“Artery chokes after 70 copies of Visual Studio” • Hacker News Board

Re: “Artery chokes after 70 copies of Visual Studio”

#61

Post by [deleted] » Thu, Apr 24, 2014, 6:15 PM UTC

neurobro wrote: post #45

chris_wot wrote: post #39

Earlier quoted context omitted.

Yes, well... try this one then: http://support.microsoft.com/kb/168702 Entitled "XL97: Data Not Returned from Query Using ORACLE Data Source", one of the solutions reads: Method 2: Move Your Mouse Pointer If you move your mouse pointer continuously while the data is being returned to Microsoft Excel, the query may not fail. Do not stop moving the mouse until all the data has been returned to Microsoft Excel. I'm sure…

In case people think you were being sarcastic (and maybe you were), a large bank used to pay me $10/hour to push F11, F7, F7, F2 for the first 2-3 hours of each day.

[deleted]

Re: “Artery chokes after 70 copies of Visual Studio”

#62

Post by Stormcaller » Thu, Apr 24, 2014, 6:16 PM UTC

RyJones wrote: post #58

rbanffy wrote: post #49

Earlier quoted context omitted.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

I sent a package of branded stuff to someone once - stuff I bought out of my own pocket at the company store - and got upbraided for sending such shitty gifts. Won't make that mistake again. I also worked for a startup where we had a handful of users that really went above and beyond reporting bugs. We sent them $25 amazon gift cards as thanks - the feedback was we were being cheap. One of those gift cards has yet to…

Hey, I think sending some cash is cheap too. It is that "you are worth exactly $25" I hate. If it were - - a public thanks, that would be way better than anything. Either send nothing, or do something good. This bug is not major, but as you said "went above and beyond" some cheap giftcard only implies "you got your $25 that you worked so hard for and we are not grateful anymore, it was a nice trade." These people usually do this because they like it.

This is my point of view and not necessarily right nor wrong.

Re: “Artery chokes after 70 copies of Visual Studio”

#63

Post by neurobro » Thu, Apr 24, 2014, 6:17 PM UTC

pbhjpbhj wrote: post #54

neurobro wrote: post #45

Earlier quoted context omitted.

In case people think you were being sarcastic (and maybe you were), a large bank used to pay me $10/hour to push F11, F7, F7, F2 for the first 2-3 hours of each day.

Can you explain further how that worked/helped the bank?

That was the sequence to accept a security transfer and print the screen (hundreds a day). Then I would match the print-outs to trade confirmations and type the data back into a spreadsheet. Sort of a digital equivalent of digging a hole in the morning and filling it back up after lunch. It was supposed to be a temp job for a couple weeks until the fancy new system was ready, but I quit after 6 months.

Re: “Artery chokes after 70 copies of Visual Studio”

#64

Post by brokentone » Thu, Apr 24, 2014, 6:20 PM UTC

droopybuns wrote: post #35

evan_ wrote: post #32

Earlier quoted context omitted.

Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

Bug bounties also pay for the work an individual puts in on x-random company's product. The time taken to figure out and fully demo a POC isn't inconsequential.

Re: “Artery chokes after 70 copies of Visual Studio”

#65

Post by rob-alarcon » Thu, Apr 24, 2014, 6:31 PM UTC

dodders wrote: post #56

From the workarounds tab: "Do not open more than 70 copies of Visual Studio..."

haha, yeah, it's really funny: "Do not open more than 70 copies of Visual Studio and do not, in any case, choke the artery! What's wrong with you? Choking the artery! Have nothing better to do?"

Re: “Artery chokes after 70 copies of Visual Studio”

#66

Post by droopybuns » Thu, Apr 24, 2014, 6:54 PM UTC

ntakasaki wrote: post #46

droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

>Corporate bug bounties will never be able to compete with the budgets of nation states. I somehow first misread that as 'Companies will need budgets of the level of nation states if they start paying for all bugs'.

Ha!

Re: “Artery chokes after 70 copies of Visual Studio”

#67

Post by droopybuns » Thu, Apr 24, 2014, 6:57 PM UTC

Fuxy wrote: post #44

droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

That sounds like wishful thinking to me. Realistically companies including Microsoft will pay as little as they can to anybody and if they get such nicely detailed bug reports for free why would they ever pay.

Is ms paying bounties?

I thought they only reward major exploit mitigation bypass.

So I am not sure whose argument this supports, but I think ms pays bottom dollar ($0) for general vulns.

Re: “Artery chokes after 70 copies of Visual Studio”

#68

Post by saraid216 » Thu, Apr 24, 2014, 7:01 PM UTC

fleitz wrote: post #60

droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

The feds usually play on the god and country crap rather than actual cash.

Speaking from experience?

Re: “Artery chokes after 70 copies of Visual Studio”

#69

Post by achamayou » Thu, Apr 24, 2014, 7:15 PM UTC

raverbashing wrote: post #33

larsberg wrote: post #4

Earlier quoted context omitted.

My guess would be that it's an automated build / deploy system that required some addon installed to run, so they had to run `devenv /build` instead of using msbuild. Then they saw this behavior on one of their build machines when something wasn't installed correctly and the process just terminated, after 71 retries... Source: I was on the visual studio environment team a decade ago, and Rube Goldberg himself could n…

One of my personal corollaries: all build systems suck Some suck more, some less And most of the time it's overcomplicated.

No one ever wants to build, all a developer really wants is a type checker.

Re: “Artery chokes after 70 copies of Visual Studio”

#70

Post by evan_ » Thu, Apr 24, 2014, 7:23 PM UTC

kalleboo wrote: post #50

sliverstorm wrote: post #47

Earlier quoted context omitted.

Of course they cannot compete on a dollars-for-dollars basis, but people will often accept less return (or pay more) to stay on the up-and-up. If a criminal would pay you $10 for your exploit, and I would pay you $9 to disclose it- many people would opt to disclose.

And what if instead of $10 and $9, it's $75,000 and $1,000? And you live in an Eastern European country, where the former will feed your family for years.

Do we have the numbers on what percentage of disclosed bugs are from Eastern Europe/"poor" countries? My guess is that gray-hat researchers take into consideration their likelihood of being caught when considering the bounty.

It would be interesting to know the percentage of people from less-developed countries who choose to claim bounties rather than exploit the bug vs. that of people in more-developed countries. I think you would probably find that fewer bug bounties are claimed by researchers in countries with less computer crime enforcement. I think you would also find that raising the payout for bug bounties would affect that likelihood.

Great thesis project for someone to work on.