{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T11:44:03Z","timestamp":1784893443258,"version":"3.55.0"},"reference-count":56,"publisher":"Oxford University Press (OUP)","issue":"2","funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CCF-0424422"],"award-info":[{"award-number":["CCF-0424422"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001711","name":"Swiss National Science Foundation","doi-asserted-by":"publisher","award":["PA00P2_145368"],"award-info":[{"award-number":["PA00P2_145368"]}],"id":[{"id":"10.13039\/501100001711","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001711","name":"Swiss National Science Foundation","doi-asserted-by":"publisher","award":["P300P2_158462 and P3P3P2_167694"],"award-info":[{"award-number":["P300P2_158462 and P3P3P2_167694"]}],"id":[{"id":"10.13039\/501100001711","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017,6,1]]},"DOI":"10.1093\/cybsec\/tyx008","type":"journal-article","created":{"date-parts":[[2017,10,14]],"date-time":"2017-10-14T07:40:41Z","timestamp":1507966841000},"page":"81-90","source":"Crossref","is-referenced-by-count":77,"title":["Given enough eyeballs, all bugs are shallow? Revisiting Eric Raymond with bug bounty programs"],"prefix":"10.1093","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5747-9927","authenticated-orcid":false,"given":"Thomas","family":"Maillart","sequence":"first","affiliation":[{"name":"Graduate School of Economics and Management, University of Geneva, Campus Biotech, 9 chemin des Mines, 1202 Geneva, Switzerland;"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyi","family":"Zhao","sequence":"additional","affiliation":[{"name":"Snap Inc., 63 Market St, Venice, CA 90291, USA;"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jens","family":"Grossklags","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Department of Informatics, Chair for Cyber Trust, Boltzmannstrasse 3, 85748 Garching, Germany and"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"John","family":"Chuang","sequence":"additional","affiliation":[{"name":"School of Information, University of California at Berkeley, 102 South Hall #4600, Berkeley, CA 94720-4600, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2017,10,13]]},"reference":[{"key":"key\n\t\t\t\t20180328135217_tyx008-B1","author":"Brady","year":"1999"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B2","author":"Greenberg","year":"2016"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B3","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1147\/rd.281.0002","article-title":"Optimizing preventive service of software products","volume":"28","author":"Adams","year":"1984","journal-title":"IBM J R&D"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B4","author":"Surowiecki","year":"2005"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B5","author":"Reed","year":"2013"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B6","doi-asserted-by":"crossref","first-page":"18949","DOI":"10.1073\/pnas.1115898108","article-title":"Algorithm discovery by protein folding game players","volume":"108","author":"Khatib","year":"2011","journal-title":"Proc Natl Acad Sci USA"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B7","volume-title":"Advances in Cryptology \u2014 EUROCRYPT 2003. EUROCRYPT 2003. Lecture Notes in Computer Science","author":"von Ahn","year":"2003"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B8","doi-asserted-by":"crossref","first-page":"879","DOI":"10.1038\/461879a","article-title":"Massively collaborative mathematics","volume":"461","author":"Gowers","year":"2009","journal-title":"Nature"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B9","first-page":"1865","author":"Cranshaw","year":"2011"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B10","volume-title":"Hackers: Heroes of the Computer Revolution","author":"Levy","year":"1984"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B11","doi-asserted-by":"crossref","first-page":"298","DOI":"10.1007\/11766155_21","volume-title":"Emerging Trends in Information and Communication Security.","author":"B\u00f6hme","year":"2006"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B12","first-page":"273","volume-title":"Proceedings of the 22nd USENIX conference on Security","author":"Finifter","year":"2013"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B13","first-page":"51","author":"Zhao","year":"2014"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B14","first-page":"1105","author":"Zhao"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B15","doi-asserted-by":"crossref","first-page":"550","DOI":"10.1109\/24.556578","article-title":"A conservative theory for long-term reliability-growth prediction [of software]","volume":"45","author":"Bishop","year":"1996","journal-title":"IEEE Trans Reliab"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B16","first-page":"173","volume-title":"Engineering Secure Software and Systems. ESSoS 2016. Lecture Notes in Computer Science","author":"Zhao","year":"2016"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B17"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B18","first-page":"332","article-title":"A Bayesian reliability growth model for computer software","volume":"22","author":"Littlewood","year":"1973","journal-title":"J R Stat Soc Ser C Appl Stat"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B19","doi-asserted-by":"crossref","first-page":"513","DOI":"10.1098\/rsta.1989.0007","article-title":"Predicting software reliability [and discussion]","volume":"327","author":"Littlewood","year":"1989","journal-title":"Phil Trans R Soc Lond A"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B20","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1145\/96267.96279","article-title":"An empirical study of the reliability of UNIX utilities","volume":"33","author":"Miller","year":"1990","journal-title":"Commun ACM"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B21","first-page":"1083","author":"Avgerinos","year":"2014"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B22","doi-asserted-by":"crossref","first-page":"218701","DOI":"10.1103\/PhysRevLett.101.218701","article-title":"Empirical tests of Zipf\u2019s law mechanism in open source Linux distribution","volume":"101","author":"Maillart","year":"2008","journal-title":"Phys Rev Lett"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B23","volume-title":"Theory of Zipf\u2019s Law and Beyond","author":"Saichev","year":"2009"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B24","author":"Hulkko","year":"2005"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B25","author":"Smith","year":"2002"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B26","first-page":"201","author":"Saleem","year":"2006"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B27","doi-asserted-by":"crossref","first-page":"84","DOI":"10.1109\/MSP.2007.159","article-title":"About penetration testing","volume":"5","author":"Bishop","year":"2007","journal-title":"IEEE Secur Priv"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B28","doi-asserted-by":"crossref","first-page":"642","DOI":"10.1287\/mnsc.1070.0771","article-title":"Optimal policy for software vulnerability disclosure","volume":"54","author":"Arora","year":"2008","journal-title":"Manag Sci"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B29","doi-asserted-by":"crossref","first-page":"171","DOI":"10.1109\/TSE.2007.26","article-title":"Efficiency of vulnerability disclosure mechanisms to disseminate vulnerability knowledge","volume":"33","author":"Cavusoglu","year":"2007","journal-title":"IEEE Trans Softw Eng"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B30","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1007\/s12130-999-1026-0","article-title":"The cathedral and the bazaar","volume":"12","author":"Raymond","year":"1999","journal-title":"Know Techn Pol"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B31","doi-asserted-by":"crossref","first-page":"1920","DOI":"10.1007\/s10664-015-9403-7","article-title":"Game of detections: How are security vulnerabilities discovered in the wild?","volume":"21","author":"Hafiz","year":"2016","journal-title":"Empir Softw Eng"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B32","volume-title":"Economics of Information Security. Advances in Information Security","author":"Jean Camp"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B33","doi-asserted-by":"crossref","first-page":"73","DOI":"10.1007\/3-540-45831-X_6","volume-title":"Infrastructure Security.","author":"Schechter","year":"2002"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B34","doi-asserted-by":"crossref","first-page":"726","DOI":"10.1287\/mnsc.1040.0357","article-title":"Market for software vulnerabilities? Think again","volume":"51","author":"Kannan","year":"2005","journal-title":"Manag Sci"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B35","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1109\/MSP.2007.180","article-title":"Vulnerability bazaar","volume":"5","author":"McKinney","year":"2007","journal-title":"IEEE Secur Priv"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B36","first-page":"43","author":"Ransbotham","year":"2012"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B37","first-page":"71","article-title":"Software vulnerability markets: Discoverers and buyers","volume":"8","author":"Algarni","year":"2014","journal-title":"Int J Comput Inf Sci Eng"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B38","author":"Ozment","year":"2004"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B39","doi-asserted-by":"crossref","first-page":"1089","DOI":"10.2307\/1911865","article-title":"A theory of auctions and competitive bidding","volume":"50","author":"Milgrom","year":"1982","journal-title":"Econometrica"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B40","author":"Pandey","year":"2014"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B41","doi-asserted-by":"crossref","first-page":"3","DOI":"10.7551\/mitpress\/5326.003.0005","volume-title":"Perspectives on Free and Open Source Software","author":"Lakhani","year":"2005"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B42","doi-asserted-by":"crossref","first-page":"161","DOI":"10.1007\/978-3-319-45741-3_9","volume-title":"Computer Security \u2014 ESORICS 2016. ESORICS 2016","author":"Laszka","year":"2016"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B43","author":"Zhao","year":"2016"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B44","article-title":"Devising effective policies for bug-bounty platforms and security vulnerability discovery","author":"Zhao","journal-title":"J Info Pol 2017"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B45","doi-asserted-by":"crossref","first-page":"056101","DOI":"10.1103\/PhysRevE.83.056101","article-title":"Quantification of deviations from rationality with heavy tails in human dynamics","volume":"83","author":"Maillart","year":"2011","journal-title":"Phys Rev E"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B46","doi-asserted-by":"crossref","first-page":"e103023.","DOI":"10.1371\/journal.pone.0103023","article-title":"How much is the whole really more than the sum of its parts? 1? 1= 2.5: Superlinear productivity in collective group actions","volume":"9","author":"Sornette","year":"2014","journal-title":"Plos One"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B47","doi-asserted-by":"crossref","first-page":"386","DOI":"10.1111\/j.1468-0335.1937.tb00002.x","article-title":"The nature of the firm","volume":"4","author":"Coase","year":"1937","journal-title":"Economica"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B48","doi-asserted-by":"crossref","first-page":"207","DOI":"10.1007\/BF02392040","article-title":"Random difference equations and renewal theory for products of random matrictfes","volume":"131","author":"Kesten","year":"1973","journal-title":"Acta Mathematica"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B49","first-page":"431","article-title":"Convergent multiplicative processes repelled from zero: Power laws and truncated power laws","volume":"7","author":"Sornette","year":"1997","journal-title":"J De Physique I"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B50","first-page":"59","article-title":"Exploring the limits of safety analysis in complex technological systems","volume":"6","author":"Sornette","year":"2013","journal-title":"IJDRR"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B51","doi-asserted-by":"crossref","first-page":"23","DOI":"10.2307\/1909829","article-title":"Exposition of a new theory on the measurement of risk","volume":"22","author":"Bernoulli","year":"1954","journal-title":"Econometrica"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B52","author":"Zetter","year":"2016"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B53","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1137\/070710111","article-title":"Power-law distributions in empirical data","volume":"51","author":"Clauset","year":"2009","journal-title":"SIAM Rev"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B54","doi-asserted-by":"crossref","first-page":"433","DOI":"10.1093\/rof\/rfn005","article-title":"Equity portfolio diversification","volume":"12","author":"Goetzmann","year":"2008","journal-title":"Rev Finance"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B55"},{"key":"key\n\t\t\t\t20180328135217_tyx008-B56","author":"Kuypers","year":"2016"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/cybersecurity\/article-pdf\/3\/2\/81\/23721621\/tyx008.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,6,27]],"date-time":"2024-06-27T19:41:02Z","timestamp":1719517262000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/3\/2\/81\/4524054"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,6,1]]},"references-count":56,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2017,10,13]]},"published-print":{"date-parts":[[2017,6,1]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyx008","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2017,6]]},"published":{"date-parts":[[2017,6,1]]}}}