4 ms·

I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and i

by yeukhon 11y ago

I always think people should get a full time position rather than earning money through bounty as a full time job. When I have time, I do play with bounty and if I am lucky I can make extra dollars. I earned one big one, but in the second one the company did not honor the payment at all, but I was cool enough to let that shit go despite what I found was critical enough to destroy their product launch that night (basically elementary web vulnerability). Your statements are going to be attacked by the usual "you don't know shit, we have argued about this ten million times here on HN." Companies are not going to reward you with $1M (think about Instagram's 1M bug [0]). While you can't really sell this to the blackmarket and expect to overload people's credit card, this is still a P1 incident and requires a major bounty reward. I am not going to discuss about what happened in this case, but even if he did get paid he wouldn't be getting 1M. The reason is simple: there are a lot more people willing to play this game and many believe being on some Hall of Frame is a great addition to their security professional resume. [0]: https://news.ycombinator.com/item?id=10754194 https://news.ycombinator.com/item?id=10754194

meritt 11y ago
Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free. And most of us do it purely for the challenge and fun, so the reward (if any) is oftentimes irrelevant. It's just there's such a large market for this sort of information (and I'm not talking about stolen credit cards, spam, fraud. Competitive intelligence is a huge industry) and there are many full-time security engineers whose only job is to find the holes some company is trying to outsource to bored programmers.
- yeukhon 11y ago
  I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.

by yeukhon 11y ago

meritt 11y ago

Yeah, I get the economics of it, which unfortunately can be a good deal for the company. They get numerous people working on a hard problem for basically free. And most of us do it purely for the challenge and fun, so the reward (if any) is oftentimes irrelevant. It's just there's such a large market for this sort of information (and I'm not talking about stolen credit cards, spam, fraud. Competitive intelligence is a huge industry) and there are many full-time security engineers whose only job is to find the holes some company is trying to outsource to bored programmers.

yeukhon 11y ago
I have extremely limited professional experience being in the security engineering industry, but my impression of a typical security engineer within a tech company: * advocate and standardize security practice in software development and throughout the company (if you don't have a separate IT/enterprise security team) * write automation to enhance your security enforcement/checks prior to production deployment (check if server is running outdated kernel? nodejs version? password committed? basic web vulnerability checks? Security headers like HSTS present?) * act as a consultant in product development (e.g. we handle this data and here is how we plan to use it, do you have any concerns and recommendations)? * code review (besides regular product code review, most of the time there are ad-hoc request from engineers - "hey we need your expertise on writing this feature"), or because the code looks hot ("have been exploited before") and needs a sign off from a security engineer. It is very rare to see someone in a major tech company spend the entire day reviewing code to find vulnerable bugs. You'd spend the whole day running through ASan, UBsan, bunch of fuzzers, whatever, wait for potential exploits to pop up, then you start analyzing the vulnerability, At least that's my understanding, but feel free to shine light.