Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

171–180 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#171

Post by Wowfunhappy »

saagarjha wrote: post #138
whatever1 wrote: post #44

Earlier quoted context omitted.

Why not collect from both of the sources? First collect with your black hat and then with your white.

Black hats will not pay you for an exploit that dies quickly once the white hats get your report. White hats will not pay you for an exploit that you fenced to a black hat agency and showed up in the wild.

> White hats will not pay you for an exploit that you fenced to a black hat agency and showed up in the wild.

...come to think of it, how does that work? Aren't the most important exploits to patch the ones being actively used in the wild?

In other words, how do they avoid someone playing both sides? "I found an exploit being used by the LEETH4X0R malware [which was in fact created by the guy I sold this exploit to] to steal people's gmail cookies."

You'd have to find out about LEETH4X0R before other researchers, but of course, you'd have a head start.

Re: The Chrome VRP Panel has decided to award $250k for this report

#172

Post by catsma21 »

xbmcuser wrote: post #117
dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

Chrome has 15-20 times the users that firefox in the blackmarket the bug would sell for similar ratio. Safari might go for more as it has more rich and tech security illiterate users.

disagree. more marketshare does not mean juicier targets, which, in this case, would be tor users. in addition, you don't buy an exploit to use it en masse, that would get it burned really quickly

Re: The Chrome VRP Panel has decided to award $250k for this report

#173

Post by bravesoul2 »

brohee wrote: post #92
bravesoul2 wrote: post #63

Earlier quoted context omitted.

Not really tax free lol! In both cases you arent getting withholding so you need to declare it.

Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607 Your hookers and blow dealers won't report you to the taxman.

Lol. HN the famously "confidently incorrect" forum especially on-coding topics is not my lawyer.

And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

Re: The Chrome VRP Panel has decided to award $250k for this report

#174

Post by Arnt »

alxeder wrote: post #83
victorbjorklund wrote: post #71

Earlier quoted context omitted.

The browser totally has zero to do with google ads. Totally no connection at all.

the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that.

https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.

Re: The Chrome VRP Panel has decided to award $250k for this report

#175

Post by gruez »

Zinu wrote: post #104
mike_hearn wrote: post #67

Earlier quoted context omitted.

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

The money itself might not be dirty, couldn’t you just claim something like “I sold a secret, highly valuable algorithm to this guy”? Tax would still need to be paid of course

For the people downvoting, that's unironically a thing:

https://www.irs.gov/publications/p525#en_US_2024_publink1000...

>Illegal activities.

>Income from illegal activities, such as money from dealing illegal drugs, must be included in your income on Schedule 1 (Form 1040), line 8z, or on Schedule C (Form 1040) if from your self-employment activity.

Re: The Chrome VRP Panel has decided to award $250k for this report

#176

Post by le-mark »

nevi-me wrote: post #126
edent wrote: post #124

Earlier quoted context omitted.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

And do those companies facilitate black market transactions that would be tax-free?

It’s another wrinkle GP didn’t get to. If you are paid, how to launder the money? Presumably you’d get a shiesty lawyer to buy you a nail salon ala breaking bad.

Re: The Chrome VRP Panel has decided to award $250k for this report

#178

Post by dadrian »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

You still have to pay taxes on income from non-bug bounty vulnerability markets, be it to law enforcement, brokers, or criminals.

Re: The Chrome VRP Panel has decided to award $250k for this report

#179

Post by Avamander »

Although seeing these bugs fixed and getting rewarded for finding them is great, I still think that Microsoft's idea of virtualising the entire browser process was genius. It also feels better than any "lockdown"-like mode that maybe just disables some JIT engine or two.

I'd really like that on both Linux and macOS.

Re: The Chrome VRP Panel has decided to award $250k for this report

#180

Post by [deleted] »

defraudbah wrote: post #120
socalgal2 wrote: post #85

Earlier quoted context omitted.

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

why comments about taxes get gray here? is it bad behavior in US to discuss taxes?

[deleted]
Post reply on HN