Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you find developers for open source bug bounties?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Ask HN: How do you find developers for open source bug bounties?

#41

Post by scarlehoff »

chrisldgk wrote: post #28
CJefferson wrote: post #21

Not the same question, but related. Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs. I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element). It would re…

We’ve found him, we’ve found the one guy that likes debugging. Honestly though, good for you. There need to be more people like this in the world.

I love it too! As another commenter says, it's like a murder mistery, specially when it is not your code. The only frustrating bit (at least for me) is being just told "there's a crash around here", but once you have a way to reliably reproduce it I enjoy it quite a bit.

Re: Ask HN: How do you find developers for open source bug bounties?

#43

Post by ayushm2003 »

https://www.bountycaster.xyz/start/bounty

this is crypto-adjacent so will probably get thrown ut of HN but still, the platform is pretty incredible for finding and posting bounties both highly technical and non technical. happy to connect you to the founder if interested, maybe she can post on your behalf if you don't wanna sign up for the platform

Re: Ask HN: How do you find developers for open source bug bounties?

#44

Post by ayewo »

There are a number of ways you could approach this.

1. Post here on HN. On the 1st work day of every month, the whoishiring bot posts 3 Ask HN threads and you can use the Ask HN: Freelancer? Seeking freelancer? thread to post an ad stating the specific skills that you are looking for. You are more likely to get inquiries if you include a budget. Here are 2 examples: https://news.ycombinator.com/item?id=38846044 (Jan 2024) and https://news.ycombinator.com/item?id=38514744 (Dec 2023).

2. There is also Algora (https://console.algora.io/) and they support the very use case you are asking about though they have a take rate of about 25% for each bounty[1].

Here's an example of Scott Chacon using Algora to sponsor a bounty in the Zed repo https://github.com/zed-industries/zed/issues/4440. He posted about his experience on Twitter here: https://x.com/chacon/status/1770005036170375594.

3. One limitation of Algora mentioned in #2 is that there is a high representation of application software (web apps, desktop apps etc) compared to system software (web browsers, databases etc) meaning many of the bounties available are in "mainstream" languages like JavaScript/TypeScript, Golang, Rust. There are only a handful of bounties that require C/C++ expertise (which I imagine is what you'll need to work on Chromium) so it might be a struggle to get the right developers on Algora. One solution would be to post the bounty on Algora then do targeted outreach in WebRTC communities so the bounty can reach the right audience. For instance, Sean DuBois, who runs the Pion WebRTC community, has posted in the past on behalf of WebRTC folks looking for a role e.g. https://x.com/_pion/status/1780286789074252176 so you could consider reaching out to him and similar communities to see if they can help with match-making folks that might be interested in your bounty.

1: https://github.com/nuxt/nuxt/issues/15639#issuecomment-19866...

Re: Ask HN: How do you find developers for open source bug bounties?

#45

Post by kazinator »

maccard wrote: post #31
kazinator wrote: post #27

Earlier quoted context omitted.

You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.

$4000/mo pre-tax is an above average salary for the UK. You'd live just fine in most places in the UK (london aside).

Are you including two kids and a retirement plan in the picture?

Re: Ask HN: How do you find developers for open source bug bounties?

#46

Post by eitland »

ungamedplayer wrote: post #39
eitland wrote: post #30

Earlier quoted context omitted.

Ey, next to teaching it is the favorite part of my profession! (I like modeling systems and greenfield development as well, but I feel my time is absolutely best utilized when I can train others or crack hard bugs that are worth paying someone good money to crack.)

Please add me to your newsletter.

I can't find your email address, send me a mail if you want.

Re: Ask HN: How do you find developers for open source bug bounties?

#47

Post by em-bee »

CJefferson wrote: post #21

Not the same question, but related. Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs. I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element). It would re…

i like debugging too. the problem is, when it's unfamiliar tech then it can take some time to get familiar with it. but i found that when i was unable to find a solution, i was to embarrassed to ask to get paid, so i realized that "no fix, no fee" is ok for me. i just have to estimate the risk involved. how much time can i afford to work on this problem if i don't get paid. in part that is influenced by how much i am interested in learning that tech.

Re: Ask HN: How do you find developers for open source bug bounties?

#48

Post by rsingireddy »

Hey we would be happy to take this on at Hydra (https://hydraoss.io/). We're an agency built for this kind of problem - finding people to fix things in open source. In contrast to a bug bounty program, we manage everything end to end, and the customer just pays us the invoice and doesn't have to deal with anything else. We specialize in Rust but we've had customers from everywhere. Let us know!

Re: Ask HN: How do you find developers for open source bug bounties?

#49

Post by bashwizard »

newaccount74 wrote: post #23
bashwizard wrote: post #19

Earlier quoted context omitted.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

Can you elaborate? Who are these people? What kind of bounties do these people go after? Do they work on lots of small bounties or focus on a few big bounties? Do you personally know these people or are you just talking about the security researchers who discovered high impact issues in iOS?

I know some of them in person as I'm involved in the bug bounty scene myself. What they work on varies depending on skill set and interest. I do not personally know any security researchers with high impact vulnerabilites in iOS but those people get paid millions and you'll never hear about them.

What I do know is that they tend to sell their exploits through exploit brokers like Zerodium.

Re: Ask HN: How do you find developers for open source bug bounties?

#50

Post by bashwizard »

andruby wrote: post #40
bashwizard wrote: post #19

Earlier quoted context omitted.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

Are you talking about fixing known bugs, or a "security bug bounty" where they are paid to report unknown security issues?

Security related vulnerabilities.
Post reply on HN