Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

251–260 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#251

Post by lostmsu »

1970-01-01 wrote: post #242
socalgal2 wrote: post #85

Earlier quoted context omitted.

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

225k in 2025 dollars is life changing for anyone in the middle class of income. The reason you were unable to do anything with it is because you were already earning too much.

Presumably people discovering these bugs are not in the middle class of income.

Re: The Chrome VRP Panel has decided to award $250k for this report

#252

Post by trhway »

rdl wrote: post #206
edent wrote: post #106

Earlier quoted context omitted.

> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…

Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...). It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bu…

>Mostly the best market is intelligence agency vendors.

That makes me wonder - may be the original bug was really a backdoor created as a result of a deal with an intelligence agency/vendor. So, can it be that Google gets money (or more generally some kind of browny points; also interesting aspect - giving that the agencies may exploit individual engineers, it would seem to be more preferable for the company to play ball and have it organized under the company's control) for a backdoor, and once backdoor is found - pays the bug bounty. The bug bounty is thus a kind of backdoor quality control program :)

Re: The Chrome VRP Panel has decided to award $250k for this report

#253

Post by __d »

sgjohnson wrote: post #103
gambiting wrote: post #100

Earlier quoted context omitted.

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

> How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing? Because neither of those are going to change your daily life that much? It simplifies a thing or two, but neither of those things are life-changing.

Debt-free college is life-changing for your kid(s).

Re: The Chrome VRP Panel has decided to award $250k for this report

#254

Post by omoikane »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

> pretty sure it he could have gotten more tax free on the black market.

Not necessarily. On slide 72 of this presentation, it says sandbox escape or bypass for Chrome is worth up to $200000:

https://nocomplexity.com/wp-content/uploads/2024/06/bluehat2...

(I originally found this presentation on github[1], but github seems down right now[2].)

[1] https://github.com/mdowd79/presentations/blob/main/bluehat20...

[2] https://www.reddit.com/r/github/comments/1mnlgc5/is_github_d...

Re: The Chrome VRP Panel has decided to award $250k for this report

#255

Post by miohtama »

omoikane wrote: post #254
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

> pretty sure it he could have gotten more tax free on the black market. Not necessarily. On slide 72 of this presentation, it says sandbox escape or bypass for Chrome is worth up to $200000: https://nocomplexity.com/wp-content/uploads/2024/06/bluehat2... (I originally found this presentation on github[1], but github seems down right now[2].) [1] https://github.com/mdowd79/presentations/blob/main/bluehat20... [2] htt…

Mossad and its subsidiaries like NSO pay $1M

https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...

Re: The Chrome VRP Panel has decided to award $250k for this report

#256

Post by dijit »

robin_reala wrote: post #112
sgjohnson wrote: post #101

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

In Sweden, assuming that $125k of that disappears in taxes, it’d leave you with 1.2M SEK. There are currently ~650 properties on Hemnet between 1M and 1.25M. I’d suggest maybe this one in Ödeshög at 1.1M SEK? https://www.hemnet.se/bostad/villa-3rum-odeshog-odeshogs-kom... Not the biggest, but it’s reasonably well done up, comes with 2/3rds of an acre of land, is near a main motorway to get to places, and near the sho…

Ödeshög is like “Abandoned Pile”, not inspiring.

Still cool that you can get a house so cheap in Sweden.

Re: The Chrome VRP Panel has decided to award $250k for this report

#257

Post by crazygringo »

Rohansi wrote: post #244
crazygringo wrote: post #213

Earlier quoted context omitted.

What about YouTube? uBlock Origin Lite blocks YouTube ads just fine.

Not for everyone. Do you really think Google wouldn't do anything about as blockers? Especially now that no ads is one of the selling points of YouTube Premium?

Have you tried? There's a strength setting to the extension. At max strength it's been blocking all YT ads for a while.

And it doesn't matter what I think about it. I'm giving you facts not opinions.

Re: The Chrome VRP Panel has decided to award $250k for this report

#258

Post by jama211 »

Zinu wrote: post #104
mike_hearn wrote: post #67

Earlier quoted context omitted.

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

The money itself might not be dirty, couldn’t you just claim something like “I sold a secret, highly valuable algorithm to this guy”? Tax would still need to be paid of course

You underestimate the tax auditors.

Re: The Chrome VRP Panel has decided to award $250k for this report

#259

Post by jama211 »

sgjohnson wrote: post #103
gambiting wrote: post #100

Earlier quoted context omitted.

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

> How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing? Because neither of those are going to change your daily life that much? It simplifies a thing or two, but neither of those things are life-changing.

Your only definition of life changing is changing your day to day life? That’s an odd way of looking at it. Going from renting to a home owner is a BIG bucket list life changing item for most people

Re: The Chrome VRP Panel has decided to award $250k for this report

#260

Post by jama211 »

socalgal2 wrote: post #85
high_na_euv wrote: post #6

Kind of life changing money, good to see such rewards

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

For you maybe. For someone in debt or who has never ever had a financial safety net, the amount of stress relief from finally having a bit of safety money behind you is mental.
Post reply on HN