Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

131–140 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#131

Post by baobun »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

If you need all that spelled out it's probably not a market for you.

You can find some by researching. AIUI most intros are via personal connections. I'd be wary of the potential ethical implications. There is more than money to life.

Re: The Chrome VRP Panel has decided to award $250k for this report

#132

Post by saagarjha »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

Have an established track record of finding high quality bugs and network with people in that space and you'll eventually get introduced to the right people.

Re: The Chrome VRP Panel has decided to award $250k for this report

#133

Post by Almondsetat »

exizt88 wrote: post #121
woadwarrior01 wrote: post #82

Earlier quoted context omitted.

If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168

Is their CEO comp not in line with the market?

Are Mozilla's earning in line with the market?

Re: The Chrome VRP Panel has decided to award $250k for this report

#135

Post by sureglymop »

edent wrote: post #124
NoahZuniga wrote: post #114

Earlier quoted context omitted.

> How There are companies that specialize in getting grey market bugs in important software, ie browsers and OSes. They are repwat players and have a reputation to actually pay out.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

I mean you just search on google... Zerodium, Crowdfense, Exodus Intelligence, etc.

Sure, I'd say the "sell it elsewhere" stuff is always a bit overly optimistic but due to the nature of this specific exploit I am pretty sure you could find a buyer offering good compensation.

Re: The Chrome VRP Panel has decided to award $250k for this report

#136

Post by ToucanLoucan »

exizt88 wrote: post #121
woadwarrior01 wrote: post #82

Earlier quoted context omitted.

If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168

Is their CEO comp not in line with the market?

That's a bad rubric to judge by, in this case. CEO pay is at a historic high, in fact I'm pretty sure the last time the gap in wage between median workers and CEOs was this high was the roaring 20's, which famously went quite well for the economy.

Re: The Chrome VRP Panel has decided to award $250k for this report

#137

Post by handsclean »

sgjohnson wrote: post #101
high_na_euv wrote: post #6

Kind of life changing money, good to see such rewards

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spending problems? Is it children whose ideas about money come from “influencers”?

Re: The Chrome VRP Panel has decided to award $250k for this report

#138

Post by saagarjha »

whatever1 wrote: post #44
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Why not collect from both of the sources? First collect with your black hat and then with your white.

Black hats will not pay you for an exploit that dies quickly once the white hats get your report. White hats will not pay you for an exploit that you fenced to a black hat agency and showed up in the wild.

Re: The Chrome VRP Panel has decided to award $250k for this report

#139

Post by saagarjha »

andersa wrote: post #59
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

What if people start asking questions where you got the million dollars from? I've never understood how those presumably illegal markets can function with such large sums involved.

They're not illegal.

Re: The Chrome VRP Panel has decided to award $250k for this report

#140

Post by saagarjha »

brohee wrote: post #92
bravesoul2 wrote: post #63

Earlier quoted context omitted.

Not really tax free lol! In both cases you arent getting withholding so you need to declare it.

Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607 Your hookers and blow dealers won't report you to the taxman.

Sure, but your car dealer will.
Post reply on HN