14 ms·

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I w

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve. If I were your tech agent I'd demand Facebook pay out $75,000 minimum for this specific problem.

sltEvas 6y ago
2%? You have an interesting idea of the world's population. Just think about what that means. It means 2 out of 100 people can hack into Facebook's Legal Department Admin Panel. I mean if we are talking "mentally capable to achieve that within a decade if the person does nothing else but strive to that goal"... Perhaps. If we are talking "sit down right now and do it", then it's more like what... 10,000-100,000 people on earth? Which makes for more like 0.0014%?
- jiofih 6y ago
  So logically you deserve to be paid 0.0014% of Facebook’s yearly revenue, which is around $1,176,000.00! /s
- throwitaway1235 6y ago
  Was a wild guess. I'm not a software engineer. More like a Stewart Cheifet lol. But thank you, very interesting.
- neffy 6y ago
  Not quite. The US alone graduates 2 million Computer Science students of various stripes every year. It's been graduating (smaller numbers) of them for over 40-50 years now. There are now second and third generation comp sci. workers and graduates. So let's say 1% of 1 million/year are up to this, I suspect it's rather more, but I can't be bothered to do the curve on past graduation rates, and figure out what the world wide figure is... you've easily got a couple of million people world wide. When I think it's going to get really interesting is in another 10 years or so when there start to be significant numbers of bored retired former developers. At any rate the market rate probably isn't that bad.
  - hobofan 6y ago
    I think you might have looked at the wrong statistic when googling this. According to this site[0] (which is one of the first hits for "computer science graduates per year"), there are 2 million computer science people in the workforce _in total_, which seems far more realistic. Actual number of graduates per year seems to be 65000. With your numbers (assuming linear growth) after those 40 years, about one third of the total US workforce would now be CS graduates. [0]: https://datausa.io/profile/cip/computer-science-110701 https://datausa.io/profile/cip/computer-science-110701
  - deleted 6y ago
    [deleted]
- czbond 6y ago
  Woo hoo! I'm in the top 100k in the world for something ;)
scarlac 6y ago
> I'd demand Facebook pay out $75,000 minimum Wouldn't demanding money be blackmailing? A story from one of my startups: A student reached out to us regarding a security vulnerability on the website, demanding money for it. He refused to say what it was or provide evidence at first, so we couldn't assess it. He said he'd disclose it to others if we didn't. I definitely felt blackmailed. I am not a lawyer but it felt illegal. Maybe someone can chime in to say if it is?
- ericjang 6y ago
  Rather than the exploiter setting an arbitrary price (which would be closer to blackmail), I think parent comment was saying that the fair market value of disclosing such a bug was worth closer to $75k given the unique skill set required. Skilled engineers turn to cybercrime when white-hat bounties are insufficiently rewarding, so it is in everyone's interest to pay competitive rates for finding security vulnerabilities.
  - singingfish 6y ago
    Which is essentially market driven blackmail as far as I can see. Once I meet my new neighbours (one of whom is a moral philosopher by trade) I might ask about how to assess if that's ok. Personally it feels somewhat ok to me, speaking as someone who's built industrial espionage for money.
    - phkahler 6y ago
      >> Which is essentially market driven blackmail as far as I can see. Modern medicine can also be like blackmail. Nobody has to actually threaten you, but nature will kill you unless you pay whatever the price of treatment. That's why we need competition, and why pharma companies like monopolies.
      - singingfish 6y ago
        Here in Australia the state funds most medical care. In this case the blackmail vector, if we use that interpretation is the taxation system.
rosywoozlechan 6y ago
That's extortion and it's illegal.
tigertigertiger 6y ago
Lol at 2%. Not even 2% of devs in silicon valley could do that.
- czbond 6y ago
  2% of worldwide devs....
  - 0xy 6y ago
    In my experience not even 2% of developers have a moderate knowledge of security practices.
tptacek 6y ago
You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can tell them "I found a vulnerability in sOmEtHiNg! But I'm not telling you what it is!" but Facebook is beset constantly by bogus bounty claims and they will blow you off. You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything. Part of being a good "agent" is understanding the market you're working in. † Especially because to even try to put a valuation on the bug --- which, again, ~nobody wants to buy --- you'd have to actively exploit it to see what's on the target system, which is straightforwardly a felony.
- gargarplex 6y ago
  I macro agree with your point about leverage although I'd like a bit more insight here... "You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything." Wouldn't that cost Facebook much more than $7,000?
  - tptacek 6y ago
    I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time. The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; their desire to attract bounty hunters is priced in to the bounties they pay. It's for this reason that people who want to make serious money and who start in bounty hunting break basically two ways: * Either they get really good at mopping up lots of 4-figure bounties (hitting the occasional blackjack on something that pays into low-mid 5 figures), often with a fair bit of automation, or * They graduate into consulting, where the weekly rate for this kind of work is substantially higher, you're given a briefing by the target about where to look, and where you get paid whether or not you find a marquee bug. (A good person to ask about this stuff is 'daeken).
doopy1 6y ago
I mean if you're demanding you're kind of committing a crime. It's actually pretty nice of FB to reward this stuff, and along with the clout come career opportunities worth much more than $7.5k.
tubbyjr 6y ago
They're brilliant at finding this stuff, sure, but incompetent when it comes to business acumen and valuing their work. Usually. Those that have some semblance of the latter, have received in the six figures from singular bounties. I haven't yet read this, and to be fair, most bug reports identify low severity issues which obviously don't deserve a six figure payout.
justinko 6y ago
And the idea of a “hacker agent” was born.
jamesmishra 6y ago
There isn't a super lucrative market for this type of thing that doesn't involve either the buyer or seller violating US law. The real money is probably something more boring than setting up exploits--such as setting up a security consulting practice that charges a ton of money. It's a lot easier because then you would have less pressure to discover completely novel exploits.
thrownaway561 6y ago
you will be sent to prison for extortion.
rolph 6y ago
or even more such as dividends

sltEvas 6y ago

2%? You have an interesting idea of the world's population. Just think about what that means. It means 2 out of 100 people can hack into Facebook's Legal Department Admin Panel. I mean if we are talking "mentally capable to achieve that within a decade if the person does nothing else but strive to that goal"... Perhaps. If we are talking "sit down right now and do it", then it's more like what... 10,000-100,000 people on earth? Which makes for more like 0.0014%?

jiofih 6y ago
So logically you deserve to be paid 0.0014% of Facebook’s yearly revenue, which is around $1,176,000.00! /s
throwitaway1235 6y ago
Was a wild guess. I'm not a software engineer. More like a Stewart Cheifet lol. But thank you, very interesting.
neffy 6y ago
Not quite. The US alone graduates 2 million Computer Science students of various stripes every year. It's been graduating (smaller numbers) of them for over 40-50 years now. There are now second and third generation comp sci. workers and graduates. So let's say 1% of 1 million/year are up to this, I suspect it's rather more, but I can't be bothered to do the curve on past graduation rates, and figure out what the world wide figure is... you've easily got a couple of million people world wide. When I think it's going to get really interesting is in another 10 years or so when there start to be significant numbers of bored retired former developers. At any rate the market rate probably isn't that bad.
- hobofan 6y ago
  I think you might have looked at the wrong statistic when googling this. According to this site[0] (which is one of the first hits for "computer science graduates per year"), there are 2 million computer science people in the workforce _in total_, which seems far more realistic. Actual number of graduates per year seems to be 65000. With your numbers (assuming linear growth) after those 40 years, about one third of the total US workforce would now be CS graduates. [0]: https://datausa.io/profile/cip/computer-science-110701 https://datausa.io/profile/cip/computer-science-110701
- deleted 6y ago
  [deleted]
czbond 6y ago
Woo hoo! I'm in the top 100k in the world for something ;)

scarlac 6y ago

> I'd demand Facebook pay out $75,000 minimum Wouldn't demanding money be blackmailing? A story from one of my startups: A student reached out to us regarding a security vulnerability on the website, demanding money for it. He refused to say what it was or provide evidence at first, so we couldn't assess it. He said he'd disclose it to others if we didn't. I definitely felt blackmailed. I am not a lawyer but it felt illegal. Maybe someone can chime in to say if it is?

ericjang 6y ago
Rather than the exploiter setting an arbitrary price (which would be closer to blackmail), I think parent comment was saying that the fair market value of disclosing such a bug was worth closer to $75k given the unique skill set required. Skilled engineers turn to cybercrime when white-hat bounties are insufficiently rewarding, so it is in everyone's interest to pay competitive rates for finding security vulnerabilities.
- singingfish 6y ago
  Which is essentially market driven blackmail as far as I can see. Once I meet my new neighbours (one of whom is a moral philosopher by trade) I might ask about how to assess if that's ok. Personally it feels somewhat ok to me, speaking as someone who's built industrial espionage for money.
  - phkahler 6y ago
    >> Which is essentially market driven blackmail as far as I can see. Modern medicine can also be like blackmail. Nobody has to actually threaten you, but nature will kill you unless you pay whatever the price of treatment. That's why we need competition, and why pharma companies like monopolies.
    - singingfish 6y ago
      Here in Australia the state funds most medical care. In this case the blackmail vector, if we use that interpretation is the taxation system.

rosywoozlechan 6y ago

That's extortion and it's illegal.

tigertigertiger 6y ago

Lol at 2%. Not even 2% of devs in silicon valley could do that.

czbond 6y ago
2% of worldwide devs....
- 0xy 6y ago
  In my experience not even 2% of developers have a moderate knowledge of security practices.

tptacek 6y ago

You can demand whatever you want. You have no leverage. You can't sell the bug to anyone else (there's no semi-anonymous liquid market for random serverside bugs in line-of-business software, so you're going to end up culpable for whatever the rando who buys it --- for much less than $7000 --- does with it†). You can disclose to Twitter, but you can do that anyways; all you're doing is foregoing the bounty. You can tell them "I found a vulnerability in sOmEtHiNg! But I'm not telling you what it is!" but Facebook is beset constantly by bogus bounty claims and they will blow you off. You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything. Part of being a good "agent" is understanding the market you're working in. † Especially because to even try to put a valuation on the bug --- which, again, ~nobody wants to buy --- you'd have to actively exploit it to see what's on the target system, which is straightforwardly a felony.

gargarplex 6y ago
I macro agree with your point about leverage although I'd like a bit more insight here... "You can give them a hint as to what it is, to vouch for the legitimacy of your finding, but Facebook has one of the better-resourced security teams in the industry, and they're just going to find it themselves and shut it down without paying you anything." Wouldn't that cost Facebook much more than $7,000?
- tptacek 6y ago
  I don't think so. Those people get paid whether or not you focus their attention on a perimeter-exposed RCE bug. By tipping them off, all you've done is make them more effective for a time. The bug is there whether a bounty hunter finds it or not. The other "leverage" you have, if you don't like $7K bounties for auth bypass on random backend thingies, is just not do hunt for bounties at all. Facebook knows that; their desire to attract bounty hunters is priced in to the bounties they pay. It's for this reason that people who want to make serious money and who start in bounty hunting break basically two ways: * Either they get really good at mopping up lots of 4-figure bounties (hitting the occasional blackjack on something that pays into low-mid 5 figures), often with a fair bit of automation, or * They graduate into consulting, where the weekly rate for this kind of work is substantially higher, you're given a briefing by the target about where to look, and where you get paid whether or not you find a marquee bug. (A good person to ask about this stuff is 'daeken).

doopy1 6y ago

I mean if you're demanding you're kind of committing a crime. It's actually pretty nice of FB to reward this stuff, and along with the clout come career opportunities worth much more than $7.5k.

tubbyjr 6y ago

They're brilliant at finding this stuff, sure, but incompetent when it comes to business acumen and valuing their work. Usually. Those that have some semblance of the latter, have received in the six figures from singular bounties. I haven't yet read this, and to be fair, most bug reports identify low severity issues which obviously don't deserve a six figure payout.

justinko 6y ago

And the idea of a “hacker agent” was born.

jamesmishra 6y ago

There isn't a super lucrative market for this type of thing that doesn't involve either the buyer or seller violating US law. The real money is probably something more boring than setting up exploits--such as setting up a security consulting practice that charges a ton of money. It's a lot easier because then you would have less pressure to discover completely novel exploits.

thrownaway561 6y ago

you will be sent to prison for extortion.

rolph 6y ago

or even more such as dividends