Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

261–270 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#261
post #84

Earlier quoted context omitted.

Because whatever language you think should be popular instead is running on a mountain of C code, but the reverse isn't true.

The D implementation and runtime library has zero C code in it.

And when you run that compiler implementation, what language family was used to implement the OS and kernel it's running on, the firmware you're using etc?

That's what I meant, not that self hosted compliers don't exist.

Re: The Chrome VRP Panel has decided to award $250k for this report

#262
post #206

Earlier quoted context omitted.

Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...). It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bu…

How does https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act play into that?

The CFAA makes it illegal to exceed authorized access to any 'protected computer' (in practice, basically any computer).

The exploit developer avoids violating the CFAA by developing the exploit on their own computer... because you are authorized to access your own computer.

The government doesn't violate the CFAA when using exploits because government agencies are exempt under 18 USC § 1030 (f)

Re: The Chrome VRP Panel has decided to award $250k for this report

#263
post #233

Earlier quoted context omitted.

I rather pay a rent than putting 250k on a down payment and still have to pay a rent amount for 15-25 years.

But you're then left with owning something probably worth more than you paid in total

It's not.

Buy-vs-rent is nearly always monetarily in favor of rent.

250k down payment is ~20% of 1.3 million which at ~6.5% comes out to you paying ~2.4 million. This doesn't include maintenance, insurance, or taxes.

I have a bunch of calculators in this post (https://news.ycombinator.com/item?id=44794529) but that thread also has a lot of other people explaining the same thing.

Re: The Chrome VRP Panel has decided to award $250k for this report

#264

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spen…

What would you change in your life with that kind of windfall?

Definitely not going to quit my job.

Definitely not going to go back to school.

Sure, I could spend it on a vacations over the next decade but I could already do that so not life changing.

I like my car already.

Maybe a renovation?

At the end of the day, I'm already doing things I like to do so additional money mostly is just going to be saved which isn't life changing. It's nice but not life _changing_.

Re: The Chrome VRP Panel has decided to award $250k for this report

#265

Earlier quoted context omitted.

> a trustworthy criminal Not going to happen.

You know most criminal enterprises are based pretty much solely on trust right? Like that is how a lot of crime gets done

'There is no honor amongst thieves' is a proverb for a reason. Case in point, my nephew, who got shot at point blank range (from behind, no less) by his 'best friend'. Criminals trust each other just long enough until there is a way to get ahead at the expense of the other.

Between 'calculative trust' and 'personality based trust' there are many poles (and other varieties of trust besides), on the whole you're much better of trusting a non-criminal than a criminal.

Re: The Chrome VRP Panel has decided to award $250k for this report

#266
post #256

Earlier quoted context omitted.

In Sweden, assuming that $125k of that disappears in taxes, it’d leave you with 1.2M SEK. There are currently ~650 properties on Hemnet between 1M and 1.25M. I’d suggest maybe this one in Ödeshög at 1.1M SEK? https://www.hemnet.se/bostad/villa-3rum-odeshog-odeshogs-kom... Not the biggest, but it’s reasonably well done up, comes with 2/3rds of an acre of land, is near a main motorway to get to places, and near the sho…

Ödeshög is like “Abandoned Pile”, not inspiring. Still cool that you can get a house so cheap in Sweden.

I mean, take your pick! Here’s the listing page for all 1M-1.25M SEK houses: https://www.hemnet.se/bostader?price_max=1250000&price_min=1...

This price level won’t get you close to a major city, but being within a quick drive or a bus of a reasonably sized town should be doable. (And now I’ve just seen this slice of the late 60s, wow: https://www.hemnet.se/bostad/villa-5rum-centralt-hedemora-he...)

Re: The Chrome VRP Panel has decided to award $250k for this report

#267

Earlier quoted context omitted.

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

Depends where you live. Where I'm from $240k would buy you a really nice house with lots of land, and you'd have money left over. >>won’t likely change your life. Maybe you could put a down payment on a house or pay for your kids college tho but it not the freedom I thought it would be How is being able to put a down paymenent on a house or being able to send your kids to collage debt-free not life changing?

You live in Poland? Country or City? Google estimated a 60 square meter 2br condo in Warsaw costs an average of $260k. So a $240k bonus, after paying taxes, leaves you with $145 in Poland, so no, you could not likely get a condo in Warsaw with a $240k bonus. I'm sure if you live well outside a major city that changes.

And, the bigger point is, even if you could afford a house, is that life changing? Would your life style change because you bought a house? Or, would it just basically be the same life style as before except you now own a house?

To me, life changing amount of money means an amount that changes my life style. That could mean, an amount that lets me retire and never work again. Or an amount that lets me quit and start my own company. Or quit and go back to school. Or quit and travel for a few years. Something alone those lines, having my "life change". Buying an apartment but having my life remain the same, same job, same hours, same activities, is not "life changing" to me.

I fully admit a $240k bonus ($140k after taxes) it could be life changing for others. If I'd been 19yrs old when my living expenses were $20k year, then $140k in the bank would have let me go ~7yrs without a job. Unfortunately my 19yr old self would have probably blown 30% on a car, 20% on travel or other things, 10-20% on random equipment like a new gaming rig or cameras and lens and then in a few months I'd be back where I was. And, even if I did manage to not blow it and do the 7 years, what else could I have done. Could I started a company and hired people? How many could I afford to hire and for how long? Would it be enough to not just lose the money or would have needed more than $140k?

Re: The Chrome VRP Panel has decided to award $250k for this report

#268
post #206

Earlier quoted context omitted.

Mostly the best market is intelligence agency vendors. As a US citizen, I would only be comfortable selling to US contractors. There are a bunch; if you go to conferences you probably meet the people there (look at the sponsors...). It won't be tax-free, though; you'd probably get a 1099, but if you're smart could set it up as corp to corp and deduct a bunch of other expenses from it. Part of the sale is signing a bu…

How does https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act play into that?

Not a lawyer, do pay a lot of attention to this area for professional reasons. Answer: it doesn't, unless you (1) found the vulnerability through methods that themselves violate CFAA (for instance, by breaking into a remote computer), or (2) sold information about the vulnerability knowing that it would be used for a particular set of crimes, in which case you can get accomplice liability for those crimes.

CFAA doesn't have anything to say about vulnerability research itself. You'd be just as liable as an accomplice if you knowingly and deliberately provided free wi-fi to a hacker.

Re: The Chrome VRP Panel has decided to award $250k for this report

#269

Earlier quoted context omitted.

> pretty sure it he could have gotten more tax free on the black market. Not necessarily. On slide 72 of this presentation, it says sandbox escape or bypass for Chrome is worth up to $200000: https://nocomplexity.com/wp-content/uploads/2024/06/bluehat2... (I originally found this presentation on github[1], but github seems down right now[2].) [1] https://github.com/mdowd79/presentations/blob/main/bluehat20... [2] htt…

Mossad and its subsidiaries like NSO pay $1M https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...

NSO is one of dozens of firms that do this work; people are just fixated on NSO because it's the one broker/enablement firm they've actually heard of. The fact that you know who you are should make you less confident in their ability, not more.

Re: The Chrome VRP Panel has decided to award $250k for this report

#270

Earlier quoted context omitted.

the first time I got a bonus that big, $240k, I thought it would be life changing. the gov took $100k in taxes. I paid off my car $20k. then when I really thought about it there wasn’t much I could do. It was not a down payment on a house in LA/SF/NYC. it was not enough to start a company and hire people. If I’d changed my life style to be like a college student and live with roommates then it might have given me 2-3…

225k in 2025 dollars is life changing for anyone in the middle class of income. The reason you were unable to do anything with it is because you were already earning too much.

$240k bonus was double my yearly salary.

I think you probably know people who've gone though something like this via inheritance. A parent dies, leaves them $200-300k You don't see their life change at all. Of course most people don't inherit that much but enough do that you probably know some of them or your family knows some of them and yet nothing noticable changed in their life.

Post reply on HN