I'm highly skeptical this level of bug bounty would be sustainable by whatever company ends up buying Chrome after DOJ forces it to be divested.
The Chrome VRP Panel has decided to award $250k for this report
231–240 of 292 posts
Re: The Chrome VRP Panel has decided to award $250k for this report
#232Earlier quoted context omitted.
> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…
Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...). It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bu…
How does https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act play into that?
Re: The Chrome VRP Panel has decided to award $250k for this report
#233Earlier quoted context omitted.
Getting enough for a good down payment on a house is life changing for many people. You'll make it back not paying rent into a void.
I rather pay a rent than putting 250k on a down payment and still have to pay a rent amount for 15-25 years.
But you're then left with owning something probably worth more than you paid in total
Re: The Chrome VRP Panel has decided to award $250k for this report
#234Earlier quoted context omitted.
There are many string libraries.
As you can expect, the answer to your question is the obvious one.
I do not think it is obvious or trivial question. I think the problem is mostly that there is no money for enhancing the C ecosystem and educating people about possibilities. The cooperate money goes into random new things.
Re: The Chrome VRP Panel has decided to award $250k for this report
#235Earlier quoted context omitted.
Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...). It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bu…
How does https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act play into that?
Off the cuff, I'd guess that any official documentation would be around the sale of "research" and not "an exploit". Depending how classy the buyer was about it, there might or might not be an offline wink and nudge.
Re: The Chrome VRP Panel has decided to award $250k for this report
#236Earlier quoted context omitted.
Everybody here is coldly evaluating the financial profit comparison. How about being a decent human being, and not enabling hundreds of criminals to hurt millions of people because your net income is potentially better?
People are fixated, across this thread, on a black market of organized criminals buying vulnerabilities, but for the most part criminals aren't the real alternative market buyers for high-end vulnerabilities, and while people on message boards may incline towards viewing IC and LEO agencies as themselves criminal, I think you'll find a pretty substantial fraction of normal people find supplying IC/LEO agencies as mor…
Not commenting about the ic/leo part specifically, but there is a pretty abundant body of work on what "normal" people are willing to do, as long as they find a way to rationalize it away. The banality of evil is well documented.
In that light, what others would do is rarely a reliable indicator that you shouldn’t think twice about your actions, lest you regret later, once the thinking has happened.
Re: The Chrome VRP Panel has decided to award $250k for this report
#237Earlier quoted context omitted.
People are fixated, across this thread, on a black market of organized criminals buying vulnerabilities, but for the most part criminals aren't the real alternative market buyers for high-end vulnerabilities, and while people on message boards may incline towards viewing IC and LEO agencies as themselves criminal, I think you'll find a pretty substantial fraction of normal people find supplying IC/LEO agencies as mor…
Not commenting about the ic/leo part specifically, but there is a pretty abundant body of work on what "normal" people are willing to do, as long as they find a way to rationalize it away. The banality of evil is well documented. In that light, what others would do is rarely a reliable indicator that you shouldn’t think twice about your actions, lest you regret later, once the thinking has happened.
I have no idea what any of this has to do with anything I just wrote, I'm sorry.
Re: The Chrome VRP Panel has decided to award $250k for this report
#238He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...
> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…
You'll probably end up with 40 subscriptions to Vibe magazine.
Re: The Chrome VRP Panel has decided to award $250k for this report
#239Earlier quoted context omitted.
> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…
> a trustworthy criminal Not going to happen.
You know most criminal enterprises are based pretty much solely on trust right? Like that is how a lot of crime gets done
Re: The Chrome VRP Panel has decided to award $250k for this report
#240Earlier quoted context omitted.
> How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing? Because neither of those are going to change your daily life that much? It simplifies a thing or two, but neither of those things are life-changing.
I can only assume you'd say so if you were able to do either of those things in the first place, so yeah, it doesn't feel life changing. It's like winning a car in a radio lottery when you already had a car - yeah pretty cool, but not life changing. There's a lot of people who can't even imagine ever being able to put down a deposit on a house or to send their kids to collage debt-free. With an amount of money like t…
Property taxes are very high thanks to prop 13. 250k in California is like 30k in states like Texas or Illinois, enough to make it a great year but not life changing.