5 ms·

Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reput

Security researchers will disagree with you. This payout amount is considered exploitative for a bug that could cause major financial loss to clients, and reputational damage to Google. Most companies are exploiting security researchers and pay them bounties that could be compared to the discounts found on Fiverr for different services.

deleted 6y ago
[deleted]
gfxgirl 6y ago
Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?
- asdfasgasdgasdg 6y ago
  Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
  - gfxgirl 6y ago
    My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
  - toast0 6y ago
    If a video used to be public, but was turned private, there could be references to it in other places.
    - BHSPitMonkey 6y ago
      That still leaves vanishingly small odds for a user to actually be exploited, in addition to the very small resolution and total lack of audio... both of which would be overcome by somebody simply downloading the video while it was public. As soon as the video was public _and_ shared/discovered by other people, it was already owned to begin with.
  - thw0rted 6y ago
    One suggestion upthread was that videos that start public or unlisted can be made private without changing the ID. I haven't verified this myself, but if true it could be a way to get around someone sharing a video, then making it private to hide the contents. Obviously this is less severe than if, say, all private video IDs were well known, or a one-up integer, but it's still a leak and could be exploited in real-world scenarios.
- saagarjha 6y ago
  This sounds like a good way to go to jail.
dimitrios1 6y ago
Well the market disagrees with security researchers. 5000 dollars is akin to to a very healthy contractor rate of $200 an hour at 25 hours of work, which is a conservative estimate of how much time OP spent discovering this. That to me feels pretty fair pay, based on things in reality, not some future value of potential costs savings that require some pretty hand-wavy maths to quantify.
- robocat 6y ago
  Hourly rates are not appropriate. * experts are paid for applying their knowledge, not their time[1][2] * A “fair” time based system should also pay for unsuccessful searches e.g. the previous month unsuccessfully searching for a bug in Chrome. * if person A spends 1 hour finding bug X, and person B spends 1000 hours finding exactly the same bug X, then it is a fallacy that you could pick a fair hourly rate. Also I’ll mention that you don’t get paid according to how much damage a bug can cause. 1: usually the damages occur to a third party (e.g. users of Microsoft Windows, not Microsoft). 2: imagine you find ten bugs that could wipe out the business Acme - you can’t get paid 10x Acme’s value (not even just 1x Acme’s profits.) [1] https://quoteinvestigator.com/2018/01/14/time-art/ https://quoteinvestigator.com/2018/01/14/time-art/ [2] https://www.snopes.com/fact-check/know-where-man/ https://www.snopes.com/fact-check/know-where-man/
  - deleted 6y ago
    [deleted]

deleted 6y ago

[deleted]

gfxgirl 6y ago

Maybe the solution is to start leaking them (anonymously of course) and then when the damages add up say "I was going to disclose this but you don't pay". A few incidents and maybe they'll start paying?

asdfasgasdgasdg 6y ago
Considering there is no practical attack here -- you don't know the private video's ID -- it's unlikely that that would serve as much of an incentive in this case. They'd just get the bug for free. Plus, youtube has no way of verifying you had the bug before it was leaked publicly.
- gfxgirl 6y ago
  My suggestion wasn't that someone should get credit. My suggestion was only that leaking the bugs and causing actual damage would eventually raise the price paid. As for proof of date of discovery, write a letter and sign it with bitcoin or equivalent.
- toast0 6y ago
  If a video used to be public, but was turned private, there could be references to it in other places.
  - BHSPitMonkey 6y ago
    That still leaves vanishingly small odds for a user to actually be exploited, in addition to the very small resolution and total lack of audio... both of which would be overcome by somebody simply downloading the video while it was public. As soon as the video was public _and_ shared/discovered by other people, it was already owned to begin with.
- thw0rted 6y ago
  One suggestion upthread was that videos that start public or unlisted can be made private without changing the ID. I haven't verified this myself, but if true it could be a way to get around someone sharing a video, then making it private to hide the contents. Obviously this is less severe than if, say, all private video IDs were well known, or a one-up integer, but it's still a leak and could be exploited in real-world scenarios.
saagarjha 6y ago
This sounds like a good way to go to jail.

dimitrios1 6y ago

Well the market disagrees with security researchers. 5000 dollars is akin to to a very healthy contractor rate of $200 an hour at 25 hours of work, which is a conservative estimate of how much time OP spent discovering this. That to me feels pretty fair pay, based on things in reality, not some future value of potential costs savings that require some pretty hand-wavy maths to quantify.

robocat 6y ago
Hourly rates are not appropriate. * experts are paid for applying their knowledge, not their time[1][2] * A “fair” time based system should also pay for unsuccessful searches e.g. the previous month unsuccessfully searching for a bug in Chrome. * if person A spends 1 hour finding bug X, and person B spends 1000 hours finding exactly the same bug X, then it is a fallacy that you could pick a fair hourly rate. Also I’ll mention that you don’t get paid according to how much damage a bug can cause. 1: usually the damages occur to a third party (e.g. users of Microsoft Windows, not Microsoft). 2: imagine you find ten bugs that could wipe out the business Acme - you can’t get paid 10x Acme’s value (not even just 1x Acme’s profits.) [1] https://quoteinvestigator.com/2018/01/14/time-art/ https://quoteinvestigator.com/2018/01/14/time-art/ [2] https://www.snopes.com/fact-check/know-where-man/ https://www.snopes.com/fact-check/know-where-man/
- deleted 6y ago
  [deleted]