Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

221–230 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#221

Post by ndr »

UncleMeat wrote: post #161
ndr wrote: post #110

Earlier quoted context omitted.

Be somewhat competitive to what such developers could get on the black market. Discounting the ethics. Surely a bug on Chrome is worth more than a bug on Firefox.

Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?

To the extent that meth is a viable substitute for cold medicine you'll have those prices correlating.

But more to your point: the bounty is more similar to an auction. Once you sell the bug to the software producer the black market has no more use of it, assuming it gets fixed.

Supply is constrained, so competition is on the demand side.

On the drug example demand is constrained, if you're the only buyer. So competition happens on the supply side.

Re: The Chrome VRP Panel has decided to award $250k for this report

#222

Post by drdec »

bravesoul2 wrote: post #173
brohee wrote: post #92

Earlier quoted context omitted.

Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607 Your hookers and blow dealers won't report you to the taxman.

Lol. HN the famously "confidently incorrect" forum especially on-coding topics is not my lawyer. And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

The reason you do money laundering is because the source of the funds is illegal. If the source of the funds is legal, just claim it. There are plenty of occupations that get paid in cash and are expected to report it.

The IRS isn't referring suspicious (whatever that means) tax returns to the authorities. What happens if you are a criminal is that the authorities have there attention on you because you are doing illegal things. One angle of attack for them is your finances. That is why money laundering exists.

Re: The Chrome VRP Panel has decided to award $250k for this report

#223

Post by jancsika »

dig1 wrote: post #31

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/

It'd be fun to do a sketch that's a montage of an array of HN armchair quarterbacks rolling up their sleeves and taking short-lived shots at CEO for Mozilla.

Marching into the home office, kicking butt, and pointing at the whiteboard for their favorite pet project:

* Mozilla focusing on privacy

* Mozilla focusing on web standards

* Mozilla focusing on speed

* Mozilla (apparently, here) focusing on maximizing the size of payouts for bug bounties

Inspiring, Rocky-style music plays in the background.

In the foreground, a red line continuously traces slowly downward, with no perceivable relationship to the scenes in the montage.

Re: The Chrome VRP Panel has decided to award $250k for this report

#224

Post by johnisgood »

XorNot wrote: post #195
johnisgood wrote: post #52

Earlier quoted context omitted.

Which is why people are hesitant to report a body they have not killed, just found!

Except if you're not the murderer, then there'll be little evidence pointing to you. If you are the murderer, there will be.

It is not so black and white.

Re: The Chrome VRP Panel has decided to award $250k for this report

#225

Post by bialpio »

matsemann wrote: post #41
Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

Ah, so it's like a two stage rocket, this turns a small exploit into a humongous one?

Yes. Chrome has multi-process architecture, with renderer processes running in a sandbox. They are the ones that deal with untrusted stuff coming from the Internet and so it is safe to assume that they can be compromised (relatively) easily. The puppet master for all those processes is the browser process, and it is Really Bad if you could exploit it. The described bug presumably does it (note how "sandbox escape" was used in one of the comments), but I'm not competent enough to say exactly how. ;)

Edit: just wanted to riff on your analogy. It is relatively simple to crash/shoot down a rocket, but this exploit gets into the control room and could allow the attacker to see where all other rockets are going & maybe redirect/crash them.

Re: The Chrome VRP Panel has decided to award $250k for this report

#226

Post by Foobar8568 »

dmix wrote: post #219
msh wrote: post #147

Earlier quoted context omitted.

Where I live (Denmark) even if it was tax free you would more or less be unable to purchase an one bedroom apartment in the capital for this amount.

Getting enough for a good down payment on a house is life changing for many people. You'll make it back not paying rent into a void.

I rather pay a rent than putting 250k on a down payment and still have to pay a rent amount for 15-25 years.

Re: The Chrome VRP Panel has decided to award $250k for this report

#228

Post by socalgal2 »

handsclean wrote: post #137
sgjohnson wrote: post #101

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spen…

For the simple reason that it didn’t change my life. Before I received it I thought it would. After I received it, paid taxes , etc. My life didn’t change at all.

It’s a fact that my life didn’t change so it wasn’t a life changing amount of money for me.

Maybe it would be life changing for others. tho at least in sf/nyc/la I suspect it wouldn’t for most people. If I had given it to my sister she’d have used it to pay down her mortgage. her life wouldn’t change. she’d have still had a mortgage and her day to day life wouldn’t have changed at all. My nephew could have used it to pay off his student loans. That would be great but again his daily life wouldn’t have changed

Re: The Chrome VRP Panel has decided to award $250k for this report

#229

Post by tantalor »

jacquesm wrote: post #200
mike_hearn wrote: post #67

Earlier quoted context omitted.

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

Up to here you weren't committing any crimes. > but you'll also have to come up with a fake but auditable story of where it came from And now you did.

Sorry, do you mean the comment was describing hypothetical crimes, or literally the comment itself was criminal?

Re: The Chrome VRP Panel has decided to award $250k for this report

#230

Post by tantalor »

idiotsecant wrote: post #191
mike_hearn wrote: post #67

Earlier quoted context omitted.

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

If you get paid in crypto, leave it in crypto, and just trade crypto for goods or services uncle sam is none the wiser.

Terrible advice
Post reply on HN