5 ms·

How much should they have been paid? This seems like a week of pay for a pretty good software dev. That's not fair comp?

• penagwin 7y ago
  > This seems like a week of pay for a pretty good software dev. Wait, 6500 * 4 * 12 = 312,000/yr Might be a bit high for a week :P EDIT: Okay turns out that if you live in the Bay area this isn't unheard of - the rest of us make 4x to 5x less then that (Saying this as a mid-level software dev from West Michigan).
  • randlet 7y ago
    Salary information on HN is skewed by Bay area engineers where $312k is not out of the realm of possibility for a senior developer afaik.
  • moneromoney 7y ago
    In Germany you will be VERY lucky making 100,000 euro / year. Germany has the lowest software dev. salary / average country salary ratio of all countries on planet.
    • foepys 7y ago
      Unless you are doing anything more or less related to SAP. Then you can make $150k/a easily. If only other companies would realize that that's one of the reasons why SAP is Germany's no. 1 software company.
  • sciurus 7y ago
    That matches up with the mid to senior range you'll see for FAANG at https://www.levels.fyi/ https://www.levels.fyi/
  • bluedino 7y ago
    60-75k is on the low side for a qualified dev, even in Michigan.
• tptacek 7y ago
  It is, as the bounty reporter says themselves, eminently fair. People on this site have very weird ideas of what the going rates for bounties are.
  • sarakayakomzin 7y ago
    The bounty hunter isn't a source of truth for the value of the bug. If you don't think you could sell an exploit to takeover any slack account for more than $6500 then you aren't familiar with what the market values in the first place.
• vlovich123 7y ago
  The value is not about the time spent finding the bug. It's about the severity of the issue, the scale, & the competitive cost of me selling it on the black market. If Apple left open a 0-day rootkit exploit that took me somehow 1 day to find it's still worth hundreds of thousands of dollars.
  • vasco 7y ago
    Well yeah if your comparison is that the person's morals allow them to just turn around and sell it in the black market, maybe they could've paid more. But the reality of HackerOne is that most people are really just doing it as a hobby or side project that happens to generate cash. Some people build 10 different static website generators, others do bug bounties. It doesn't mean they'd go on to sell these exploits and risk going to jail.
    • QuinnWilton 7y ago
      It's not the people using HackerOne to be concerned about. It's the ones who don't use HackerOne because they realize they'd get more money on the black market. When it comes to vulnerabilities with a large enough impact it isn't enough to learn about most of them, because all it takes is one financially motivated actor to weaponize things.
    • tptacek 7y ago
      There is almost certainly no liquid black market for this bug, even though Slack is very important to lots of businesses. It had no half-life at all (the fix was one-and-done) and doesn't fit into any existing business/operational model (nobody has an infrastructure where different targeted Slack bugs are pin-compatible drop-ins).
  • floatrock 7y ago
    This thread is interesting because it shows different ways people value their work. This is reasonable if you look at it as "just another job" -- you're being paid to build Good Software, so just another day at work. Or you're doing a Good Thing by helping a lot of people not get pwned. This is unreasonable if you look at is as value-creation: "how much is this worth on the black market" or "what is this worth to Slack as a company". Other people can get into the socioeconomic or means-of-production or entrepreneuring implications of all this, but I just think whether you downvoted or upvoted this provides a useful mirror into how one values one's own professional work.
• lonelappde 7y ago
  If he worked a week and didn't find a vuln, he'd get 0. Average that in. Bug bounties are the uberification of security research.