Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

71–80 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#71

Post by victorbjorklund »

morpheuskafka wrote: post #58
MrGilbert wrote: post #40

Earlier quoted context omitted.

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

But Chrome is paying more as a percentage of their browser units' income, no? Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free,…

The browser totally has zero to do with google ads. Totally no connection at all.

Re: The Chrome VRP Panel has decided to award $250k for this report

#72

Post by jve »

WalterBright wrote: post #13
krtkush wrote: post #4

How does one start acquiring skills like these?

Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail.

How can that language still be so popular?

Re: The Chrome VRP Panel has decided to award $250k for this report

#73

Post by fny »

MrGilbert wrote: post #40
dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

Do you pay a software engineer for their time based on your revenue or his skill?

Re: The Chrome VRP Panel has decided to award $250k for this report

#74

Post by bapak »

TheDong wrote: post #70
bapak wrote: post #15

Earlier quoted context omitted.

What's your suggestion exactly? Making anyone who can find a bug a millionaire? That's ridiculous. 250k is already insanely high. You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

Yeah, assuming the people working at the taco shop aren't very well off the taco should cost $100 for a software engineer, $80M for Jeffrey Bezos, and $4 for someone down on their luck. If we wanted, we could make this more efficient by giving out free healthcare and housing to people, proportional to their need, and tax $95 from the software engineer, $80M from Bezos, and $0 from someone down on their luck. Progress…

Right. So why work when everything is priced according to your worth? I'll stay in my $2 rent and free food delivery for life. Thank you.

Re: The Chrome VRP Panel has decided to award $250k for this report

#75

Post by bapak »

pydry wrote: post #18
bapak wrote: post #15

Earlier quoted context omitted.

What's your suggestion exactly? Making anyone who can find a bug a millionaire? That's ridiculous. 250k is already insanely high. You make a bunch money too, should you pay $100 for that taco? It's nothing to you.

Equal to the black market price. Anything less is an incitement to allow exploits to be used in the wild.

That's a different argument. Price it for its worth, not for my worth.

Re: The Chrome VRP Panel has decided to award $250k for this report

#76

Post by MrGilbert »

postflopclarity wrote: post #62
MrGilbert wrote: post #26

Earlier quoted context omitted.

> You make a bunch money too, should you pay $100 for that taco? It's nothing to you. Looking at my yearly net income, paying 100$ for a single taco in a year would mean that 0.26% of my net income would go into a taco. Paying 0.1$ for a single taco would make it 0.00026%. According to the consensus in this comment section, that would be pretty gracious. Yes, that's where I'm going with this. //Edit: Thanks at postfl…

so you make $5 million / year but you're still incredulous at > It's wild how much money big corporations have. ?

I was wondering why my math wasn't mathing, but was too busy to earn money at the same time. Thanks for pointing it out, fixed! Now my statement makes way more sense.

Re: The Chrome VRP Panel has decided to award $250k for this report

#78

Post by ChrisRR »

whatever1 wrote: post #44
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Why not collect from both of the sources? First collect with your black hat and then with your white.

Because you'll get found out and never employed as a security researcher again

Re: The Chrome VRP Panel has decided to award $250k for this report

#79

Post by PhilipRoman »

OutOfHere wrote: post #30

It is unfortunate that there is no web browser in a memory safe language. As I understand, both Chromium and Firefox use C++, although Firefox partly uses Rust. This has put billions of people at risk.

One of the biggest security holes is the JIT engine, rewriting it in Rust or any other language wouldn't make a difference, since it is effectively an inner platform.

Re: The Chrome VRP Panel has decided to award $250k for this report

#80

Post by Reasoning »

andersa wrote: post #59
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.

Money laundering, give the money to a shell company and have them report it as income. Obviously not that simple but that's the basic explanation.
Post reply on HN