Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you find developers for open source bug bounties?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 70 posts

Re: Ask HN: How do you find developers for open source bug bounties?

#21

Post by CJefferson »

Not the same question, but related.

Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs.

I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element).

It would require the company giving out their source code to me, and giving me a way to build it, so I imagine in most situations it wouldn't be worth the effort, unless the bug was absolutely mission-critical.

Re: Ask HN: How do you find developers for open source bug bounties?

#22

Post by ptsneves »

bashwizard wrote: post #19
newaccount74 wrote: post #14

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

This sounds like they are a known figure in the project and are offered consultancy jobs. When I had a company that is what I did when I needed something fixed. It was not cheap either. The point being yes it is possible but it is not a bounty board like in the city town hall.

Anyway I find it a bit weird the topic is asked at all. Why didn’t the OP just cold contacted committers?

Re: Ask HN: How do you find developers for open source bug bounties?

#23

Post by newaccount74 »

bashwizard wrote: post #19
newaccount74 wrote: post #14

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

Can you elaborate? Who are these people? What kind of bounties do these people go after? Do they work on lots of small bounties or focus on a few big bounties? Do you personally know these people or are you just talking about the security researchers who discovered high impact issues in iOS?

Re: Ask HN: How do you find developers for open source bug bounties?

#24

Post by DocTomoe »

chrommmer wrote: post #5

> There's a WebRTC Chromium bug that is making life difficult for us. I'd like to pay a developer to fix it, but I don't know where/how to find people. Have you filed a bug in the project's issue tracker? Has the project team not followed up? Is there a link to this issue?

I have stopped writing bug reports altogether.

I believe to write good bug reports, and put serious effort in it to provide test cases, describe the environment the bug thrives in, make assumptions on what may be wrong, etc. A good bug report takes half an hour of my time, easily. Only to then be ignored for 15+ years and eventually silently closed because "we don't use that architecture anymore". Looking at you, KDE, and Atlassian (= the problem exists regardless on the monetarization format).

It's just no longer worth my time.

Re: Ask HN: How do you find developers for open source bug bounties?

#26

Post by k__ »

newaccount74 wrote: post #14

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

Depends on what you call "a living".

You probably won't get rich from doing $500 bug bounties.

But there are hackathons with bounties in the $1000-$10000 range.

Do 2-4 of those per month and you're good.

Re: Ask HN: How do you find developers for open source bug bounties?

#27

Post by kazinator »

k__ wrote: post #26
newaccount74 wrote: post #14

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

Depends on what you call "a living". You probably won't get rich from doing $500 bug bounties. But there are hackathons with bounties in the $1000-$10000 range. Do 2-4 of those per month and you're good.

You're not good if they are very close to the bottom of your range.

Unless you live in a hut in Thailand or something.

Re: Ask HN: How do you find developers for open source bug bounties?

#28

Post by chrisldgk »

CJefferson wrote: post #21

Not the same question, but related. Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs. I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element). It would re…

We’ve found him, we’ve found the one guy that likes debugging. Honestly though, good for you. There need to be more people like this in the world.

Re: Ask HN: How do you find developers for open source bug bounties?

#29

Post by manuelmoreale »

kazinator wrote: post #27
k__ wrote: post #26

Earlier quoted context omitted.

Depends on what you call "a living". You probably won't get rich from doing $500 bug bounties. But there are hackathons with bounties in the $1000-$10000 range. Do 2-4 of those per month and you're good.

You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.

2 or 4 1k a month puts you either above or way above average salary here in Italy.

Re: Ask HN: How do you find developers for open source bug bounties?

#30

Post by eitland »

chrisldgk wrote: post #28
CJefferson wrote: post #21

Not the same question, but related. Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs. I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element). It would re…

We’ve found him, we’ve found the one guy that likes debugging. Honestly though, good for you. There need to be more people like this in the world.

Ey, next to teaching it is the favorite part of my profession!

(I like modeling systems and greenfield development as well, but I feel my time is absolutely best utilized when I can train others or crack hard bugs that are worth paying someone good money to crack.)

Post reply on HN