3 ms·

In that case can I borrow $100k?

by eli 10y ago

fragmede 10y ago
Y'know Y Combinator? That Startup Accelerator that runs this site? They will just let you borrow $100k (well, $120k) if they like you and your idea. See http://www.ycombinator.com/ http://www.ycombinator.com/ for more. Snark aside, assuming the contestant took the whole year to work on the exploit, the chance of a $100k payout is small compared to the risk of not actually finding the exploit, combined with the fact that they could be making twice that working at a place like Facebook or Google. Also, you'll note that the Ars' paper doesn't talk at all about the contestants to the contest who's hacks failed to succeed.
- zelon88 10y ago
  Perhaps they came across the exploit under different circumstances? Perhaps they've exploited it themselves in the real world, but the lure of the $100k prize is worth giving-up-the-goods?
  - fragmede 10y ago
    It's a fair point - bug bounties were controversial when companies started doing them, and even then, by reducing it to monetary terms, economics states they are only as effective as their payout. For example, in the so called "Cloudbleed" writeup, it was evident that Cloudflare was leaking authorization headers from Uber. If the security researcher who discovered it had far fewer morals, instead of reporting the issue to get it fix, it's possible they had the power to change the bank account/whatever that each Uber driver gets paid into, to an account under the researcher's control. For all their hard work and honesty, the security researcher (aside from the benefits of an awesome job at Google), won a grand prize of... a T-shirt from Cloudflare (hopefully it said "I broke the Internet and all I got was this Tshirt"). Maybe the pwn2own exploit did come from different circumstances. In that case, someone was able to reuse previous work and make an easy $100k. (If you're jealous of that, residuals in Hollywood are gonna make you move to LA.) Whatever portion of that $100k that came from VMWare, it's cheap for VMWare to know about this bug and to be able to close it, when their business model rests on their security claim that the guest cannot escape to the host.
    - slv77 10y ago
      >economics states they are only as effective as their payout. It's a bit more complicated than that as the value of the bug bounty only has to be greater than the lowest economic value to all of those that are aware of the bug to be effective. That incentive, even though small, dramatically reduces the size of the total number of individuals who will know about the bug before it's disclosed. Since the set of people who are willing and able to exploit the bug for gain is small keeping the number of people who know about an undisclosed bug small reduces the probability of an overlap.
- eli 10y ago
  If you want to make the most money doing security research, your best bet is going to be finding people who will pay you to do security research. You get paid even if you don't find anything! And $120k in exchange for equity is a sale not a loan or a gift.

In that case can I borrow $100k?

by eli 10y ago

In that case can I borrow $100k?

Y'know Y Combinator? That Startup Accelerator that runs this site? They will just let you borrow $100k (well, $120k) if they like you and your idea. See http://www.ycombinator.com/ http://www.ycombinator.com/ for more. Snark aside, assuming the contestant took the whole year to work on the exploit, the chance of a $100k payout is small compared to the risk of not actually finding the exploit, combined with the fact that they could be making twice that working at a place like Facebook or Google. Also, you'll note that the Ars' paper doesn't talk at all about the contestants to the contest who's hacks failed to succeed.

zelon88 10y ago
Perhaps they came across the exploit under different circumstances? Perhaps they've exploited it themselves in the real world, but the lure of the $100k prize is worth giving-up-the-goods?
- fragmede 10y ago
  It's a fair point - bug bounties were controversial when companies started doing them, and even then, by reducing it to monetary terms, economics states they are only as effective as their payout. For example, in the so called "Cloudbleed" writeup, it was evident that Cloudflare was leaking authorization headers from Uber. If the security researcher who discovered it had far fewer morals, instead of reporting the issue to get it fix, it's possible they had the power to change the bank account/whatever that each Uber driver gets paid into, to an account under the researcher's control. For all their hard work and honesty, the security researcher (aside from the benefits of an awesome job at Google), won a grand prize of... a T-shirt from Cloudflare (hopefully it said "I broke the Internet and all I got was this Tshirt"). Maybe the pwn2own exploit did come from different circumstances. In that case, someone was able to reuse previous work and make an easy $100k. (If you're jealous of that, residuals in Hollywood are gonna make you move to LA.) Whatever portion of that $100k that came from VMWare, it's cheap for VMWare to know about this bug and to be able to close it, when their business model rests on their security claim that the guest cannot escape to the host.
  - slv77 10y ago
    >economics states they are only as effective as their payout. It's a bit more complicated than that as the value of the bug bounty only has to be greater than the lowest economic value to all of those that are aware of the bug to be effective. That incentive, even though small, dramatically reduces the size of the total number of individuals who will know about the bug before it's disclosed. Since the set of people who are willing and able to exploit the bug for gain is small keeping the number of people who know about an undisclosed bug small reduces the probability of an overlap.
eli 10y ago
If you want to make the most money doing security research, your best bet is going to be finding people who will pay you to do security research. You get paid even if you don't find anything! And $120k in exchange for equity is a sale not a loan or a gift.