51–60 of 178 posts
I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.
I like the picture at the beginning of some CLI novice trying to git push his home directory
Earlier quoted context omitted.
What's a way to learn security work? Genuinely curious.
I'm not a security expert by any means, but based on learning other niche-ish areas of technology, the following probably exist for security: * Books * MOOCs * Lecture notes, slides, and assignments from university courses * Subreddits, Quora topics, etc * Prominent community members you can follow on Twitter
Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…
Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…
I don't doubt your lived experience, but for real companies, the economics of ruthlessly withdrawing bounties don't make sense; bounties just don't cost enough money to be worth picking fights over. There are some patterns where I've seen people not get paid just on general principle; for instance, people find systemic issues and, rather than disclosing the root cause, try to claim bounties for every instance of the…
> for real companies
I wouldn't consider those entirely equivalent sets. I imagine plenty of startups probably don't fall under the criteria you would consider "real companies", or at least not in the beginning before people have a chance to mature into their roles or flunk out of them.
> the economics of ruthlessly withdrawing bounties don't make sense
The economics of something and how people try to justify it or let their own egos get in the way often don't match. I mean, I still have to kick myself sometimes because while I work at a small company, agonizing over a couple hundred dollars a month in service fee differences is not a good way to spend my time given my hourly rate and the time a more expensive option might save if it does what it says. Ingrained thinking can be hard to overcome.
Earlier quoted context omitted.
> understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities. No, but it does suggest that you're likely capable of learning security work. Just like your data structure and algorithm knowledge didn't come for free, nobody is born knowing how to find security problems. You need to work for it.
What's a way to learn security work? Genuinely curious.
They have 30+ levels where you ssh into a server and attempt to find some type of vulnerability. They start out very easy and get tough quick. It’s very eye opening to see the types of exploits that exist.
They also have a set of challenges aimed at serverside web security. http://overthewire.org/wargames/natas/ I went through the web challenges last year and they helped a ton in my web dev roles.
Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…
They closed it with severity 8.8 on hackerone but the bounty wasn’t very high given how serious it was. There’s not really any sorta process for selling your bugs elsewhere though, you know?
Earlier quoted context omitted.
330K USD in San Francisco is much, much less than 300K USD in Buenos Aires
True, but consider that 70% of rentals in SF are rent controlled. It takes a couple emails from FB groups or Craigslist to find a good living situation for way below market rate. Case in point: my friend that worked at Waymo paid $900/mo for a room in a house in Lower Haight...
I wish I had a knack for this type of work. That's quite a bit of cash. I do feel I am a competent software engineer, but understanding data structures and algorithms doesn't necessarily correlate to one's ability to identify security vulnerabilities.
Beware survivorship bias, I wonder what the average hourly rate of bug hunters is?
> As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi.
---
[0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff...
[1] https://mitpress.mit.edu/books/new-solutions-cybersecurity
But damn, I wonder what Srinivasa Ramanujan or Norbert Wiener would have focused on if they were 13 now.
And maybe that's just whataboutism.