Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google launches new vulnerability reward platform

security.googleblog.com

Post reply on HN
Print view View original

11–20 of 109 posts

Re: Google launches new vulnerability reward platform

#11

Post by bostondavidvc »

Whoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards

Payouts for security-positive improvements to security-critical OSS projects:

* $20,000 for setting up continuous fuzzing with OSS-Fuzz

* $10,000 for high-impact improvements that prevent major classes of vulnerabilities

but the low end of the scale is kind of neat too:

* "$1,337 for submissions of modest complexity, or for ones that offer fairly speculative gains."

* "$500 our "one-liner special" for smaller improvements that still have a merit from the security standpoint."

... and you can qualify for these even if your day job is working on one of these OSS projects!

> Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify?

> A: They most certainly do.

Neat stuff.

(Googler here, but I don't work on the VRP.)

Re: Google launches new vulnerability reward platform

#12

Post by shadowgovt »

zibzab wrote: post #6

If only Google could run their other businesses as frictionless as this... Found an interesting bug? Let's have a 1-1 chat over lunch, drinks are on us BTW. Your developer account was banned by some bot gone wild? Sorry, no human interaction is allows in my department. Maybe if you have a famous buddy that can pester some hotshots on twitter...

It's tough; I wish I had a good solution to the latter problem. Half the trouble is the majority of what Google bans is semi-automated bot farms; the "minimal human contact" policies are to avoid making the company vulnerable to social engineering.

(That vulnerability goes deep. People would look up the phone numbers of Google offices and call with stories about kidnapped family members and the need to get into a Gmail account to find the ransom note.)

Re: Google launches new vulnerability reward platform

#13

Post by deckar01 »

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independently discovered. I would like to see status updates from developers. I would like to see some kind of shared compensation system that acknowledges it can take more than one person to investigate a problem before it is fixable and that even time spent replicating a vulnerability has value.

Re: Google launches new vulnerability reward platform

#14

Post by anonymouswacker »

deckar01 wrote: post #13

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independentl…

Sounds like a full time job vs. a gig.

Re: Google launches new vulnerability reward platform

#16

Post by Trias11 »

bostondavidvc wrote: post #11

Whoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards Payouts for security-positive improvements to security-critical OSS projects: * $20,000 for setting up continuous fuzzing with OSS-Fuzz * $10,000 for high-impact improvements that prevent major classes of vulnerabilities but the low end of the scale is kind of neat too: * "$1,337 for submissions of modest com…

1. Press [Submit]

2. Thank you for your submission, that was already known issue.

Re: Google launches new vulnerability reward platform

#18

Post by HenryKissinger »

bostondavidvc wrote: post #11

Whoa, this kind of impressed me (linked from the blog post) https://bughunters.google.com/about/patch-rewards Payouts for security-positive improvements to security-critical OSS projects: * $20,000 for setting up continuous fuzzing with OSS-Fuzz * $10,000 for high-impact improvements that prevent major classes of vulnerabilities but the low end of the scale is kind of neat too: * "$1,337 for submissions of modest com…

They need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.

Re: Google launches new vulnerability reward platform

#19

Post by jcims »

deckar01 wrote: post #13

I would rather see more transparency once you are a reporter than shinier leaderboards. It is extremely frustrating to spend a week reverse engineering a vulnerability in an opaque cloud service only to be told it was a known issue (but private), won’t be fixed (but is within 48 hours), and that you don’t qualify for any compensation. I would like to see private issues shared with reporters when they are independentl…

*Not a Google employee but have worked for a bug bounty*

I agree everything you've stated would be desirable, and if there was a strong culture and policy of supporting bounty programs from the CEO on down, this could potentially be achievable. However:

dupes - On the bounty side dupes are extremely common and buddies telling buddies about their finds is going to drive fraud up quite a bit. In my triage work I saw very clear attempts at this regularly.

wontfix - This one is largely due to the fact that many bug bounties don't have authority over or even shared reporting structure with the product teams. There's probably room for a consolation prize as long as the bug is in scope but that's about it. The fact that the bug goes away later could be a fix or could just be part of a new release. This should be extremely rare though and is worth following up with the program (again, as long as its in scope).

sharing issues - This is going to struggle mightily with legal without good contracts and NDAs for each researcher.

status updates - Agree its frustrating but is challenged by the product team/bug bounty alignment noted above. Most bounty programs don't get info from devs either and if product teams don't listen about fixing bugs the likelihood that they are going to regularly report on fixes is almost nil.

shared comp - Unless I'm missing your point you can self-organize outside of the bounty program (and many do) for this.

Post reply on HN