Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

211–220 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#211

Post by Rohansi »

Arnt wrote: post #174
alxeder wrote: post #83

Earlier quoted context omitted.

the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads…

Don't forget about YouTube!

Re: The Chrome VRP Panel has decided to award $250k for this report

#212

Post by klysm »

QuadrupleA wrote: post #207
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Everybody here is coldly evaluating the financial profit comparison. How about being a decent human being, and not enabling hundreds of criminals to hurt millions of people because your net income is potentially better?

People are evaluating this from a cold perspective to see if the system is working as designed or not.

Re: The Chrome VRP Panel has decided to award $250k for this report

#213

Post by crazygringo »

Rohansi wrote: post #211
Arnt wrote: post #174

Earlier quoted context omitted.

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads…

Don't forget about YouTube!

What about YouTube?

uBlock Origin Lite blocks YouTube ads just fine.

Re: The Chrome VRP Panel has decided to award $250k for this report

#214

Post by Danjoe4 »

UncleMeat wrote: post #161
ndr wrote: post #110

Earlier quoted context omitted.

Be somewhat competitive to what such developers could get on the black market. Discounting the ethics. Surely a bug on Chrome is worth more than a bug on Firefox.

Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?

Bad analogy, but yes actually. This is one reason people buy drugs from illegal online pharmacies - cost. I

Re: The Chrome VRP Panel has decided to award $250k for this report

#215

Post by brcmthrowaway »

tptacek wrote: post #209
brcmthrowaway wrote: post #185

Are there people who work full time from income on bug bounties?

To add to the sibling comment, there are also many different ways of making a living doing this stuff: * You can find killer clientside bugs where the bounty will cover a year's worth of compensation (bear in mind you'll get maybe 1.5 of these payouts a year on your own if you're good but replacement-level) * You can find these kinds of bugs and work with brokers to sell them to grey-market buyers along with enableme…

This seems harder and riskier than a full time wage - almost like a salesman who makes money from commission.

Re: The Chrome VRP Panel has decided to award $250k for this report

#216

Post by tptacek »

brcmthrowaway wrote: post #215
tptacek wrote: post #209

Earlier quoted context omitted.

To add to the sibling comment, there are also many different ways of making a living doing this stuff: * You can find killer clientside bugs where the bounty will cover a year's worth of compensation (bear in mind you'll get maybe 1.5 of these payouts a year on your own if you're good but replacement-level) * You can find these kinds of bugs and work with brokers to sell them to grey-market buyers along with enableme…

This seems harder and riskier than a full time wage - almost like a salesman who makes money from commission.

The salesperson earning much of their annual take-home from variable compensation is one of the most common white collar jobs there is.

Re: The Chrome VRP Panel has decided to award $250k for this report

#217

Post by QuadrupleA »

klysm wrote: post #212
QuadrupleA wrote: post #207

Earlier quoted context omitted.

Everybody here is coldly evaluating the financial profit comparison. How about being a decent human being, and not enabling hundreds of criminals to hurt millions of people because your net income is potentially better?

People are evaluating this from a cold perspective to see if the system is working as designed or not.

Hopefully decency reduces the necessary price a little.

Re: The Chrome VRP Panel has decided to award $250k for this report

#218

Post by tptacek »

QuadrupleA wrote: post #207
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Everybody here is coldly evaluating the financial profit comparison. How about being a decent human being, and not enabling hundreds of criminals to hurt millions of people because your net income is potentially better?

People are fixated, across this thread, on a black market of organized criminals buying vulnerabilities, but for the most part criminals aren't the real alternative market buyers for high-end vulnerabilities, and while people on message boards may incline towards viewing IC and LEO agencies as themselves criminal, I think you'll find a pretty substantial fraction of normal people find supplying IC/LEO agencies as more than just decent; praiseworthy, even.

That thorny ethical issue aside, I'm fond of pointing out that the IC's main alternative to CNE intelligence collection is human intelligence, and the cost of HUMINT simply in employee benefits dwarfs any near-term possible cost of exploit enablement packages; 7 figures is a pittance (remember: most major western governments are essentially benefits management organizations with standing armies).

Even given the seemingly vast sums earned by organized crime, government buyers are positioned to decisively outbid crime over the medium term. It's really early days for these markets.

Re: The Chrome VRP Panel has decided to award $250k for this report

#219

Post by dmix »

msh wrote: post #147
high_na_euv wrote: post #6

Kind of life changing money, good to see such rewards

Where I live (Denmark) even if it was tax free you would more or less be unable to purchase an one bedroom apartment in the capital for this amount.

Getting enough for a good down payment on a house is life changing for many people. You'll make it back not paying rent into a void.

Re: The Chrome VRP Panel has decided to award $250k for this report

#220

Post by drdec »

XorNot wrote: post #192
charcircuit wrote: post #89

Earlier quoted context omitted.

Selling an exploit is not illegal so why bother with money laundering?

Because the people buying it don't get their money from legal sources, nor engage in legal business activities. They also have every incentive to make sure you're guilty enough to not go blab to the authorities later, or sell it to someone else. And since you're trying to be anonymous in this, you aren't going to be getting a regular tax receipt either.

If you did not commit a crime to receive the money, there is no reason for money laundering (at least in the US). The IRS does not care as long as you claim it. You don't need a fancy story or anything, just claim the income.
Post reply on HN