payment??
very bad idea, that just sounds like blackmail to me... having said that, some sort of "code licence" sounds very intriguing, tho I suspect there's too much intertia for it to get anywhere
Consider this scenario:
- Researcher finds vulnerability.
- Researcher notifies company.
- Company determines it's valid, but that noone is exploiting it, and so schedules the fix for the next scheduled update*.
- Researcher thinks this is too far away, releases vuln. details, company releases fix faster.
In this situation, it can be argued the researcher has done harm, because now the details are out on the web. Sure, the fix is out too, but "fix available" doesn't equate to "user machines protected", especially if it's an out-of-band release.
*We do all agree that regular update cycles are a Good Thing, yes? Because by giving companies a chance to plan updates there's the possibility they might actually install them, rather than going "these might break something, we'd better play it safe" as they trickle in?