Hacker News Reader

Hacker News

Comment by applfanboysbgon | Hacker News Reader

Full thread

applfanboysbgon

> $25,000 to the first true universal jailbreak to clear all five questions.

This program is a complete scam. Even if 100 people find "bugs", they will only pay out to one person.

View on HN

Do we also have to pay for the API usage? Then they will actually be profitable, lol

How is that a scam? You don't get participation awards for solving half of a puzzle...

I didn't say anything about partial solutions. The puzzle can have multiple full solutions. Or does the software you write only have exactly one bug? If so, that's impressive, in multiple ways, including the fact that you're able to identify that there's exactly one bug but not what the bug is and fix it.

The fact the bug bounty program is private and requires you to apply and be accepted first is also sus especially when the scope is the desktop app anyone can download.

They will also decide what “true” means.

that's not the point even. They are attempting to build credibility in two ways: 1. this model is SO advanced that there are huge risks, never before considered. 2. we're doing the super-responsible thing in incentivizing work that addresses this. #1 is unproven and frankly, unlikely, which makes #2 meaningless. The fact that the "prize" is so low & structured this was suggests that they're not that concerned but do think it's likely that a bunch of people will find things. If they truly thought their model was so good they would be confident issues would be both rare and very critical, then offer huge rewards with no limits because they'd be much more confident no one would claim it.

Yes, I was about to edit in that I think this is simply a media/PR stunt before I got so many replies so quickly. They get bonus points because the structure is so insulting that it may not engender many serious participants, in which case it may go unbroken, in which case they can go to the media and proclaim "look, we offered a reward, but nobody broke it! Our model is objectively the safest in the world!".

I think there's definitely going to be a prizewinner. It's an insultingly low bounty for a professional, but a script kiddie could probably figure out a jailbreak and it's a huge payout for them.

Well, that depends on how you set up the bounty program. What if I find a solution, share it to a friend so that both of us can claim the prize?

bug bounty programs have never paid out independent disclosure for the same bug though; they might split or even pay-out larger coordinated efforts. It's largely a first place award only.

assume there exists 2+ different bugs

after the 1st bug is found, no payout for any other of the bugs

Reply on news.ycombinator.com