Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

81–90 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#81

Post by tossandthrow »

fny wrote: post #73
MrGilbert wrote: post #40

Earlier quoted context omitted.

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

Do you pay a software engineer for their time based on your revenue or his skill?

Mostly based on revenue - or at least that is the way we are going.

That is why you see equivalent skill levels being paid differently in big tech compared to other places.

And why you see millions in salaries at some big techs Ai hiring.

Re: The Chrome VRP Panel has decided to award $250k for this report

#82

Post by woadwarrior01 »

MrGilbert wrote: post #40
dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

If only they'd use a similar rubric to rein in their CEO comp[1].

[1]: https://news.ycombinator.com/item?id=24132168

Re: The Chrome VRP Panel has decided to award $250k for this report

#83

Post by alxeder »

victorbjorklund wrote: post #71
morpheuskafka wrote: post #58

Earlier quoted context omitted.

But Chrome is paying more as a percentage of their browser units' income, no? Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free,…

The browser totally has zero to do with google ads. Totally no connection at all.

the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.

Re: The Chrome VRP Panel has decided to award $250k for this report

#84

Post by avar »

jve wrote: post #72
WalterBright wrote: post #13

Earlier quoted context omitted.

Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

Because whatever language you think should be popular instead is running on a mountain of C code, but the reverse isn't true.

Re: The Chrome VRP Panel has decided to award $250k for this report

#85

Post by socalgal2 »

high_na_euv wrote: post #6

Kind of life changing money, good to see such rewards

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do.

It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3 years of student lifestyle but I was 34 and not prepared to go back to student lifestyle

To be honest it was super disappointing. Of course getting a $240k bonus is a privilege. My only point was it didn’t change my life like I thought it would.

And, that was 25 years ago. today, even a million ($600k after taxes) in those 3 cities won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be

Re: The Chrome VRP Panel has decided to award $250k for this report

#86

Post by tossandthrow »

rvz wrote: post #42
dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.

Just like you personally obviously don't care about your personal security when you do not pay a team of body guards 250k a year.

Re: The Chrome VRP Panel has decided to award $250k for this report

#87

Post by yaseer »

fny wrote: post #73
MrGilbert wrote: post #40

Earlier quoted context omitted.

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

Do you pay a software engineer for their time based on your revenue or his skill?

Both - these are the two sides of the market, aka supply and demand.

Re: The Chrome VRP Panel has decided to award $250k for this report

#88

Post by danjc »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

This is true for all crime.

Re: The Chrome VRP Panel has decided to award $250k for this report

#89

Post by charcircuit »

mike_hearn wrote: post #67
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

Selling an exploit is not illegal so why bother with money laundering?

Re: The Chrome VRP Panel has decided to award $250k for this report

#90

Post by AlienRobot »

jve wrote: post #72
WalterBright wrote: post #13

Earlier quoted context omitted.

Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

Okay, I want to make a desktop app that runs on Linux. Which language should I use? Java?
Post reply on HN