Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Artery chokes after 70 copies of Visual Studio”

connect.microsoft.com

Post reply on HN
Print view View original

81–90 of 99 posts

Re: “Artery chokes after 70 copies of Visual Studio”

#81

Post by singlow »

evan_ wrote: post #71
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive". If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the b…

I don't think the bounty is all that significant in deterring any would-be exploiter. Instead, it incentivizes the honest person who enjoys the puzzle of finding the exploit but would never actually try to profit from it illegally. It might allow some of those "hobbyists" to justify a little more time at the task, or attract them to one project over another.

Re: “Artery chokes after 70 copies of Visual Studio”

#82

Post by MichaelGG »

droopybuns wrote: post #35
evan_ wrote: post #32

Earlier quoted context omitted.

Bounties exist for security bugs to make it more profitable to report the bug than it is to exploit it, or to sell knowledge of it to those who would. A buy about opening 70 copies of Visual Studio is unlikely to be very profitable to exploit.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

Please tell me, what do I need to do to sell to nation states? I've found lots of remotely-exploitable (as in root or direct financial gain) in open source and commercial software. Vendors have poor responses[1] so I've stopped disclosing but if I could legally convert them into cash I'd be very interested in knowing how. For now I'm just keeping them because I might decide to open an auditing company some day and they'd be good marketing.

1: Once a company got angry and blamed me for delaying their shipping cycle. Another time they laughed when I suggested their memory corruption might be leveraged for escalation. And another vendor told me "buffer overflows would only happen maybe if you had a very fast network IO".

Re: “Artery chokes after 70 copies of Visual Studio”

#83

Post by milkshakes »

MichaelGG wrote: post #82
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

Please tell me, what do I need to do to sell to nation states? I've found lots of remotely-exploitable (as in root or direct financial gain) in open source and commercial software. Vendors have poor responses[1] so I've stopped disclosing but if I could legally convert them into cash I'd be very interested in knowing how. For now I'm just keeping them because I might decide to open an auditing company some day and th…

you could always work for endgame systems

Re: “Artery chokes after 70 copies of Visual Studio”

#84

Post by fleitz »

saraid216 wrote: post #68
fleitz wrote: post #60

Earlier quoted context omitted.

The feds usually play on the god and country crap rather than actual cash.

Speaking from experience?

Just general observations from things like the rate of pay differences between the army and blackwater.

I'm imagining that if you phoned up the CIA/NSA to sell them a vulnerability that they would not pay you and instead would send some lawyers to seize the info under a flimsy pretext.

For the most part the gov't acts like working for the gov't is some noble thing worthy of losing pay over, as if it was some special honor to die being paid $40K per year instead of $400K per year.

That said if you can contract something out to the gov't through official channels they'll pay the stupidest rates imaginable. So I guess if there was an FBO contract for vulnerabilities you'd probably do quite well.

Re: “Artery chokes after 70 copies of Visual Studio”

#85

Post by x0x0 »

MichaelGG wrote: post #82
droopybuns wrote: post #35

Earlier quoted context omitted.

Repectfully, you are incorrect that bounties exist to make it more profitable to disclose than to sell. Corporate bug bounties will never be able to compete with the budgets of nation states. They are basically a way of paying respect for a moral approach to a discovery that takes great skill.

Please tell me, what do I need to do to sell to nation states? I've found lots of remotely-exploitable (as in root or direct financial gain) in open source and commercial software. Vendors have poor responses[1] so I've stopped disclosing but if I could legally convert them into cash I'd be very interested in knowing how. For now I'm just keeping them because I might decide to open an auditing company some day and th…

here's a profile of a 0-day broker [1] I read a few years ago

[1] http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...

Re: “Artery chokes after 70 copies of Visual Studio”

#86

Post by eitland »

iLoch wrote: post #74
rbanffy wrote: post #49

Earlier quoted context omitted.

> The bounty "prize" is you will eventually have a working product to use. While an IDE running under Windows is hardly what I would like to work with, a bug that manifests itself only on such extreme circumstances cannot be called a showstopper. I would worry more about other instances where this Peek() method is being misused like this, perhaps on other situations that happen more frequently than Visual Studio 2013…

> While an IDE running under Windows is hardly what I would like to work with Visual Studio is probably the best IDE ever created. Have you even used it?

Which other ones have you spent significant time on? : )

IntelliJ is made by the folks that create the resharper plugin that adds decent refactoring to vstudio.

Eclipse has equally good refactoring, -out of the box just as IntelliJ

Re: “Artery chokes after 70 copies of Visual Studio”

#87

Post by sjf »

rbanffy wrote: post #79
iLoch wrote: post #74

Earlier quoted context omitted.

> While an IDE running under Windows is hardly what I would like to work with Visual Studio is probably the best IDE ever created. Have you even used it?

Yes. I used Visual Studio since 97 (and other Microsoft development tools that eventually merged into VS since 1991). I used VS more than any other development tool until 2001 or 2002. Used it occasionally until 2010. Visual Studio is a very good IDE, but, unless whatever you are developing is designed to run (or be served from) Windows, it's not particularly useful. My problem is not with Visual Studio, but with Win…

We really must be in the age of Linux on the desktop if setting up multiple monitors and printers is trivial...

Re: “Artery chokes after 70 copies of Visual Studio”

#88

Post by dev360 »

Locke1689 wrote: post #57

That explains it: this is a Schabse bug. He reports bugs like: when you have 4 levels of nested generics with an overriden indexed property going through ComImport, the modopts are incorrectly copied into the method signature, causing a runtime crash in the CLR. It's like having another tester on the C# team :)

Or like having an aspbergers stalker?

Re: “Artery chokes after 70 copies of Visual Studio”

#89

Post by MichaelGG »

x0x0 wrote: post #85
MichaelGG wrote: post #82

Earlier quoted context omitted.

Please tell me, what do I need to do to sell to nation states? I've found lots of remotely-exploitable (as in root or direct financial gain) in open source and commercial software. Vendors have poor responses[1] so I've stopped disclosing but if I could legally convert them into cash I'd be very interested in knowing how. For now I'm just keeping them because I might decide to open an auditing company some day and th…

here's a profile of a 0-day broker [1] I read a few years ago [1] http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...

I wonder what pricing is like for industry-specific systems. Places where a operational leak can easily cost $$$$$ a month and go rather undetected and certainly not prosecuted.

I suppose that's only valuable to criminals. Sorta like saying knowing someone's bank info can let you steal money - no one legit will pay for it.

Re: “Artery chokes after 70 copies of Visual Studio”

#90

Post by luke-stanley »

rob-alarcon wrote: post #65
dodders wrote: post #56

From the workarounds tab: "Do not open more than 70 copies of Visual Studio..."

haha, yeah, it's really funny: "Do not open more than 70 copies of Visual Studio and do not, in any case, choke the artery! What's wrong with you? Choking the artery! Have nothing better to do?"

They might be wanting to run automated tests to find some other problem, and find after 70 tests, they get an error. So it's sensible to want to fix it.
Post reply on HN