What is the bug?
Ask HN: How do you find developers for open source bug bounties?
51–60 of 70 posts
Re: Ask HN: How do you find developers for open source bug bounties?
#52Hey we would be happy to take this on at Hydra ( https://hydraoss.io/ ). We're an agency built for this kind of problem - finding people to fix things in open source. In contrast to a bug bounty program, we manage everything end to end, and the customer just pays us the invoice and doesn't have to deal with anything else. We specialize in Rust but we've had customers from everywhere. Let us know!
[dead]
Re: Ask HN: How do you find developers for open source bug bounties?
#53Earlier quoted context omitted.
I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.
How is it possible to make that much though? Is it like a private bounty board or something?
Big money like that is only made one way, security vulns in "software or hardware of interest", sold via brokers to 3 letter agencies (or much less scrupulous actors from time to time).
Re: Ask HN: How do you find developers for open source bug bounties?
#54https://www.bountycaster.xyz/start/bounty this is crypto-adjacent so will probably get thrown ut of HN but still, the platform is pretty incredible for finding and posting bounties both highly technical and non technical. happy to connect you to the founder if interested, maybe she can post on your behalf if you don't wanna sign up for the platform
Great app! Got a logo designed without leaving farcaster
Re: Ask HN: How do you find developers for open source bug bounties?
#55I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.
I helped out running a bug bounty program for a company whose large offering was a FOSS product a couple of years ago. Most of the people participating were either in very LCOL countries like Thailand or Montenegro, or were bored C level/founder people who would use the tiny amount of money as an incentive to keep their coding skills sharp since their day to day no longer involved coding.
Re: Ask HN: How do you find developers for open source bug bounties?
#56Igalia is a consultancy that specializes in fixing bugs/building features in Browsers. My company uses them regularly
This is the real answer.
Re: Ask HN: How do you find developers for open source bug bounties?
#57Earlier quoted context omitted.
Are you talking about fixing known bugs, or a "security bug bounty" where they are paid to report unknown security issues?
Security related vulnerabilities.
That’s very different than what the OP question is about. Both are called “bounties” though.
One is getting paid to write code that fixes bugs or adds functionality to open source projects. (Pays very little and we suspect nobody makes a living from)
The other is doing security research and reporting on vulnerabilities. Here typically no fix is provided. You are paid for the discovery. Plenty of good researchers make a living on these security bounties
Re: Ask HN: How do you find developers for open source bug bounties?
#58Companies like Collabora (for general linux stuff) and Igalia (for browser type stuff) exist to do things like this.
They employee a bunch of people who work on open-source stuff, and you can pay that company to get stuff done on various open-source projects.
The stumbling block is that the cost is almost always much much more than you would be willing to pay, because, surprise surprise, our line of work is very very expensive.
Re: Ask HN: How do you find developers for open source bug bounties?
#59Earlier quoted context omitted.
You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.
2 or 4 1k a month puts you either above or way above average salary here in Italy.
You have to compare it to being a self employed business owner instead of to a salary from a job. Half of it is going to go to taxes.
Re: Ask HN: How do you find developers for open source bug bounties?
#60Pay successful bounty submissions on a faster than net 180 time frame. A friend was interested in the rather extensive Expensify bug bounty programme [0], but the red tape involved created far too long a turnaround time between claiming a ticket and receiving compensation. [0] https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aiss...
Do they get to claim it and then work on it, or do they need to have a solution already to claim it? net 180 wouldn't be bad if you could reserve several of them to work on at a time. It'd suck to work 'for free' that first few months, but then you'd have consistent income coming in regularly after that.