Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

191–200 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#191

Post by idiotsecant »

mike_hearn wrote: post #67
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

If you get paid in crypto, leave it in crypto, and just trade crypto for goods or services uncle sam is none the wiser.

Re: The Chrome VRP Panel has decided to award $250k for this report

#192

Post by XorNot »

charcircuit wrote: post #89
mike_hearn wrote: post #67

Earlier quoted context omitted.

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

Selling an exploit is not illegal so why bother with money laundering?

Because the people buying it don't get their money from legal sources, nor engage in legal business activities.

They also have every incentive to make sure you're guilty enough to not go blab to the authorities later, or sell it to someone else.

And since you're trying to be anonymous in this, you aren't going to be getting a regular tax receipt either.

Re: The Chrome VRP Panel has decided to award $250k for this report

#193

Post by rkomorn »

AlienRobot wrote: post #190
rkomorn wrote: post #95

Earlier quoted context omitted.

Some current trendy options would be Kotlin (with Kotlin Multiplatform) or C# (with Avalonia UI). Edit: I guess I should've at least asked myself if the question was rhetorical.

My problem with "crossplatform" GUIs that run on Linux is that they aren't made to run on Linux desktop, they are made to run on Android, iOS, Windows, macOS, and finally Linux desktop. All I want is a menubar, a toolbar, a statusbar, and some dialog windows. I don't want fading transitions when I click a tab. It's crazy that I'm forced to write header files just to have a menubar. Zig 1.0 can't come soon enough.

Wouldn't Qt or GTK be good for this, then?

Or... https://quickshell.org/ ?

Re: The Chrome VRP Panel has decided to award $250k for this report

#194

Post by idiotsecant »

bravesoul2 wrote: post #173
brohee wrote: post #92

Earlier quoted context omitted.

Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607 Your hookers and blow dealers won't report you to the taxman.

Lol. HN the famously "confidently incorrect" forum especially on-coding topics is not my lawyer. And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

Just use your ill gotten gains slowly for your regular living expenses, or a portion of them. Let your legit money stack up. Don't cross contaminate the two. EZPZ very unlikely to get caught.

Re: The Chrome VRP Panel has decided to award $250k for this report

#195

Post by XorNot »

johnisgood wrote: post #52
ajb wrote: post #47

Earlier quoted context omitted.

"If I report the body, no-one will suspect I'm the murderer" Yes they will.

Which is why people are hesitant to report a body they have not killed, just found!

Except if you're not the murderer, then there'll be little evidence pointing to you.

If you are the murderer, there will be.

Re: The Chrome VRP Panel has decided to award $250k for this report

#196

Post by tptacek »

brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Yes; this is the one case where there's a liquid market for these kinds of vulnerabilities. The important detail: for these (and only these) bugs, you can sell them multiple times; for instance, firms exist that specialize in selling these bugs and their enablement packages to, say, every law enforcement and intelligence agency in a single country.

Re: The Chrome VRP Panel has decided to award $250k for this report

#197

Post by tptacek »

sureglymop wrote: post #135
edent wrote: post #124

Earlier quoted context omitted.

OK. But how do I find them ? And, again, how do I assess their reputation and likelihood of paying me. How much of a premium are they paying to make it worthwhile?

I mean you just search on google... Zerodium, Crowdfense, Exodus Intelligence, etc. Sure, I'd say the "sell it elsewhere" stuff is always a bit overly optimistic but due to the nature of this specific exploit I am pretty sure you could find a buyer offering good compensation.

Does Zerodium even exist anymore? The impression I have is that people seriously selling clientsides weren't going through any firm a typical message board thread would be talking about.

Re: The Chrome VRP Panel has decided to award $250k for this report

#198

Post by XorNot »

bravesoul2 wrote: post #173
brohee wrote: post #92

Earlier quoted context omitted.

Some exploits are sold bag of cash under a table. See e.g. https://news.ycombinator.com/item?id=20651607 Your hookers and blow dealers won't report you to the taxman.

Lol. HN the famously "confidently incorrect" forum especially on-coding topics is not my lawyer. And yeah if you want normal stuff like a house or car you'd need to wash the money. How do I know? Breaking Bad. Which lets be honest is probably for most of us, our only reference point here.

Hey now, for me it was late primary or early secondary school and the book "45+47 Stella St and everything that happened"[1]

[1] https://www.elizabethhoney.com/45--47-stella-street.html

Re: The Chrome VRP Panel has decided to award $250k for this report

#199

Post by jacquesm »

edent wrote: post #106
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

> pretty sure it he could have gotten more tax free on the black market. How? I've been paid by bug bounties (although not that big) and I have no idea how I would find a trustworthy criminal to sell to. I guess I'd need to find a forum? Unless my opsec is exemplary then I'm risking being exposed. I'd need to vet that the buyer would actually pay me and not just steal it from me. Even if they do pay me, I'd be worrie…

> a trustworthy criminal

Not going to happen.

Re: The Chrome VRP Panel has decided to award $250k for this report

#200

Post by jacquesm »

mike_hearn wrote: post #67
brohee wrote: post #14

He had a pretty reliable exploit on the most used browser, pretty sure it he could have gotten more tax free on the black market. Now, with EDR widely deployed it's likely that the exploit usage ends up being caught sooner than later, but pretty sure some dictatorship intelligence agency would have found all those journalists deep compromise worthwhile...

Selling something to the black market doesn't magically make it tax free. It's almost the opposite. The money is going to show up in your auditable accounts sooner or later, so it's best to pay tax on it, but you'll also have to come up with a fake but auditable story of where it came from, meaning you'll have to engage the services of professional money launderers. They will also take a cut. So, it's like paying tax…

Up to here you weren't committing any crimes.

> but you'll also have to come up with a fake but auditable story of where it came from

And now you did.

Post reply on HN