Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

171–178 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#171

Post by whiskeykilo »

chronode wrote: post #59
quickthrower2 wrote: post #51

Earlier quoted context omitted.

Beware survivorship bias, I wonder what the average hourly rate of bug hunters is?

Trail of Bits has a nice summary[0] on that (they're discussing this[1] book). > As productive as the top 1% are, their earnings are equally depressing. The top seven participants in the Facebook data set averaged 0.87 bugs per month, earning an average yearly salary of $34,255; slightly less than what a pest control worker makes in Mississippi. --- [0] https://blog.trailofbits.com/2019/01/14/on-bounties-and-boff...…

The Trail of Bits piece kinda ignores the amount of time invested however: https://www.techrepublic.com/article/bug-bounty-programs-eve...

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#172

Post by alexcnwy »

vertex-four wrote: post #163
alexcnwy wrote: post #143

Earlier quoted context omitted.

The company posting the bounty. Third party verifies the bug. Why sarcastic?

Why doesn’t the third party publish the data themselves then?

The third party doesn't know about the vulnerability. Company C posts bug bounty B in contract. Researcher X discovers vulnerability. Validator Y confirms the vulnerability and X gets paid (1-f)B where f is validator fee.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#173

Post by vertex-four »

alexcnwy wrote: post #172
vertex-four wrote: post #163

Earlier quoted context omitted.

Why doesn’t the third party publish the data themselves then?

The third party doesn't know about the vulnerability. Company C posts bug bounty B in contract. Researcher X discovers vulnerability. Validator Y confirms the vulnerability and X gets paid (1-f)B where f is validator fee.

OK, so why doesn't Y hold the money as well, given that they're in the position of deciding whether or not X gets it?

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#174

Post by [deleted] »

dasil003 wrote: post #147
danschumann wrote: post #73

I wonder if anyone has "cobra effect"ed the bug bounty world yet.. whereby they leave vulnerabilities in their code in order to obtain a bug bounty.

I have never once heard of a bug bounty being paid to a former employee let alone to the same person who wrote the code. It strikes me as something that is likely to do damage to ones reputation far out of proportion the few thousands of dollars one might hope to gain.

[deleted]

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#175

Post by Moodles »

lisper wrote: post #127
glomph wrote: post #123

Earlier quoted context omitted.

They could publish a hash of the whole existing tree regularly.

Exactly. After every submission in fact.

Well no, they’d have to publish all reports which most companies don’t like doing because it makes them look very bad.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#176

Post by glomph »

Moodles wrote: post #175
lisper wrote: post #127

Earlier quoted context omitted.

Exactly. After every submission in fact.

Well no, they’d have to publish all reports which most companies don’t like doing because it makes them look very bad.

They wouldn't have to by the nature of how a Merkel tree works.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#177

Post by Moodles »

glomph wrote: post #176
Moodles wrote: post #175

Earlier quoted context omitted.

Well no, they’d have to publish all reports which most companies don’t like doing because it makes them look very bad.

They wouldn't have to by the nature of how a Merkel tree works.

Could you elaborate precisely how this scheme works to stop a company claiming reports are duplicates when they’re not?

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#178

Post by glomph »

Moodles wrote: post #177
glomph wrote: post #176

Earlier quoted context omitted.

They wouldn't have to by the nature of how a Merkel tree works.

Could you elaborate precisely how this scheme works to stop a company claiming reports are duplicates when they’re not?

If it was a duplicate they would be able to show how the hash of the duplicate report was already in the tree. For more information you might want to read about Merkel proofs. For example here: https://www.quora.com/Cryptography-How-does-a-Merkle-proof-a...
Post reply on HN