Re:Google launches new vulnerability reward platform
by Trias11 on Tuesday July 27, 2021 @11:53AM
(#27973888)
1.
Press [Submit]
2. Thank you for your submission, that was already known issue.
Re:Google launches new vulnerability reward platform
by biryani_chicken on Tuesday July 27, 2021 @12:52PM
(#27974632)
Will project maintainers avoid writing issue tickets before sending the patch to this platform?
Re:Google launches new vulnerability reward platform
by heavyset_go on Tuesday July 27, 2021 @06:59PM
(#27978640)
> https://bughunters.google.com/about/patch-rewards
> (Googler here, but I don't work on the VRP.)
The URL that you posted doesn't render correctly on Firefox 90 for Linux.
Re:Google launches new vulnerability reward platform
by HenryKissinger on Tuesday July 27, 2021 @12:14PM
(#27974171)
They need to mltiply these amounts by 50x. Cybersec researchers make 6-7 figures. 20k is almost nothing.
Re:Google launches new vulnerability reward platform
by H8crilA on Tuesday July 27, 2021 @12:40PM
(#27974481)
Not sure why you're downvoted, but the $3M/year total rewards payoff is likely smaller than the corporate administrative and developer time (for review) costs. I.e. if this was a charity it would pay out less than 50 cents on the dollar.
Re:Google launches new vulnerability reward platform
by tptacek on Tuesday July 27, 2021 @02:31PM
(#27975822)
I downvoted because "cybersec researchers" do not in fact routinely make 7 figures. For strong pentester types reporting the typical (real) vulnerability the VRP handles, the median is probably in the low 6's.
Re:Google launches new vulnerability reward platform
by na85 on Tuesday July 27, 2021 @05:43PM
(#27978030)
6 figures from breaking systems and reporting them responsibly?
Sounds amazing, what's the catch?
Re:Google launches new vulnerability reward platform
by tptacek on Tuesday July 27, 2021 @06:16PM
(#27978355)
There's no catch. You want a job as a pentester. That job is in high demand.
Re:Google launches new vulnerability reward platform
by kasey_junk on Tuesday July 27, 2021 @07:53PM
(#27978967)
Frankly low 6 figures sounds low for a software job. How do you attract talent at that level?
Re:Google launches new vulnerability reward platform
by tptacek on Tuesday July 27, 2021 @07:55PM
(#27978984)
The median bounty hunter isn't an SFBA software developer.
Re:Google launches new vulnerability reward platform
by kasey_junk on Tuesday July 27, 2021 @08:30PM
(#27979179)
Is it international arbitrage? Or something else cause low 6 figures is now the going rate all over the states.
*not trying to be argumentative just trying to price the market.
Re:Google launches new vulnerability reward platform
by tptacek on Tuesday July 27, 2021 @08:34PM
(#27979203)
It's a combination of the lower value of the median bug bounty submission (we hear about the high-ticket vulnerabilities, but most of them are pretty low-test) and the fact that huge numbers of bounty participants are abroad. I know there are people who claim to make high-6's and even low-7's from bounties, but they're very rare. I think most people who participate in bounties would be best off financially by using them to build a portfolio they can exploit to pivot into consulting or full-time work of some other sort.
Payouts for security-positive improvements to security-critical OSS projects:
* $20,000 for setting up continuous fuzzing with OSS-Fuzz
* $10,000 for high-impact improvements that prevent major classes of vulnerabilities
but the low end of the scale is kind of neat too:
* "$1,337 for submissions of modest complexity, or for ones that offer fairly speculative gains."
* "$500 our "one-liner special" for smaller improvements that still have a merit from the security standpoint."
... and you can qualify for these even if your day job is working on one of these OSS projects!
> Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify?
> A: They most certainly do.
Neat stuff.
(Googler here, but I don't work on the VRP.)