6 ms·

Well, this author states he got a $5000 payout, I'd consider that pretty decent.

sneak 6y ago
It's not when you consider it in context of the unpaid work one has to do to find payout bugs like this. For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours. Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.
- rewq4321 6y ago
  Security researchers can easily get $500 per hour on consult. The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.
  - hinkley 6y ago
    More importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told. As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.
- unityByFreedom 6y ago
  After winning a $5k payout I bet you can get a decent consultancy going. These payouts are foot-in-the-door or for hobbyists, like Kaggle is for ML.
  - krageon 6y ago
    "Do it for the exposure" is a nasty thing to say to people, even if you couch it in disguising terms.
    - leetcrew 6y ago
      disagree, especially when the "exposure" is not the entire compensation package.
    - sangnoir 6y ago
      > Isn't the entire pen-test/security industry based on exposure (of your "brand") though? What you can bill depends directly on how well known you are & your past work, in lieu of an objective measure of how good at it a person is. Geohot could bill thousands (or tens of thousands) per hour of his time and no one would bat an eye, but if some guy named Blake tried that, he'd be laughed out of the room.
    - unityByFreedom 6y ago
      Why? I wish it paid a salary too but it isn't worthless. At the end of the day the businesses that best allocate their dollars for internal vs. outsourced talent are going to come out on top. I certainly don't see room for adding regulatory requirements here. And, about public pressure, this type of work is in its infancy, relatively speaking. Going straight for the throat is too much.
      - krageon 6y ago
        "The free market will solve it" is sadly no longer a uniquely US-based view, but it is still wrong. There are so many examples of this I don't even know where to begin telling you how wrong it is.
        unityByFreedom 6y ago
        That's too general of a statement. Everything is governed so there is a mix of free market and regulation. Having everything state-owned isn't a solution either and I know you're not suggesting that.
  - hinkley 6y ago
    Then you are pitting nascent white hat hackers against seasoned black hats and how do you expect that’s going to turn out?
    - unityByFreedom 6y ago
      Sounds like a good argument at first but you're talking about running afoul of the law. You can't make a career of that. The better you get, the more people are after you. I don't mean that the US would chase you in Russia but you are digging yourself a hole and limiting options as you go.
dessant 6y ago
Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google. Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.
- deleted 6y ago
  [deleted]
- gfxgirl 6y ago
  Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?
  - asdfasgasdgasdg 6y ago
    Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
    - gfxgirl 6y ago
      My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
    - toast0 6y ago
      If a video used to be public, but was turned private, there could be references to it in other places.
      - BHSPitMonkey 6y ago
throwaway2245 6y ago
For this kind of specialism, I'd expect a company to pay an internal employee that much ($5000) per week of work - and contractors should be charging double. The fact that a company has undervalued this work and failed to identify it as important, and someone external has identified it, makes it worth even more. A ransom demand on YouTube might be unbounded in value, e.g.: https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db-49d1-9e8f-a25cabe7dfcf https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db...
- wscott 6y ago
  Exactly. If you have the skill set to find exploits like described here or even more complicated ones, would that payout tempt you do this fulltime? If you live in the US then I would say no. It ends up being much lower pay than you could get in other areas. For brilliant hackers in other parts of the world, then this might be a nice job. But I don't know if these bug bounties are available everywhere.
Jimmc414 6y ago
Factor in how rare it is to find a software defect like this and how many fruitless hours of work go into finding it, the author is hardly breaking even. The only financial advantage I see is bestowed by the credibility gained from the publicity. Considering the monetary damage that a defect like this can do to YT and considering the thriving black market for zero days, $5000 seems irresponsibly low.

It's not when you consider it in context of the unpaid work one has to do to find payout bugs like this. For context, this is approximately what Google has to pay for an entry level engineer employee to work for ~40 hours. Finding a bug of this severity level in a publicly accessible service with a bug bounty program every 40 hours of work is... a stretch of the imagination for an entry level person.

rewq4321 6y ago
Security researchers can easily get $500 per hour on consult. The author should "charge" based on a percentage of the value that this bug fix gives to google. I'd argue that for such a huge platform this bug is worth tens if not hundreds of thousands. Certainly would cause way more reputational damage than that of there was a large-scale data leak based on this.
- hinkley 6y ago
  More importantly, the value of zero day exploits on the black market can run into the hundreds of thousands, we are told. As the music industry learned the hard way, if you make it too hard to be a good guy, everyone will become a bad guy.
unityByFreedom 6y ago
After winning a $5k payout I bet you can get a decent consultancy going. These payouts are foot-in-the-door or for hobbyists, like Kaggle is for ML.
- krageon 6y ago
  "Do it for the exposure" is a nasty thing to say to people, even if you couch it in disguising terms.
  - leetcrew 6y ago
    disagree, especially when the "exposure" is not the entire compensation package.
  - sangnoir 6y ago
    > Isn't the entire pen-test/security industry based on exposure (of your "brand") though? What you can bill depends directly on how well known you are & your past work, in lieu of an objective measure of how good at it a person is. Geohot could bill thousands (or tens of thousands) per hour of his time and no one would bat an eye, but if some guy named Blake tried that, he'd be laughed out of the room.
  - unityByFreedom 6y ago
    Why? I wish it paid a salary too but it isn't worthless. At the end of the day the businesses that best allocate their dollars for internal vs. outsourced talent are going to come out on top. I certainly don't see room for adding regulatory requirements here. And, about public pressure, this type of work is in its infancy, relatively speaking. Going straight for the throat is too much.
    - krageon 6y ago
      "The free market will solve it" is sadly no longer a uniquely US-based view, but it is still wrong. There are so many examples of this I don't even know where to begin telling you how wrong it is.
      - unityByFreedom 6y ago
        That's too general of a statement. Everything is governed so there is a mix of free market and regulation. Having everything state-owned isn't a solution either and I know you're not suggesting that.
- hinkley 6y ago
  Then you are pitting nascent white hat hackers against seasoned black hats and how do you expect that’s going to turn out?
  - unityByFreedom 6y ago
    Sounds like a good argument at first but you're talking about running afoul of the law. You can't make a career of that. The better you get, the more people are after you. I don't mean that the US would chase you in Russia but you are digging yourself a hole and limiting options as you go.

dessant 6y ago

Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google. Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.

deleted 6y ago
[deleted]
gfxgirl 6y ago
Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?
- asdfasgasdgasdg 6y ago
  Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
  - gfxgirl 6y ago
    My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
  - toast0 6y ago
    If a video used to be public, but was turned private, there could be references to it in other places.
    - BHSPitMonkey 6y ago

throwaway2245 6y ago

For this kind of specialism, I'd expect a company to pay an internal employee that much ($5000) per week of work - and contractors should be charging double. The fact that a company has undervalued this work and failed to identify it as important, and someone external has identified it, makes it worth even more. A ransom demand on YouTube might be unbounded in value, e.g.: https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db-49d1-9e8f-a25cabe7dfcf https://www.lexology.com/library/detail.aspx?g=e4d1be15-18db...

wscott 6y ago
Exactly. If you have the skill set to find exploits like described here or even more complicated ones, would that payout tempt you do this fulltime? If you live in the US then I would say no. It ends up being much lower pay than you could get in other areas. For brilliant hackers in other parts of the world, then this might be a nice job. But I don't know if these bug bounties are available everywhere.

Jimmc414 6y ago

Factor in how rare it is to find a software defect like this and how many fruitless hours of work go into finding it, the author is hardly breaking even. The only financial advantage I see is bestowed by the credibility gained from the publicity. Considering the monetary damage that a defect like this can do to YT and considering the thriving black market for zero days, $5000 seems irresponsibly low.