Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Artery chokes after 70 copies of Visual Studio”

connect.microsoft.com

Post reply on HN
Print view View original

51–60 of 99 posts

Re: “Artery chokes after 70 copies of Visual Studio”

#51

Post by catshirt »

Fuxy wrote: post #44
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

That sounds like wishful thinking to me. Realistically companies including Microsoft will pay as little as they can to anybody and if they get such nicely detailed bug reports for free why would they ever pay.

that's the point. if they were paying to compete with the black market they would be paying more.

Re: “Artery chokes after 70 copies of Visual Studio”

#52

Post by sliverstorm »

kalleboo wrote: post #50
sliverstorm wrote: post #47

Earlier quoted context omitted.

Of course they cannot compete on a dollars-for-dollars basis, but people will often accept less return (or pay more) to stay on the up-and-up. If a criminal would pay you $10 for your exploit, and I would pay you $9 to disclose it- many people would opt to disclose.

And what if instead of $10 and $9, it's $75,000 and $1,000? And you live in an Eastern European country, where the former will feed your family for years.

Then the ratio of people who would disclose, changes. I'm not saying the bounties prevent everyone from selling to criminals.

Re: “Artery chokes after 70 copies of Visual Studio”

#53

Post by pflats »

sliverstorm wrote: post #47
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

Of course they cannot compete on a dollars-for-dollars basis, but people will often accept less return (or pay more) to stay on the up-and-up. If a criminal would pay you $10 for your exploit, and I would pay you $9 to disclose it- many people would opt to disclose.

Furthermore, I imagine it could attract researchers' priority and attention to your product over a competitor who offers a lesser/no bounty.

Re: “Artery chokes after 70 copies of Visual Studio”

#54

Post by pbhjpbhj »

neurobro wrote: post #45
chris_wot wrote: post #39

Earlier quoted context omitted.

Yes, well... try this one then: http://support.microsoft.com/kb/168702 Entitled "XL97: Data Not Returned from Query Using ORACLE Data Source", one of the solutions reads: Method 2: Move Your Mouse Pointer If you move your mouse pointer continuously while the data is being returned to Microsoft Excel, the query may not fail. Do not stop moving the mouse until all the data has been returned to Microsoft Excel. I'm sure…

In case people think you were being sarcastic (and maybe you were), a large bank used to pay me $10/hour to push F11, F7, F7, F2 for the first 2-3 hours of each day.

Can you explain further how that worked/helped the bank?

Re: “Artery chokes after 70 copies of Visual Studio”

#55

Post by patio11 »

nraynaud wrote: post #17
Serow225 wrote: post #9

Now that's how bug reports should be written!

I don't think you can always expect your users to do the reduction and the debugging for you, they pay you for a bug free product. In this case it's a developer-centric product, so I guess the bug reports are more geeky, but customers are not here to serve the developers.

they pay you for a bug free product

A nitpick but it's really important that HNers understand it: users do not, in fact, pay for bug free products. They pay for products which achieve the benefits promised to them, bugs and all. If they wanted to buy bug-free products, they'd a) make decisions about software adoption driven primarily by externally visible indicia of bug-freeness and b) pay prices similar to that paid by e.g. the Space Shuttle or flight control systems. Users do neither of these things for most software.

Re: “Artery chokes after 70 copies of Visual Studio”

#57

Post by Locke1689 »

That explains it: this is a Schabse bug. He reports bugs like: when you have 4 levels of nested generics with an overriden indexed property going through ComImport, the modopts are incorrectly copied into the method signature, causing a runtime crash in the CLR.

It's like having another tester on the C# team :)

Re: “Artery chokes after 70 copies of Visual Studio”

#58

Post by RyJones »

rbanffy wrote: post #49
jenscow wrote: post #29

Earlier quoted context omitted.

The bounty "prize" is you will eventually have a working product to use. If you don't report it, then there is slim chance of the bug being fixed.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

I sent a package of branded stuff to someone once - stuff I bought out of my own pocket at the company store - and got upbraided for sending such shitty gifts. Won't make that mistake again.

I also worked for a startup where we had a handful of users that really went above and beyond reporting bugs. We sent them $25 amazon gift cards as thanks - the feedback was we were being cheap. One of those gift cards has yet to be spent, years later.

Re: “Artery chokes after 70 copies of Visual Studio”

#59

Post by [deleted] »

larsberg wrote: post #4
mnichloo wrote: post #2

What I want to know is this, what hellish workflow led to the discovery of this bug?

My guess would be that it's an automated build / deploy system that required some addon installed to run, so they had to run `devenv /build` instead of using msbuild. Then they saw this behavior on one of their build machines when something wasn't installed correctly and the process just terminated, after 71 retries... Source: I was on the visual studio environment team a decade ago, and Rube Goldberg himself could n…

[deleted]

Re: “Artery chokes after 70 copies of Visual Studio”

#60

Post by fleitz »

droopybuns wrote: post #35
evan_ wrote: post #32

Earlier quoted context omitted.

Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

The feds usually play on the god and country crap rather than actual cash.
Post reply on HN