Earlier quoted context omitted.
The browser totally has zero to do with google ads. Totally no connection at all.
the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.
[deleted]
The Chrome VRP Panel has decided to award $250k for this report
91–100 of 292 posts
Re: The Chrome VRP Panel has decided to award $250k for this report
#92He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...
Not really tax free lol! In both cases you arent getting withholding so you need to declare it.
Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607
Your hookers and blow dealers won't report you to the taxman.
Re: The Chrome VRP Panel has decided to award $250k for this report
#93Earlier quoted context omitted.
Do you pay a software engineer for their time based on your revenue or his skill?
Mostly based on revenue - or at least that is the way we are going. That is why you see equivalent skill levels being paid differently in big tech compared to other places. And why you see millions in salaries at some big techs Ai hiring.
Not at all. Corporation always pays as little as possible. Unless we are talking about CEO levels...
Re: The Chrome VRP Panel has decided to award $250k for this report
#94Earlier quoted context omitted.
Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.
It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?
The language is just fine. The real question is: Why do people not use a string library that abstracts this away safely?
Re: The Chrome VRP Panel has decided to award $250k for this report
#95Earlier quoted context omitted.
It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?
Okay, I want to make a desktop app that runs on Linux. Which language should I use? Java?
Some current trendy options would be Kotlin (with Kotlin Multiplatform) or C# (with Avalonia UI).
Edit: I guess I should've at least asked myself if the question was rhetorical.
Re: The Chrome VRP Panel has decided to award $250k for this report
#96Re: The Chrome VRP Panel has decided to award $250k for this report
#97He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...
Why not collect from both of the sources? First collect with your black hat and then with your white.
An exploit that is used is an exploit that will eventually leave traces that an analyst will look at (if used on a corporate PC)... Either you use it very sparingly on HVT or you end up on the EDR radars and some IOC will be made public eventually.
Re: The Chrome VRP Panel has decided to award $250k for this report
#98Earlier quoted context omitted.
Okay, I want to make a desktop app that runs on Linux. Which language should I use? Java?
Some current trendy options would be Kotlin (with Kotlin Multiplatform) or C# (with Avalonia UI). Edit: I guess I should've at least asked myself if the question was rhetorical.
Whatever you do, please do not use a language that makes it difficult to provide security updates: https://www.debian.org/releases/trixie/release-notes/issues....
Re: The Chrome VRP Panel has decided to award $250k for this report
#99Earlier quoted context omitted.
Why not collect from both of the sources? First collect with your black hat and then with your white.
Because you'll get found out and never employed as a security researcher again
Perhaps but won’t some of those blackhats pay $1 million or more? Depending where you live that’s retirement money.
Honestly I’d be more worried about crossing the blackhats.
Re: The Chrome VRP Panel has decided to award $250k for this report
#100Kind of life changing money, good to see such rewards
the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…
Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over.
>>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be
How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?