How does one start acquiring skills like these?
[flagged]
The Chrome VRP Panel has decided to award $250k for this report
51–60 of 292 posts
Re: The Chrome VRP Panel has decided to award $250k for this report
#52Earlier quoted context omitted.
Why not collect from both of the sources? First collect with your black hat and then with your white.
"If I report the body, no-one will suspect I'm the murderer" Yes they will.
Which is why people are hesitant to report a body they have not killed, just found!
Re: The Chrome VRP Panel has decided to award $250k for this report
#53Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/
According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…
[deleted]
Re: The Chrome VRP Panel has decided to award $250k for this report
#54Earlier quoted context omitted.
According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…
>According to Wikipedia, that's 0.0012% of their net income. How much of the Mozilla foundation's income goes into product development nowadays?
Do you imply that it's not 5x, but 500x of what Google pays? /s
Re: The Chrome VRP Panel has decided to award $250k for this report
#55Earlier quoted context omitted.
According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…
>According to Wikipedia, that's 0.0012% of their net income. How much of the Mozilla foundation's income goes into product development nowadays?
260 Mio. USD, as answered by the linked article, though the numbers only go up to 2023. So "nowadays" is a bit of a stretch.
Re: The Chrome VRP Panel has decided to award $250k for this report
#56Earlier quoted context omitted.
Why not collect from both of the sources? First collect with your black hat and then with your white.
Typically can't do that. Security services tend to anonymously report security flaws they use after use against any high value target, since they don't want the opponent using those same flaws back at them.
Private sector has the incentive of keeping an exploit open for as long as possible. Several cases with iPhone exploits that were apparently open (and sold) for years.
Re: The Chrome VRP Panel has decided to award $250k for this report
#57Earlier quoted context omitted.
How much Alphabet makes is almost irrelevant. The incentive here should be for security researchers. As long as there's enough incentive for security researchers to continue to report the bugs they find (which must be balanced against the potential payment a criminal could get if exploiting the bug, which is not directly correlated to the company's income either, at least not necessarily), the payment is appropriate.
To be fair, goog has to pay comparable to other 3rd party brokers, and not necessarily "potential payment by exploiting the bug". Finding an exploit and being able to deploy it for financial gains are two distinct problems, with separate skillsets, risks, etc. Plus there are some other benefits of disclosing to goog. After you get into VRP you get access to grants & stuff and can basically ask to study a problem and…
You think state intelligence agencies don’t hack whitehats for their 0days?
You know there’s ongoing and plausible efforts by at least 3 organizations to conquer the Earth, right?
Re: The Chrome VRP Panel has decided to award $250k for this report
#58Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/
According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…
But Chrome is paying more as a percentage of their browser units' income, no?
Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free, for competitors via Project Zero.
Re: The Chrome VRP Panel has decided to award $250k for this report
#59He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...
What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.
Re: The Chrome VRP Panel has decided to award $250k for this report
#60Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/
Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.
Really doesn't tell me piss all, as I'm not privy to their respective overall cash flow. Are you, considering you say it does for you?
Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously, by the way? Sounds a bit backwards to me.