2 ms·

It's honestly extremely difficult to get by in the first world as a white hat security researcher. Bug bounties payouts look big, but unless you're hitting a 10

by Kalium 8y ago

It's honestly extremely difficult to get by in the first world as a white hat security researcher. Bug bounties payouts look big, but unless you're hitting a 10K bug a month you're better off with a Rails gig. And that will be very hit-or-miss, because who the hell knows if $COMPANY will play ball this time or not? Or if you're the first person to find the bug you spent weeks searching for? Exploit development security research is something that there's a surprisingly small market for... unless you're selling vulns. And buyers are usually either government intelligence services or organized crime (skipping right past "what's the difference hyuk hyuk hyuk").

icebraining 8y ago
Isn't the way to make money to find contracts from companies that want you to look into their security? Doing the work first and selling it later is always inherently risky, be it writing a novel or bug hunting.
- Kalium 8y ago
  You're right! Penetration testing is one way to make money! It sometimes can be perhaps slightly less lucrative than you might expect, with your average pen tester paid significantly less than your average SWE. And often somewhat different than the kind of specialty skills someone focused on (say) Windows Internals might have. Compare with selling exploits, where a month's worth of highly enjoyable work might turn into mid-five-figures. Or higher. You're absolutely right. Penetration testing and code auditing are ways to make money. It's possible that there may be some relevant differences in both subject and compensation is all.
- EthanHeilman 8y ago
  Finding exploits and performing a security audit are often very different tasks. A person that can do one is not always able to do the other. Companies, such as companies that sell surveillance software to governments, do hire people to just find exploits, but judging by leaked emails that can be a stressful job as you are expected to regularly deliver new exploits.

by Kalium 8y ago

icebraining 8y ago

Isn't the way to make money to find contracts from companies that want you to look into their security? Doing the work first and selling it later is always inherently risky, be it writing a novel or bug hunting.

Kalium 8y ago
You're right! Penetration testing is one way to make money! It sometimes can be perhaps slightly less lucrative than you might expect, with your average pen tester paid significantly less than your average SWE. And often somewhat different than the kind of specialty skills someone focused on (say) Windows Internals might have. Compare with selling exploits, where a month's worth of highly enjoyable work might turn into mid-five-figures. Or higher. You're absolutely right. Penetration testing and code auditing are ways to make money. It's possible that there may be some relevant differences in both subject and compensation is all.
EthanHeilman 8y ago
Finding exploits and performing a security audit are often very different tasks. A person that can do one is not always able to do the other. Companies, such as companies that sell surveillance software to governments, do hire people to just find exploits, but judging by leaked emails that can be a stressful job as you are expected to regularly deliver new exploits.