Hacker News Reader

Comment by p-e-w | Hacker News Reader

> As the Linux kernel is a key component not just for Google, but for the Internet, we started heavily investing in this area. We extended the VRP's scope and maximum reward in 2021 (to $50k), then again in February 2022 (to $91k), and finally in August 2022 (to $133k).

So an award roughly equal to four months' salary for an average Silicon Valley engineer is considered "heavily investing" in security, when it comes to potentially industry-shattering exploits?

I imagine that anyone who knows where to look can easily find dozens of interested buyers willing to pay a lot more than that, from intelligence agencies and their contractors to crime syndicates.

View on HN

Who is lawfully paying out more for bounties on open source projects they didn't even start?

You also seem to discount the monetary value of not becoming a criminal by selling exploits unlawfully. Do you want to be the person that reported a vulnerability to increase security in the world or to give more power to spy agencies or crime syndicates?

How do you define "selling exploits unlawfully?" I'm not aware of any law that says only Google is allowed to purchase information disclosing exploits in open source software.

Because if this exploit is ever used in breach of the computer fraud and abuse act, now you are down as a conspirator.

When you sell this to another party, are you going to report it on your taxes? If you do report it, is your buyer going to like that?

If you clear all those conditions, then by all means.

> When you sell this to another party, are you going to report it on your taxes? If you do report it, is your buyer going to like that?

You don't need to declare who gave you the money on the income tax filing.

Then you get investigated for money laundering?

> You don't need to declare who gave you the money on the income tax filing.

Don't you? I thought that in the US you needed to have either a 1099 or a W2 for any significant employment income.

- this isn't employment income, that's a separate category with higher taxes

- you want the payment sent to your LLC or similar, not directly to you. See above

- the requirement to file a 1099 is on the payer, not the worker

- many transactions don't require filing a 1099, most notably all payments made using a credit card. If you're an independent contractor in the US and accept credit cards, you'll get paid 5 minutes after sending an email instead of 30 days later after it goes through layers of approval

> Who is lawfully paying out more for bounties on open source projects they didn't even start?

That’s kind of begging the question. Google invests a non trivial amount employing Linux kernel developers. How do these bounty payouts compare in terms of the amount they pay for their own engineers and security researchers? This also isn’t a donation. This is rewards for work Google finds valuable enough that they’ve changed several products based on this work. They also benefit immensely from all the free labor other companies and volunteers out into the kernel.

I think OP raised an extremely fair critique of the amount being too small.

If it's too small, what is the right amount, and who should pay it?

I believe the world governments should create an international organization funded by per country quotas like the IMF for example to pay for bounties, but until then, the fact a private company does this sets the market price for exploits, and saying "it's too low" seems meaningless if there's no proof anyone is willing to pay more.

I'm sure if it were $1m per bounty some other HN user would say it should be more as well. That's why you define this by how much someone _actually_ pays out, because talk is cheap.

> and saying "it's too low" seems meaningless if there's no proof anyone is willing to pay more.

The black market is a good proxy for estimating the true market value of an exploit. There’s a coupon to be applied in terms of the legal costs associated with selling on the black market, but still comparable.

The other way to look at it is when are there diminishing returns. From the chart they posted, they’re very far away from that.

Finally the other way to look at it is compared with other kinds of bounties they run for OSS.

Anyway, of course they should be commended for having any bounty. They’re certainly not required by legislation. But maybe instead of having an international governmental or NGO with funding, you could require that some percentage of a SW company’s revenue is diverted to bug bounties for SW depending on how critical the SW is to the ISV’s business. That way it’s a cost directly borne by the ISV using the software to internalize the security risk into a P&L line item for the software being used (and not just OSS - all software from an ISV should be forced into bug bounties like that). And the vendor has a vested interest in confirming the VULN whereas a NGO could have all kinds of soft corruption to incentive flowing payments to friends. That being said, I’m not sure the status quo would really improve in such any alternate scheme.

Finding black market prices has been done in the past. The issue is that people often do not have a clear understanding of what a “product” actually looks like on the black market and what the value of the “coupon” is.

I'm pretty sure it's "lawful" to sell exploits to intelligence agencies of your own country. It wouldn't make any sense for it not to be, considering that the same people who control those agencies also control what's legal and what isn't.

Can you link me to where I can submit bounties to a spy agency, and any material or personal anecdote about them paying more than Google for Linux kernel exploits? Because so far this all sounds like speculation on your part.

> Can you link me to where I can submit bounties to a spy agency

No. I have no idea. But it would clearly be in the interest of such institutions to have such programs, so common sense says they do. I'm sure that people who are active in this business would know more about it.

I’m not active in this business, but I know people who are. It’s not as easy as you think it is. You cannot just go to a government and say “hey, here’s my bug, give me a million dollars”. First off, your bug probably isn’t worth a million dollars, at least if you’re just converting bug bounty submissions directly. They’re looking for reliable exploits, and payouts will depend on how long they can continue to field the chain (if it gets patched, you might be on the hook for another exploit!) and whether you’re selling it exclusively to them. Payouts will typically happen on a schedule.

Unless you’re a very known quantity they’re not going to talk to you directly, anyways. You’re going to go through a broker who will take a cut. My understanding (though I don’t know much about it) is that say, the NSA, has their own internal teams and they don’t need to buy anything anyways. The other federal agencies will contract out to a handful of firms that generally have salaried employees. You can work there, but now you’re seeing very little of the “profits” that come from the sale. Maybe your exploit will get some shoddy forensics glued into it and end up being sold as “data recovery” or something for a local police department, who probably doesn’t have much money to spare anyway.

It might be lawful in the sense that your country won't persecute you but definitely not for the good of other people and morally questionable.

Yup, GP underestimates the difficulty of being a serious criminal.

If you try to sell your exploit on the black market for 133k but mess up and walk into a federal agent honey pot, now your in jail for 10 years.

Even if you did successfully do it, imagine how hard it is to explain where an extra 133k came from in your bank account.

Why would it be illegal to sell? Is it illegal to sell information on door locks which can be opened with a bump key?

If you are very confident that the buyer is legit and not evil, then you’ll be fine.

Imagine though, that this information you willing sold to a shady party was used in a big hack. Say national security or an oil pipeline or something.

Do you think your defense will hold up in court? How many years will you be in court? Even if you are deemed not guilty, will your life ever be the same?

You’re gonna risk all of that because you thought you could squeeze a $200k out of your bug?

Why "black market"? Surely any intelligence agency worth their salt has a public, open, completely legal program where you can just contact them and offer what you have, no? They'd be stupid not to.

Selling to governments is not trivial, at all. You can't just post these things on eBay and hope for the best. Like all things, you need hard fought relationships to be able to even talk to anyone, let alone actually make a sale.

> You can't just post these things on eBay and hope for the best.

Of course not. You start a "security consulting company" and then apply to be a contractor. There are hundreds, if not thousands, of companies like that. And as an individual researcher, you can either join such a company, or freelance for one.

It's indeed not trivial, but I imagine that anyone with enough experience in the business would know how to pull it off.

Example of someone that did that and posted a writeup? How much did they pay for similar exploits? I would be unsurprised if Google paid more

Generally people who work at these places are not all that chatty about it online.

> I imagine that anyone who knows where to look can easily find dozens of interested buyers willing to pay a lot more than that, from intelligence agencies and their contractors to crime syndicates.

If that were the case, why did even a single person report a vulnerability to Google? Why didn't these muppets just sell it to somebody else for ten times as much? I would suggest tha it's because what you claim isn't correct. It's not actually "easy", and the payoffs won't be "a lot more".

Now, it's pretty hard for anyone to actually refute your argument since literally the only evidence you're providing is your imagination. The one thing we do know is that tens of serious vulnerabilities were reported to Google via this program. Those are a concrete existence proof of this VRP being a sufficient incentive for bugs to be reported via this legit channel. Surely that outweighs your complete lack of evidence.

It’s also possible that people prefer the channel that makes them feel better about themselves?

It's a lot more than the $0 or negative reward that most companies offer. There are many examples of security researchers being rewarded with threats and police reports.

Funny how when a person/company does a small good deed, they get criticized for not doing more but when they don't do anything and implicitly offer $0 they don't get criticized.

You don't include reputation and publicity benefits into the overall profit formula. If you sell stuff on grey market, you'll have to keep your lips tight over that deal. It isn't going to your resume, so if one day you'll decide to join a security division in some corp, you'll have nothing to show them. Whereas a public achievement like this may be a door opener for many places. Same thing with things like pwn2own or security conferences. Why burn knowledge there? Because it promotes you.

Those are just the maximum rewards, not the total rewards paid?

> I imagine that anyone who knows where to look can easily find dozens of interested buyers willing to pay a lot more than that, from intelligence agencies and their contractors to crime syndicates.

This is unfortunately false. The running price for Linux kernel exploit isn't that high.

Note how none of the companies that don't do this find themselves criticized. This is called the Copenhagen Interpretation of Ethics.

In fact, despite so many of us personally relying on this software and giving nothing, we are all immune from criticism.

I suspect that if I had offered $10 into a bounty I would be responsible too for not paying more than lunch in SF. Haha!

My criticism doesn't concern Google's ethics, it concerns their practicality.

Common sense says that with bounties like that, they won't attract the most serious exploits, which isn't an ethical problem, but can absolutely be a security problem.

They only have to beat the prevailing rate on zerodium to get it first. It's not like every exploit is some magically usable thing that can exfil all the googs. People really overrate a bunch of things.

There was a crypto company running with all spectre:meltdown mitigation off. And no one took the money until the company went bust and an insider tried to run with it.

I also told the world that it was the case so it wasn't secret: https://news.ycombinator.com/item?id=32077583

That was a lot of money untraceable if so many of these were exploitable. They're generally not. Google is often the best buyer.

Reading a bit futher, the total for the program comes to almost 2 million which seems heavier than the per-award number.

That is not very much money. You can not even start a single McDonald’s restaurant with that little money.

McDonald’s restauranteurs ought to level up their kernel pwning skills then.

Just wonder if the the reward for security bounty would increase such as 1 - 10 million dollars to match the black market, do you think it would attract more serious security researchers?

Some people also have moral values and selling these would conflict with their personality. Not saying that the payout is high enough for skilled individuals to invest time.

One way is legal, the other is not wirh shady buters, etc.

Reply on news.ycombinator.com