$100M in bounties paid via HackerOne to ethical hackers

Re:$100M in bounties paid via HackerOne to ethical hackers by chc4 on Wednesday May 27, 2020 @05:39PM (#23330380)

$100M is 1000 people getting paid $100k. $100k isn't a particularly good programmer salary, and is a very high bug bounty salary. From what I've heard, HackerOne/BugCrowd high earners basically just end up spamming as many companies as they can with web vulnerabilities like clickjacking that are low impact but everyone has, and live in very low cost-of-living areas like South America. It's a lot of repetitive hustle and not secure.

Infosec twitter people aren't the ones doing bug bounties. A lot of them are blue team cybersecurity, doing network engineering and IT, or do penetration testing for networks which is a different wheelhouse. Some of them might be reporting exploits to Zerodium/ZDI/other exploit brokers, but they keep a low profile and it is very different from "bug bounties".

[ Parent | on HN ]

Re:$100M in bounties paid via HackerOne to ethical hackers by Dayshine on Thursday May 28, 2020 @03:44AM (#23334581)

> $100k isn't a particularly good programmer salary

It's 95th percentile for a lead developer in the UK... and probably everywhere outside some areas in the US.

[ Parent | on HN ]

Re:$100M in bounties paid via HackerOne to ethical hackers by Kalium on Thursday May 28, 2020 @02:16PM (#23340493)

It's been my experience that a good chunk of the researchers on HackerOne are exactly what this point would lead you predict. I recall working with some in Morocco, Pakistan, and Romania.

This was admittedly a few years ago. No idea if that's still accurate.

[ Parent | on HN ]