Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Artery chokes after 70 copies of Visual Studio”

connect.microsoft.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: “Artery chokes after 70 copies of Visual Studio”

#71

Post by evan_ »

droopybuns wrote: post #35
evan_ wrote: post #32

Earlier quoted context omitted.

Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive".

If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the bounty every time. I think a lot of people would agree with me.

As discussed further down in this thread, raising the value of the payout or lowering the possibility of being caught makes the other side more attractive.

(of course, I would choose to disclose every time, because I'm just a good person.)

Re: “Artery chokes after 70 copies of Visual Studio”

#72

Post by travem »

RyJones wrote: post #58
rbanffy wrote: post #49

Earlier quoted context omitted.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

I sent a package of branded stuff to someone once - stuff I bought out of my own pocket at the company store - and got upbraided for sending such shitty gifts. Won't make that mistake again. I also worked for a startup where we had a handful of users that really went above and beyond reporting bugs. We sent them $25 amazon gift cards as thanks - the feedback was we were being cheap. One of those gift cards has yet to…

It's not strictly rational but when you are giving extrinsic rewards, like a gift card, they are not perceived as an added reward but as a replacement. What did they replace? The intrinsic motivation/justification that prompted them to perform the action in the first place.

When the motivation switches from intrinsic (I'm doing this because I'm a good person) to extrinsic (I'm doing this for money) we use a different value of judgment which in this case appears to not have worked as well for you as you would have liked. Instead it may have been better to offer some form of recognition/acclaim to reinforce the intrinsic motivation and promote this behavior. For example helping people on stack overflow rewards you with feeling good about being a productive member of a community; the "reputation" score reinforces that same fact. Now imagine instead of having the reputation score mechanic you were paid 25 cents for every accepted answer instead? Would we have seen the same adoption or would people have not bothered "working" for a few dollars an hour?

Re: “Artery chokes after 70 copies of Visual Studio”

#74

Post by iLoch »

rbanffy wrote: post #49
jenscow wrote: post #29

Earlier quoted context omitted.

The bounty "prize" is you will eventually have a working product to use. If you don't report it, then there is slim chance of the bug being fixed.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

> While an IDE running under Windows is hardly what I would like to work with

Visual Studio is probably the best IDE ever created. Have you even used it?

Re: “Artery chokes after 70 copies of Visual Studio”

#75

Post by tzakrajs »

evan_ wrote: post #71
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive". If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the b…

Bad guys must not agree with your assessment of 90% chance of going to jail.

Re: “Artery chokes after 70 copies of Visual Studio”

#77

Post by fyrabanks »

tzakrajs wrote: post #75
evan_ wrote: post #71

Earlier quoted context omitted.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive". If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the b…

Bad guys must not agree with your assessment of 90% chance of going to jail.

I think that's what defines them "bad guys".

Re: “Artery chokes after 70 copies of Visual Studio”

#78

Post by mseebach »

tzakrajs wrote: post #75
evan_ wrote: post #71

Earlier quoted context omitted.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive". If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the b…

Bad guys must not agree with your assessment of 90% chance of going to jail.

The risk of getting caught isn't constant, it's highly dependant on the circumstances and the perpetrator.

Also, besides the crime itself, spending a large sum of ill gotten money without getting caught is a lot easier if you already move in an environment geared for that - few things you can do in a middle class lifestyle that won't arouse suspicion.

Re: “Artery chokes after 70 copies of Visual Studio”

#79

Post by rbanffy »

iLoch wrote: post #74
rbanffy wrote: post #49

Earlier quoted context omitted.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

> While an IDE running under Windows is hardly what I would like to work with Visual Studio is probably the best IDE ever created. Have you even used it?

Yes. I used Visual Studio since 97 (and other Microsoft development tools that eventually merged into VS since 1991). I used VS more than any other development tool until 2001 or 2002. Used it occasionally until 2010. Visual Studio is a very good IDE, but, unless whatever you are developing is designed to run (or be served from) Windows, it's not particularly useful.

My problem is not with Visual Studio, but with Windows. After many years using Macs and Linuxes, Windows is an incredibly confusing environment. With Linux and Macs I always know what to expect. Trivial things like setting up wireless networking or a network printer or a multi-monitor setup often involve downloading a program that will install an application that will manage what you want to do. It's insulting to have to download a hundred megabytes of stuff just to use a printer and then have yet another icon somewhere on the screen that doesn't even visually merge with the rest of the environment.

And then you have an environment where you can't even delete an open file. Or eject a USB stick just because some program decided to quit in an unclean way and leave a file open.

After you get used to a consistent and predictable platform, using anything else becomes almost intolerable.

Re: “Artery chokes after 70 copies of Visual Studio”

#80

Post by octagonal »

evan_ wrote: post #71
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive". If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the b…

When is the last time you heard of someone going to jail because of a zero day?
Post reply on HN