One of the best vulnerability researchers in the world right now. Tavis Ormandy is a spectre of doom. He is one of the last people you want to see tweeting about your company.

Every member of Google's Project Zero team is individually more capable and productive than entire teams of consultants at the best security firms.

This is a bit disingenuous. It's almost impossible to measure the output of the other teams/consultants because their reports are never made public.

I wish that we had more opportunities available for researchers to do the work that Tavis is doing. He is very very good and highly productive, but he's not somehow orders of magnitude better at his research than others. The thing that makes him unique is that Google is paying him a full-time salary just to find bugs and post them publicly. He doesn't have to worry about only targeting stuff in bug bounty scope or working on executive-targeted write-ups and consultation reports to make ends meet.

Basically, he gets paid to spend all day, every day, finding bugs and documenting them for people to see. We need more people in those sorts of positions, but only Google is really able to bankroll it.

You make a fair point, but I don't think it's an argument against what I'm saying. If for no other reason than what you stated about being paid for such open goals, he certainly is more productive than most consulting teams. And given his practice and experience at that sort of productivity, he's likely more capable as well.

I agree that security consulting results should be more open, but incentives are not really aligned for that to be the case.

Well, this is Project Zero, the security researchers working there are highly competent, but I do agree this guy is amazing. I wonder what kind of methodology do they use to even come up with these attacks.

Having briefly interacted with a few of them, and following their work in general:

1. They have a phenomenal intuition for where developers get lazy, tired or simply incompetent in security-sensitive code,

2. They have, in aggregate, a vast knowledge and understanding of past vulnerabilities and how those might be repeated elsewhere or imperfectly patched,

3. They practice a lot and they read a lot (i.e. relevant research, etc). It might be more accurate to say that they have a lot of practice because of their work, not that they actively practice outside of work.

4. They are good at the general process of security research - long hours of mostly dull, complex research interspersed with brief eureka moments and bouts of euphoria.

They're an extraordinary team, for sure.

Natalie Silvanovich of Project Zero gave a talk at REcon last year about how she finds flash bugs, and she went into her methodology some: https://www.youtube.com/watch?v=JbvwCEOxyrA

Look at all his bugs:

https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

This is golden:

https://bugs.chromium.org/p/project-zero/issues/detail?id=69...

Not that I had a high opinion of Trend Micro before, but that series of responses from them is shamefully bad.

OMG. Arbitrary code execution just from visiting a URL, and dump all the passwords?

I'll bookmark this for the next time someone recommends AV of any sort...

The guy must get tired saving the world so frequently. I hope Google literally pays him a dumptruck full of money.

He also found vulnerabilities in many more security products out there. At some point, years ago, Microsoft became very hostile toward him, but things seem to be better now.

> Microsoft became very hostile toward him

What happened?

Little of it was made public, but

http://www.theverge.com/2013/5/23/4358400/google-engineer-ba...

"Microsoft treat vulnerability researchers with great hostility," he says.