Hacker News Reader

Comment by dig1 | Hacker News Reader

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that...

[1] https://bughunters.google.com/about/rules/chrome-friends/574...

[2] https://www.mozilla.org/en-US/security/client-bug-bounty/

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying.

Sounds fine to me.

[0]: https://en.wikipedia.org/wiki/Mozilla_Corporation

//Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percentage.

>According to Wikipedia, that's 0.0012% of their net income.

How much of the Mozilla foundation's income goes into product development nowadays?

Do you imply that it's not 5x, but 500x of what Google pays? /s

260 Mio. USD, as answered by the linked article, though the numbers only go up to 2023. So "nowadays" is a bit of a stretch.

But Chrome is paying more as a percentage of their browser units' income, no?

Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free, for competitors via Project Zero.

The browser totally has zero to do with google ads. Totally no connection at all.

the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.

People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that.

https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.

Don't forget about YouTube!

What about YouTube?

uBlock Origin Lite blocks YouTube ads just fine.

Not for everyone.

Do you really think Google wouldn't do anything about as blockers? Especially now that no ads is one of the selling points of YouTube Premium?

Have you tried? There's a strength setting to the extension. At max strength it's been blocking all YT ads for a while.

And it doesn't matter what I think about it. I'm giving you facts not opinions.

Well, maybe.

Personally I believe that the browser is intended to defend against e.g. Facebook's apps. Google wants to make sure that if you buy a new device and it comes with a Facebook app preinstalled, it also comes with a browser. And that the browser isn't controlled by anyone who'd like to disrupt any of Google's many nice income streams.

Do you pay a software engineer for their time based on your revenue or his skill?

Mostly based on revenue - or at least that is the way we are going.

That is why you see equivalent skill levels being paid differently in big tech compared to other places.

And why you see millions in salaries at some big techs Ai hiring.

Not at all. Corporation always pays as little as possible. Unless we are talking about CEO levels...

Both - these are the two sides of the market, aka supply and demand.

If you don't have the revenue, you don't pay them at all, because you don't actually employ them.

It's really no secret that higher revenue means higher potential pay/more devs...

Be somewhat competitive to what such developers could get on the black market. Discounting the ethics.

Surely a bug on Chrome is worth more than a bug on Firefox.

Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?

This is the complete opposite in every facet. I struggle to think of a worse analogy.

Bad analogy, but yes actually. This is one reason people buy drugs from illegal online pharmacies - cost. I

To the extent that meth is a viable substitute for cold medicine you'll have those prices correlating.

But more to your point: the bounty is more similar to an auction. Once you sell the bug to the software producer the black market has no more use of it, assuming it gets fixed.

Supply is constrained, so competition is on the demand side.

On the drug example demand is constrained, if you're the only buyer. So competition happens on the supply side.

If only they'd use a similar rubric to rein in their CEO comp[1].

[1]: https://news.ycombinator.com/item?id=24132168

Is their CEO comp not in line with the market?

Are Mozilla's earning in line with the market?

That's a bad rubric to judge by, in this case. CEO pay is at a historic high, in fact I'm pretty sure the last time the gap in wage between median workers and CEOs was this high was the roaring 20's, which famously went quite well for the economy.

No. More than 80% of Mozilla Corp's income is a yearly payment from Google. [0]

The payment will stop immediately if Google thinks it's no longer needed, or if federal prosecutors (who have determined this payment is illegal) decide the remedy is to stop the payment. [1]

The CEO's job is simple. Say "I think we should take Google's money again this year", and then pocket several million of it. Ca-ching! What are your plans for post-Google-money? Uh uh... AI? Sell out our users to advertisers? [2] It's not looking good.

The Firefox market share continues to dwindle. The board continues to hob-nob with San Francisco socialites and "activists" and use Mozilla as a piggybank to fund their chums. [edit: removed line about Mitchell Baker as she does seem to have finally left]

[0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances

[1] https://www.bloomberg.com/news/articles/2024-08-05/google-lo...

[2] https://news.ycombinator.com/item?id=43185909

> Mitchell Baker did not leave the gravy train by stepping down as CEO, she merely moved to a different seat on the gravy train - chair of the Mozilla Foundation

Mitchell has not been a member of the Mozilla Foundation or Mozilla Corporation boards since February 2025.

https://blog.mozilla.org/en/mozilla/mozilla-leadership-growt...

Thanks for noting that, I hadn't realised. I've edited out that line.

Chrome has 15-20 times the users that firefox in the blackmarket the bug would sell for similar ratio. Safari might go for more as it has more rich and tech security illiterate users.

disagree. more marketshare does not mean juicier targets, which, in this case, would be tor users. in addition, you don't buy an exploit to use it en masse, that would get it burned really quickly

More market share does in fact impact availability of targets, but in the case of Firefox it's just as much a factor that there are more bugs and exploits floating around.

Have you looked at the financial health of the one company vs the other? I am pretty sure Google is making more than 10x the money Mozilla is making.

It'd be fun to do a sketch that's a montage of an array of HN armchair quarterbacks rolling up their sleeves and taking short-lived shots at CEO for Mozilla.

Marching into the home office, kicking butt, and pointing at the whiteboard for their favorite pet project:

* Mozilla focusing on privacy

* Mozilla focusing on web standards

* Mozilla focusing on speed

* Mozilla (apparently, here) focusing on maximizing the size of payouts for bug bounties

Inspiring, Rocky-style music plays in the background.

In the foreground, a red line continuously traces slowly downward, with no perceivable relationship to the scenes in the montage.

The grey market also offers much less for Firefox vulnerabilities, for reasons of both supply and of demand.

* Compare income * Compare market share * Compare market share normalised by likelihood of attack yielding benefit, in short-- fx users would be power users probably more likely to have other ways to mitigate an attack

* Or basically just compare black market prices which already taken the above 3 into account

Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug.

Won't complain about that.

> Tells you who is more serious about security.

Yup, clearly Mozilla.

$250k is loose change for Google.

Really doesn't tell me piss all, as I'm not privy to their respective overall cash flow. Are you, considering you say it does for you?

Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously, by the way? Sounds a bit backwards to me.

What I call backwards is Mozilla paying their executives multi-millions of dollars for failure and the decline of Firefox.

Maybe had they ran the company competently, they could to afford to pay their engineers and offer larger bounties instead.

> Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously.

Many such researchers would rather sell their 0day to the black market if the effort + price offered is too low and not worth it. It is up to the vendor (Mozilla) to set a fair price to prevent that exploit from reaching the black market for a much higher price.

So given all the above, Mozilla is not serious.

Just like you personally obviously don't care about your personal security when you do not pay a team of body guards 250k a year.

Reply on news.ycombinator.com