The Chrome VRP Panel has decided to award $250k for this report
issues.chromium.org
The Chrome VRP Panel has decided to award $250k for this report
1–10 of 292 posts
Re: The Chrome VRP Panel has decided to award $250k for this report
#2[deleted]
Re: The Chrome VRP Panel has decided to award $250k for this report
#3[deleted]
Re: The Chrome VRP Panel has decided to award $250k for this report
#4How does one start acquiring skills like these?
Re: The Chrome VRP Panel has decided to award $250k for this report
#5Impressive. Feel like finding issues like this in such a large project is like looking for a needle in a haystack
Re: The Chrome VRP Panel has decided to award $250k for this report
#6Kind of life changing money, good to see such rewards
Re: The Chrome VRP Panel has decided to award $250k for this report
#7How does one start acquiring skills like these?
Practice, and having supernatural perseverance (although probably not in that order)
I'd guess the curriculum is half reverse engineering and half reading any write-ups to see the attacks and areas of attack for inspiration
Re: The Chrome VRP Panel has decided to award $250k for this report
#8"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0].
A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the verge of "maybe they should have paid more?", the numbers would mean that even 10x the sum would move the percentage by one decimal. It's wild how much money big corporations have.
I highly applaud the researcher for their tremendous amount of skill and dedication.
[0] https://www.reddit.com/r/google/comments/1lh0pl4/google_is_n...
Re: The Chrome VRP Panel has decided to award $250k for this report
#9"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…
How much Alphabet makes is almost irrelevant. The incentive here should be for security researchers. As long as there's enough incentive for security researchers to continue to report the bugs they find (which must be balanced against the potential payment a criminal could get if exploiting the bug, which is not directly correlated to the company's income either, at least not necessarily), the payment is appropriate.
Re: The Chrome VRP Panel has decided to award $250k for this report
#10"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…
These types of comparisons are illogical.
There’s little relationship between the net income of a company and what is an appropriate bug bounty, especially a company as diversified as alphabet.