Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

21–30 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#23

Post by MrGilbert »

brabel wrote: post #9
MrGilbert wrote: post #8

"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…

How much Alphabet makes is almost irrelevant. The incentive here should be for security researchers. As long as there's enough incentive for security researchers to continue to report the bugs they find (which must be balanced against the potential payment a criminal could get if exploiting the bug, which is not directly correlated to the company's income either, at least not necessarily), the payment is appropriate.

> How much Alphabet makes is almost irrelevant.

While I embrace the downvotes, I disagree. From my pov, the amount of money paid should factor in the anticipated risk for your business. If a privilege escalation means that Google takes a massive hit in Ad Revenue, than this should be factored in.

Re: The Chrome VRP Panel has decided to award $250k for this report

#25

Post by lmz »

renewiltord wrote: post #17
MrGilbert wrote: post #8

"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…

Indeed, one of the great tragedies of life is that this happens. Humans cannot survive without water, yet the median water bill is $80, which is about 1% of the median household's income. People make so much money but refuse to pay for something that literally sustains their life. Join me in requiring that every household at least 10x the amount they pay for this precious water. To employees of water companies: Thank…

Have you also considered how much humans ought to be paying the trees for their Oxygen? I may look into buying some shares in those trees if they are available.

Re: The Chrome VRP Panel has decided to award $250k for this report

#26

Post by MrGilbert »

bapak wrote: post #15
MrGilbert wrote: post #8

"Decent." was the first word that came into my mind. After a second, I realized that 250,000 USD ist basically 0.00022 % of Alphabet's (Google's?) annual net income [0]. A life changing amount of money for an individual, but nothing more than a small blip on Google's charts. Of course, I'm aware of "budgets" and "departments", and that one simply does not move funds between departments. And while my mind is on the ve…

What's your suggestion exactly? Making anyone who can find a bug a millionaire? That's ridiculous. 250k is already insanely high. You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

> You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

Looking at my yearly net income, paying 100$ for a single taco in a year would mean that 0.26% of my net income would go into a taco. Paying 0.1$ for a single taco would make it 0.00026%. According to the consensus in this comment section, that would be pretty gracious. Yes, that's where I'm going with this.

//Edit: Thanks at postflopclarity for pointing out my wrong math.

Re: The Chrome VRP Panel has decided to award $250k for this report

#28

Post by kafrofrite »

colbyn wrote: post #22

Suppose someone wanted to dive into other projects with the ambition of finding high value bugs. Besides chromium what would you recommend or consider? What would be your thought process for deciding what projects to look into?

The answer to your question is WebKit (because iOS), kernels (XNU, Linux, Windows) etc. In case you are not familiar with the domain I'd start with user-space exploitation and relevant write ups to get my feet wet. You'll find plenty of write ups, blogs etc. so I'll skip those. Some of the books I generally found interesting are [1],[2], [3]. There's more to that, including fundamental concepts of CS (e.g., compilers and optimization in JITs, OS architecture etc.). I believe also https://p.ost2.fyi/dashboard has some relevant training.

[1] https://nostarch.com/zero-day

[2] https://nostarch.com/hacking2.htm

[3] https://ia801309.us.archive.org/26/items/Wiley.The.Shellcode...

Re: The Chrome VRP Panel has decided to award $250k for this report

#29

Post by georgemcbay »

ad-astra wrote: post #5

Impressive. Feel like finding issues like this in such a large project is like looking for a needle in a haystack

Finding issues in large complex projects is generally easier than smaller projects. More code, more bugs. But its still difficult to find serious issues on the level of a sandbox escape in Chromium just because Google's long-running reward system means lots of people have spent lots of time looking into it, both manually and using automated fuzzer tools.

Back in ye olden days of 2014 I randomly stumbled upon a Chrome issue (wasn't trying to find bugs, was just writing some JavaScript code and noticed a problem) and reported it to Google and they paid me $1,500. Not bad for like half an hour's work to report the issue.

https://issues.chromium.org/issues/40078754

Post reply on HN