"number":[95],"bugs.":[97],"result":[99],"offers":[100,127],"validation":[102],"step":[103],"theory":[106,116],"brought":[107],"forth":[108],"early":[109],"Brady":[112],"et":[113],"al.":[114],"proposes":[117],"inspecting":[122],"piece":[124],"unique":[129],"environment":[130],"skills":[132],"mindset,":[134],"which":[135],"amenable":[137],"discovery":[140],"bugs":[142,172,202,214],"others":[144],"may":[145],"not":[146],"able":[148],"uncover.":[150],"indeed":[154],"benefit":[155,167],"from":[156,169],"large":[160],"crowds":[161],"researchers.":[163],"Conversely,":[164],"greatly":[168],"searching":[170],"in":[173],"multiple":[174],"programs.":[177],"we":[179],"following":[182],"strong":[184],"front-loading":[185],"effect,":[186],"newly":[187],"launched":[188],"attract":[190],"at":[192],"expense":[194],"older":[196],"programs:":[197],"probability":[199],"finding":[201],"decays":[203],"\u223c1/t0.4":[205],"after":[206],"launch":[208],"even":[212],"though":[213],"found":[215],"later":[216],"yield":[217],"average":[219],"higher":[220],"rewards.":[221],"Our":[222],"results":[223],"lead":[224],"us":[225],"formulate":[227],"three":[228],"recommendations":[229],"organizing":[231],"platforms:":[236],"(i)":[237],"organize":[238,252,258],"enrollment,":[239],"mobility,":[240],"renewal":[242],"across":[246],"(ii)":[249],"highlight":[250],"front-loading,":[255],"(iii)":[257],"fluid":[259],"market":[260],"transactions":[261],"reduce":[263,267],"uncertainty":[264],"thus":[266],"sell":[273],"black":[276],"market.":[277]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":12},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":12},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":13},{"year":2020,"cited_by_count":13},{"year":2019,"cited_by_count":7},{"year":2018,"cited_by_count":7},{"year":2017,"cited_by_count":4},{"year":2016,"cited_by_count":2}],"updated_date":"2026-07-25T15:57:00.446498","created_date":"2025-10-10T00:00:00"}