Google Bug Bounty – The $5k Error Page

Re:Google Bug Bounty – The $5k Error Page by ensiferum on Thursday May 18, 2017 @04:23PM (#14370780)

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by nodesocket on Thursday May 18, 2017 @04:34PM (#14370856)

Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by to3m on Thursday May 18, 2017 @05:06PM (#14371090)

Most of their consumer-facing services are not, shall we say, famous for being high-touch...

But presumably different people look after the security side of things.

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by kristianp on Thursday May 18, 2017 @06:06PM (#14371502)

This story from yesterday has raised some resentment about google's support:

A startup’s Firebase bill suddenly increased from $25 to $1750 per month https://news.ycombinator.com/item?id=14356409

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by joatmon-snoo on Thursday May 18, 2017 @07:16PM (#14371837)

Their customer/enterprise support is notoriously sketchy, at least from the outside (a la HN) looking in.

That's not the same at all as their bug bounty program, which is generally one of the best out there.

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by sushid on Thursday May 18, 2017 @04:26PM (#14370799)

Google's known for their fast triage/response time. They're also fairly generous with their bounties.

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by carvalho on Thursday May 18, 2017 @06:13PM (#14371534)

Depending on the severity of your finding, your report could wake up a senior security engineer.

When your report is out of scope, Google will not ignore your report. When there is a non-serious bug, you get acknowleged in the bug report they file internally. Finally, when they can not replicate your finding, they will communicate that with you and stay patient until they can either replicate or close your report.

Edit: forgot to add that they raised the bounty with another 2k ("we updated our payouts") and they invited me to their Blackhat booth 1 year later.

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by i336_ on Thursday May 18, 2017 @08:12PM (#14372095)

Interesting. What'd you find? :)

[ Parent | on HN ]

Re:Google Bug Bounty – The $5k Error Page by carvalho on Thursday May 18, 2017 @08:43PM (#14372251)

Apparently I was part of a test where input sanitization was turned off. Reported and fixed before they could push it live.

Very "monkey on a typewriter". I was not even looking for security bugs, but studying usage of maia.css.

http://aster.or.jp/conference/icst2017/program/jmicco-keynot...

[ Parent | on HN ]