Depends on what you call "a living".

You probably won't get rich from doing $500 bug bounties.

But there are hackathons with bounties in the $1000-$10000 range.

Do 2-4 of those per month and you're good.

You're not good if they are very close to the bottom of your range.

Unless you live in a hut in Thailand or something.

2 or 4 1k a month puts you either above or way above average salary here in Italy.

You have to compare it to being a self employed business owner instead of to a salary from a job. Half of it is going to go to taxes.

Self employed since 2011. In Italy. I know how this world works. If you get 2 to 4K a month you can easily live an absolutely normal life or even above average.

I suppose it depends on how you are defining normal. Does that mean owning a home and vehicle and supporting a wife and kids, or does that mean sharing an apartment with multiple people and using public transport and not having any savings? I get that the cost of living is lower in Italy, but different people have different ideas about what constitutes comfortable. Just from googling, the 2k seems like it'd be a bit of a struggle but the 4k seems like it'd be pretty nice.

2k/mo pre taxes as a self employed would allow you to live a normal life meaning you’d not struggle to get through the month. 4k/mo would allow you to easily buy a house and live an above average life. This is obviously true for most of the country and it’s different if you want to live in one of the big cities but that goes without saying.

If you happen to be supporting a four-member family on that 2K, it's barely above the poverty line.

Even when you're young and single, it behooves you to think about retirement; it's sooner than you think.

You need a safety net in case something happens, leaving you unable to work for a long time.

If you support a family, you have to think about things like education funds for the kids, and what happens if you suddenly die.

Agree on the family but if 2 people are working (which is normal) with two 2k salaries you’re doing just fine.

Retirement is provided by the state here so it’s not something I have to plan for.

Again, just to reiterate, the original post was using 2k/mo as the absolute minimum and the point I was trying to make is that a few Ks a month is a reasonable living in way more places that people realize.

But I suspect a non negligible % of people here on HN have a distorted view of the world and how much living cost.

In Austria, 2k/mo before taxes is roughly what you earn as a part-time employee filling shelves at the supermarket [1].

[1]: Typical supermarket job in Austria: https://jobs.aldi-hofer.com/hofer-karriere-at/job/Linz-BACKB... The advertised salary for 21 hours/week of 1330€ is paid 14 times per year and comes to a total income of ~15.7k€ after taxes. If you make 24k€ a year as a self-employed person, you will have to pay ~400€ taxes + 6.5k€ pension + health insurance leaving a total of ~17k€ after taxes.

$4000/mo pre-tax is an above average salary for the UK. You'd live just fine in most places in the UK (london aside).

Can't really compare a salary to bounties. With a salary, you can rely on the income.

If you have irregular income, you need to plan for a lot more since you'll always have slow months with no income, or customers that don't pay or pay much later than you expected, and you have a lot of costs that employees don't (eg. you need to pay for your own hardware, office space, accountant, tax advisor, health care, pensions, unemployment insurance, etc).

Are you including two kids and a retirement plan in the picture?

That sounds somewhat feasible, but are there enough of those hackathons around? Can you take part in 20-50 hackathons a year? Most hackathons also require some kind of preparation, I doubt you can just show up, work for 15 hours, and collect $1000?

I'd really love to hear from someone who is making a living from bounties or hackathons, because it just seems very hard or impossible to me.

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

This sounds like they are a known figure in the project and are offered consultancy jobs. When I had a company that is what I did when I needed something fixed. It was not cheap either. The point being yes it is possible but it is not a bounty board like in the city town hall.

Anyway I find it a bit weird the topic is asked at all. Why didn’t the OP just cold contacted committers?

Can you elaborate? Who are these people? What kind of bounties do these people go after? Do they work on lots of small bounties or focus on a few big bounties? Do you personally know these people or are you just talking about the security researchers who discovered high impact issues in iOS?

I know some of them in person as I'm involved in the bug bounty scene myself. What they work on varies depending on skill set and interest. I do not personally know any security researchers with high impact vulnerabilites in iOS but those people get paid millions and you'll never hear about them.

What I do know is that they tend to sell their exploits through exploit brokers like Zerodium.

How is it possible to make that much though? Is it like a private bounty board or something?

Big money like that is only made one way, security vulns in "software or hardware of interest", sold via brokers to 3 letter agencies (or much less scrupulous actors from time to time).

Are you talking about fixing known bugs, or a "security bug bounty" where they are paid to report unknown security issues?

Security related vulnerabilities.

That’s very different than what the OP question is about. Both are called “bounties” though.

One is getting paid to write code that fixes bugs or adds functionality to open source projects. (Pays very little and we suspect nobody makes a living from)

The other is doing security research and reporting on vulnerabilities. Here typically no fix is provided. You are paid for the discovery. Plenty of good researchers make a living on these security bounties

I helped out running a bug bounty program for a company whose large offering was a FOSS product a couple of years ago. Most of the people participating were either in very LCOL countries like Thailand or Montenegro, or were bored C level/founder people who would use the tiny amount of money as an incentive to keep their coding skills sharp since their day to day no longer involved coding.

I spent a decade or so living life off of bug bounties. Smart Contracts are the only way to go these days.