Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

121–130 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#121

Post by exizt88 »

woadwarrior01 wrote: post #82
MrGilbert wrote: post #40

Earlier quoted context omitted.

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percent…

If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168

Is their CEO comp not in line with the market?

Re: The Chrome VRP Panel has decided to award $250k for this report

#122

Post by gambiting »

sgjohnson wrote: post #103
gambiting wrote: post #100

Earlier quoted context omitted.

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

> How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing? Because neither of those are going to change your daily life that much? It simplifies a thing or two, but neither of those things are life-changing.

I can only assume you'd say so if you were able to do either of those things in the first place, so yeah, it doesn't feel life changing. It's like winning a car in a radio lottery when you already had a car - yeah pretty cool, but not life changing.

There's a lot of people who can't even imagine ever being able to put down a deposit on a house or to send their kids to collage debt-free. With an amount of money like that you can go from being trapped in a rent hell forever to actually purchasing your own house. Or you can give your kids the education you want to give them. They are major, life changing impacts. Again, to describe it as "simplifes a thing or two" to me implies that you could do them even without this money in which case yeah, it changes very little.

Re: The Chrome VRP Panel has decided to award $250k for this report

#124

Post by edent »

NoahZuniga wrote: post #114
edent wrote: post #106

Earlier quoted context omitted.

> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them? And, again, how do I assess their reputation and likelihood of paying me.

How much of a premium are they paying to make it worthwhile?

Re: The Chrome VRP Panel has decided to award $250k for this report

#125

Post by kristianp »

Retr0id wrote: post #39
matsemann wrote: post #34

Is there somewhere explaining this bug in terms understandable for someone not dabbling in this? I don't really understand how this works to "escape the sandbox". Normally it's like a website you visit that get access it shouldn't have. But this talk about renderers and native apis make it seem like it's stuff another process on the computer would do?

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

> The referenced `patch.diff` is basically for simulating a compromised renderer.

The patch.diff part is hard to understand. Surely if you have a compromised renderer, you have effectively full access to the machine already?

Re: The Chrome VRP Panel has decided to award $250k for this report

#126

Post by nevi-me »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

And do those companies facilitate black market transactions that would be tax-free?

Re: The Chrome VRP Panel has decided to award $250k for this report

#129

Post by Retr0id »

kristianp wrote: post #125
Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

> The referenced `patch.diff` is basically for simulating a compromised renderer. The patch.diff part is hard to understand. Surely if you have a compromised renderer, you have effectively full access to the machine already?

No, because of the sandbox.

Re: The Chrome VRP Panel has decided to award $250k for this report

#130

Post by saagarjha »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

> Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later

lol

Post reply on HN