1. git clone the project you're interested in 2. extract emails of the contributors that are involved in what you need using something like this: git log --pretty=format:"%ad - %ae - %ce" 3. make them an offer
4. keep upping the offer until they say yes note: I mean to imply, the person that asked the question likely has a budget far lower than the person qualified to do the work is willing to accept.
Ask HN: How do you find developers for open source bug bounties?
11–20 of 70 posts
Re: Ask HN: How do you find developers for open source bug bounties?
#12Earlier quoted context omitted.
Filing a bug report properly is work and it is easier to pay.
Seems to me, describing the problem for the person you're going to pay is the exact same amount of work as filing a bug. They can't read your mind so you'll have to detail what you want fixed. Show how to repo the problem so they can prove they fixed it. Sounds like a bug report to me
Re: Ask HN: How do you find developers for open source bug bounties?
#13Re: Ask HN: How do you find developers for open source bug bounties?
#14I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.
Re: Ask HN: How do you find developers for open source bug bounties?
#15Re: Ask HN: How do you find developers for open source bug bounties?
#16Earlier quoted context omitted.
4. keep upping the offer until they say yes note: I mean to imply, the person that asked the question likely has a budget far lower than the person qualified to do the work is willing to accept.
Bingo.
Re: Ask HN: How do you find developers for open source bug bounties?
#17I've seen algora being used a lot by many popular projects and recently heard about polar.sh also supporting bug bounties.
Re: Ask HN: How do you find developers for open source bug bounties?
#18What you are asking for seems very specific, however. It’ll cost thousands in developer hours just to understand the bug and determine if it is really a bug. That assuming you find the right person for this job.
Your best bet is to try and work it out with the chromium team. They are already on Google’s payroll and that’s their job.
Re: Ask HN: How do you find developers for open source bug bounties?
#19I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.
Re: Ask HN: How do you find developers for open source bug bounties?
#20I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.
I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.