Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Becomes First Hacker to Earn $1M Through Bug Bounties

digit.fyi

Post reply on HN
Print view View original

41–50 of 178 posts

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#41

Post by kerng »

WrtCdEvrydy wrote: post #39
shiado wrote: post #33

Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen t…

I've never had this happen but what I've had in the past is people saying "This isn't a vulnerability", then I told them I would go public with it with an Easy POC that anyone could do. Example: http://writecodeeveryday.github.io/projects/badqr/ I literally had to twist their arm to get it patched... since was a something to 'reduce friction' which allowed you to steal someone's Bitcoins. At the time, the POC would h…

With Amazon AWS I had fun exchange a couple of years back. They don't have a bug bounty (still I think), but their response was that they will fix it but not publicly recognize it because "the cloud is always secure"? Go figure.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#43

Post by elpakal »

crapbone wrote: post #38
tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

But no one is going to pay $330k to a 17 year old with no experience

And a pretty good income for 13/14 year old

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#44

Post by staticassertion »

crapbone wrote: post #38
tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

But no one is going to pay $330k to a 17 year old with no experience

Well, they did, right? So that doesn't seem true.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#45

Post by mattigames »

Narkov wrote: post #13

I'm very happy for the kid and like the idea that these programs are available but does this incentivise companies to effectively outsource their bug finding? From a purely fiscal point of view, why hire expensive full time staff to go digging when you can just throw a few sheckles at stuff as it comes up?

So what? Nearly every advance of technology and management is in one way or another making more job positions irrelevant, if we want to tackle the ultimate consequence of leaving people without a living wave then we should tackle that problem directly instead of complaining when companies try to use cheaper alternatives to their problems.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#46

Post by [deleted] »

badfrog wrote: post #20
Narkov wrote: post #13

I'm very happy for the kid and like the idea that these programs are available but does this incentivise companies to effectively outsource their bug finding? From a purely fiscal point of view, why hire expensive full time staff to go digging when you can just throw a few sheckles at stuff as it comes up?

Why not both? The bounties are great for finding things your security team might not think about or might consider low-pri, but having a dedicated team is important to make sure you've got the core use cases covered.

[deleted]

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#48

Post by mattigames »

pszndr wrote: post #47
tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

330K USD in San Francisco is much, much less than 300K USD in Buenos Aires

People don't even conceive the difference, in Buenos Aires you can rent a great house in a great neighborhood for 800 USD per month, in San Fran you get a shared room where other 3 people live for that much -IF even that-. In SF you spend at least 5 dollars going anywhere and going back using public transport, in Buenos aires $2 is more than enough to go the the opposite side of the city and back.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#49

Post by oconnore »

staticassertion wrote: post #44
crapbone wrote: post #38

Earlier quoted context omitted.

But no one is going to pay $330k to a 17 year old with no experience

Well, they did, right? So that doesn't seem true.

This is the usual salary vs. contractor thing.

You can almost always make more as a contractor because you're shifting risk from the company onto your LLC. They pay for a la carte results instead of paying for an employee who could hypothetically deliver results.

Re: Teen Becomes First Hacker to Earn $1M Through Bug Bounties

#50

Post by randomacct3847 »

pszndr wrote: post #47
tptacek wrote: post #34

This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.

330K USD in San Francisco is much, much less than 300K USD in Buenos Aires

True, but consider that 70% of rentals in SF are rent controlled. It takes a couple emails from FB groups or Craigslist to find a good living situation for way below market rate.

Case in point: my friend that worked at Waymo paid $900/mo for a room in a house in Lower Haight...

Post reply on HN