Hacker News Reader

Comment by dheera | Hacker News Reader

Honest question: Was the $2M figure advertised in advance? Where does one go about discovering bug bounties of this size?

It seems like it might be worth the gamble of taking 3-6 months off work to discover a bug of that size.

View on HN

> Was the $2M figure advertised in advance?

https://blog.sei.io/bug-bounty/

> Where does one go about discovering bug bounties of this size?

- SECURITY.txt for individual projects.

- https://immunefi.com for blockchain in general.

- BugCrowd and HackerOne for wider tech.

I'm an infrastructure engineer though and may not be the best person to answer.

> It seems like it might be worth the gamble of taking 3-6 months off work to discover a bug of that size.

https://www.hackerone.com/ethical-hacker/meet-six-hackers-ma...

Note: I work at a foundation for another blockchain. This doesn't affect anything I wrote above, just disclosing potential CoI.

It was advertised in advance, but the real gamble is on if they'll pay. If you go to my other blogpost linked in OP, you can see a case where I was owed 500k and paid 60k.

You're right though that it's a lot of risk. It's not something that most of the leaderboard works full time on, though some of us do. The immunefi homepage has a list of all the bounties on offer.

Couldn’t there be a smart contract for this? I’ve no idea how.

Yes, that is actually worth it. This seems comparable to what a third party might pay.

I have always wondered why the payouts are capped at the trillion dollar corps at such low figures. It appears like $75k max and MS and $100k max at Apple. Meanwhile shady 3rd party groups will pay you 10x that, won't they?

Cryptocurrency bug bounty programs perhaps have an advantage in that the risks of classes of bugs are often concrete, financially quantifiable, immediate, and catastrophic. A bad RCE in a mainstream OS could do untold damage to users, reputational damage to the company, and so on, but even if severe, those risks have to be estimated. But in this case, for example, it seems like the $2m bounty was for a bug that, if exploited, would have made $1b in market cap disappear. I expect it's just much simpler to convince a skeptic businessperson when the risks are so clear.

That's a very solid point, as sad as it is.

I suppose the argument for OS makers to raise their rates might be that they are paying 10x below market rates, and the rates were set by the actual freaking market that exists.

If I was a congressional aide, I would definitely write something up about this when my boss was going to drag a Microsoft exec across the coals in public. I would imagine that billions in gov contracts are at risk for MS right now due to lax security. A $2M bug bounty could have prevented that.

I wonder if very large bounties create incentives to create bugs...

Oh yeah, the old cobra effect. However, you could only pull it off once. I am sure a postmortem of all related design and commits would be done, correct?

Also, FAANG level salaries are pretty high for anyone involved with that type of code, right?

There could also be a reverse bounty paid as a salary bonus to the devs if there is no security bug found in N months. A "code quality bonus", if you will. Though only to encourage quality control.

Intentional bug creation should probably result in firing, unless it was done under duress.

Apple outbids bottom- and mid-tier buyers, and top-tier buyers are extremely finicky about what they're buying: exploits, not vulnerabilities, for reliable bugs, with a variety of additional constraints. Apple and Google will buy exploits top-tier IC buyers won't, with less negotiation and less risk.

The major parties to this market are aware of each other and are calibrating against each other; Apple and Google aren't blowing this off. It's complicated and counterintuitive in a bunch of ways.

You can see lots more here:

https://immunefi.com/bug-bounty/

Reply on news.ycombinator.com