Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

281–290 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#281

Post by jama211 »

bearl wrote: post #240
gambiting wrote: post #122

Earlier quoted context omitted.

I can only assume you'd say so if you were able to do either of those things in the first place, so yeah, it doesn't feel life changing. It's like winning a car in a radio lottery when you already had a car - yeah pretty cool, but not life changing. There's a lot of people who can't even imagine ever being able to put down a deposit on a house or to send their kids to collage debt-free. With an amount of money like t…

Property taxes are very high thanks to prop 13. 250k in California is like 30k in states like Texas or Illinois, enough to make it a great year but not life changing.

I think you’re exaggerating a few things, and forgetting that even if expenses like housing are higher, not every cost scales with income. The price of many standard goods are very similar. Not to mention that for example if you have x% of your income left over after expenses, that’s still way more money in one situation over another.

You’re sounding very out of touch to be honest.

Re: The Chrome VRP Panel has decided to award $250k for this report

#282

Post by jama211 »

Enginerrrd wrote: post #183
remus wrote: post #113

Earlier quoted context omitted.

Immediate follow up questions from the tax man, and then shortly afterwards the police "who is this guy? where is the invoice? what is his phone number?"

No, it doesnt typically work that way at all. The tax man just wants to get paid. I grew up in an area known for people growing cannabis before it was legal. An enormous amount of taxes got dodged through cash land deals, but tons of people just claimed the income under various categories and no one ever came knocking because of that. Its usually the other way around. If you caught the Fed's eye, then they might try…

“I didn’t see these specific people get caught much in this specific situation therefore in general it works this way” - do you see how silly this sounds?

Re: The Chrome VRP Panel has decided to award $250k for this report

#283

Post by CrimsonCape »

saagarjha wrote: post #144
jve wrote: post #72

Earlier quoted context omitted.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

Programming is the consideration of implementation details. When you manipulate strings in C you consider the terminating nul byte just like when you manipulate strings in Python you consider how its stores codepoints or when you manipulate strings in Swift you think about grapheme clusters. There is no free lunch. (Though, of course, you can get reduced price lunches based on the choices you make!)

Pardon my ignorance, since I don't know C, but is it true to say that the length of string "Foo" is greater than 4 because of the null terminating byte? Or maybe there is no concept of string length? I could see this getting annoying since Foo is three chars long, you would assume it's length is 3, but we could be speaking of the actual length of bytes, in which i assume it is sizeof(char)*3+1 i.e. the sizeof(char F, char o, char o)+1nullbyte

Re: The Chrome VRP Panel has decided to award $250k for this report

#284

Post by probably_wrong »

CrimsonCape wrote: post #283
saagarjha wrote: post #144

Earlier quoted context omitted.

Programming is the consideration of implementation details. When you manipulate strings in C you consider the terminating nul byte just like when you manipulate strings in Python you consider how its stores codepoints or when you manipulate strings in Swift you think about grapheme clusters. There is no free lunch. (Though, of course, you can get reduced price lunches based on the choices you make!)

Pardon my ignorance, since I don't know C, but is it true to say that the length of string "Foo" is greater than 4 because of the null terminating byte? Or maybe there is no concept of string length? I could see this getting annoying since Foo is three chars long, you would assume it's length is 3, but we could be speaking of the actual length of bytes, in which i assume it is sizeof(char)*3+1 i.e. the sizeof(char F,…

The string length in C is "whatever number of bytes are there between the beginning of the string and the first \0 character". That's different from "how much memory is being used by this string" because you usually allocate a bigger buffer.

The length of the string "Foo", when properly terminated, is 3. The minimum number of bytes needed [1] to represent that string properly is 4 (3+'\0'). The actual number of bytes used by that string is whatever you asked for and received when using "malloc".

[1] Assuming ASCII and 1-byte characters.

Re: The Chrome VRP Panel has decided to award $250k for this report

#285

Post by saagarjha »

CrimsonCape wrote: post #283
saagarjha wrote: post #144

Earlier quoted context omitted.

Programming is the consideration of implementation details. When you manipulate strings in C you consider the terminating nul byte just like when you manipulate strings in Python you consider how its stores codepoints or when you manipulate strings in Swift you think about grapheme clusters. There is no free lunch. (Though, of course, you can get reduced price lunches based on the choices you make!)

Pardon my ignorance, since I don't know C, but is it true to say that the length of string "Foo" is greater than 4 because of the null terminating byte? Or maybe there is no concept of string length? I could see this getting annoying since Foo is three chars long, you would assume it's length is 3, but we could be speaking of the actual length of bytes, in which i assume it is sizeof(char)*3+1 i.e. the sizeof(char F,…

strlen("Foo") == 3 but you need 4 bytes to store it.

Re: The Chrome VRP Panel has decided to award $250k for this report

#286

Post by saagarjha »

Wowfunhappy wrote: post #171
saagarjha wrote: post #138

Earlier quoted context omitted.

Black hats will not pay you for an exploit that dies quickly once the white hats get your report. White hats will not pay you for an exploit that you fenced to a black hat agency and showed up in the wild.

> White hats will not pay you for an exploit that you fenced to a black hat agency and showed up in the wild. ...come to think of it, how does that work? Aren't the most important exploits to patch the ones being actively used in the wild? In other words, how do they avoid someone playing both sides? "I found an exploit being used by the LEETH4X0R malware [which was in fact created by the guy I sold this exploit to]…

You won't get paid for an in-the-wild exploit.

Re: The Chrome VRP Panel has decided to award $250k for this report

#287

Post by saagarjha »

brohee wrote: post #246
saagarjha wrote: post #130

Earlier quoted context omitted.

> Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later lol

Why? If you actually exit the sandbox you'll start leaving traces, and eventually you'll slip and be looked at. That's part of the story EDR vendors sell at least. You can't deny that you are way more likely to burn the exploit using it on a machine under watch than on a machine that is not...

Because most EDR is not designed to catch exploits.

Re: The Chrome VRP Panel has decided to award $250k for this report

#288

Post by saagarjha »

uecker wrote: post #234
saagarjha wrote: post #162

Earlier quoted context omitted.

As you can expect, the answer to your question is the obvious one.

I do not think it is obvious or trivial question. I think the problem is mostly that there is no money for enhancing the C ecosystem and educating people about possibilities. The cooperate money goes into random new things.

I think most of the money goes to new languages that have a better strings story, yes.

Re: The Chrome VRP Panel has decided to award $250k for this report

#289

Post by AJRF »

tptacek wrote: post #210
AJRF wrote: post #116

I wonder how much the black market would pay for an exploit like that - anyone know?

Grey market, not black. It's been several months since I've talked to anyone in the space but full-chain reliable quiet Chrome exploit packages were high six figures, with discussions starting about bugs reaching 7 figures imminently, and the people I talked to might have been talking that down (or talking it up). Again, remember that grey market payouts are tranched, so you could get 3x more than Google would pay, o…

I’m sure there is a black market for something like this?

Re: The Chrome VRP Panel has decided to award $250k for this report

#290

Post by tptacek »

AJRF wrote: post #289
tptacek wrote: post #210

Earlier quoted context omitted.

Grey market, not black. It's been several months since I've talked to anyone in the space but full-chain reliable quiet Chrome exploit packages were high six figures, with discussions starting about bugs reaching 7 figures imminently, and the people I talked to might have been talking that down (or talking it up). Again, remember that grey market payouts are tranched, so you could get 3x more than Google would pay, o…

I’m sure there is a black market for something like this?

I'm sure there is too, but I think over the medium term the government market is going to consistently outbid it.
Post reply on HN