Live data from Hacker News

Ask HN: How do you find developers for open source bug bounties?

news.ycombinator.com

11–20 of 70 posts

Re: Ask HN: How do you find developers for open source bug bounties?

#11
post #8

1. git clone the project you're interested in 2. extract emails of the contributors that are involved in what you need using something like this: git log --pretty=format:"%ad - %ae - %ce" 3. make them an offer

4. keep upping the offer until they say yes note: I mean to imply, the person that asked the question likely has a budget far lower than the person qualified to do the work is willing to accept.

Bingo.

Re: Ask HN: How do you find developers for open source bug bounties?

#12
post #9

Earlier quoted context omitted.

Filing a bug report properly is work and it is easier to pay.

Seems to me, describing the problem for the person you're going to pay is the exact same amount of work as filing a bug. They can't read your mind so you'll have to detail what you want fixed. Show how to repo the problem so they can prove they fixed it. Sounds like a bug report to me

Depends. No work is involved if problem is easily reproducible. Just need to describe the bug & environment to the "bounty hunter" and they will take care of the rest. Anything more than that would necessitate filing the actual issue yourself.

Re: Ask HN: How do you find developers for open source bug bounties?

#14
I always wonder if there is anyone making a living of bounties?

I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

Re: Ask HN: How do you find developers for open source bug bounties?

#16
post #8

Earlier quoted context omitted.

4. keep upping the offer until they say yes note: I mean to imply, the person that asked the question likely has a budget far lower than the person qualified to do the work is willing to accept.

Bingo.

Open-source is often free, and it seems like a good system that projects can be initialized easily with a low cost, but to use it in a business, businesses should pay the costs of the boring production pipeline, ie the security bounties.

Re: Ask HN: How do you find developers for open source bug bounties?

#17
Finding qualifying people is hard, but with bug bounties you don't have to worry about it right? You only pay when you approve that PR..

I've seen algora being used a lot by many popular projects and recently heard about polar.sh also supporting bug bounties.

Re: Ask HN: How do you find developers for open source bug bounties?

#18
There isn’t a market for that, really. You can open bounties for your project and this might interest some developers to do some work with their goal of being hired, eventually. Or maybe they are looking to build a portfolio but then they’ll be picking the bounties to solve. Or the problems are kinda repetitive, so that they can solve the $200 bounty in a single day and they can make it work at scale.

What you are asking for seems very specific, however. It’ll cost thousands in developer hours just to understand the bug and determine if it is really a bug. That assuming you find the right person for this job.

Your best bet is to try and work it out with the chromium team. They are already on Google’s payroll and that’s their job.

Re: Ask HN: How do you find developers for open source bug bounties?

#19

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

Re: Ask HN: How do you find developers for open source bug bounties?

#20

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

How is it possible to make that much though? Is it like a private bounty board or something?
Post reply on HN