9 ms·

Well, colour me impressed. The dude's in high school and finds stuff like this? Hopefully it won't get to his head, we've got enough "rock star" devs :)

Thorncorona 6y ago
Was the second part of your comment really necessary?
- heywherelogingo 6y ago
  You seem very sensitive.
jcims 6y ago
I worked at a very large bug bounty program for a short spell a few years back. I’ve been in the infosec world since the 90’s, and the number of ridiculously talented teenagers around the world that were sending in very good reports on sophisticated attacks was pretty mind boggling. Yes there was a lot of garbage too, but that was to be expected. I came away thinking that i hope these kids remain engaged and invested in society lol.
- gogopuppygogo 6y ago
  I knew some teenagers in the warez scene in the 90’s and early aughts. Insanely talented folks. One even runs a bank now...
  - warlog 6y ago
    So, a life of crime?...
    - eru 6y ago
      It's only a crime if you get caught and convicted in a court of law. Innocent until and unless proven guilty.
      - distances 6y ago
        I think that was just a joke towards their career in banking.
        eru 6y ago
        I was trying to extend the joke---what banks do might be shady by some standards, but they have good enough lawyers and accountants that it's seldom outright illegal enough to get individual bankers criminally liable.
judofyr 6y ago
> The dude's in high school and finds stuff like this? As someone who once got a $500 bug bounty from Facebook in high school, I'll have to say that this is not so surprising. Finding these bugs is 10% knowing about attack vectors (CSRF, XSS etc.) and 90% spending time trying them out in various forms in all the places you can think of. In school (especially if you're already doing well there) you often have lots of spare time and not so many others way of earning money. And with just a few years of experience with programming/computers there are far quicker ways to earn money. It's still super impressive work by the author of course!! They are extremely talented! I'm not trying to dismiss what they accomplished; just commenting on the strange dynamic of software security research.
- vmception 6y ago
  Also its worth considering that all these applications get updated like every week, so something that was ruled out in the past can be exploitable now.
- paulpauper 6y ago
  This is not just finding bugs but coding and dev., work. I too found bugs in fakebook but they never paid me, but they did fix them.
  - ipaddr 6y ago
    I found many bugs over the years. Never reported any and they were available when I needed them later. Disclosing sounds like a good idea until you realize they hold all of the power. You tell them something is broken they fix it and they get to decide if they want to pay you and how much. The holes into private photos remained open for years. I'm glad no one disclosed.
    - montenegrohugo 6y ago
      Just to clarify: you exploited said hole to access private photos of other people without their consent or knowledge?
tester34 6y ago
That's huge pros of this industry, that all you need to enter is just cheap computer and willingness to put effort and you can make huge career. You don't even need to waste time on college because of the information avaliability, especially when you're already this good before even being able to attend.
- TrackerFF 6y ago
  > You don't even need to waste time on college Well that completely depends on where you live, and the culture there. You could be a rock-star 10x dev in every sense of the word, but certain places in the world, if you don't have a degree or decades of industry experience, you will almost certainly never even get an interview. You will need to seek out, and network your way into positions where you can actually impress some human being, and not get stonewalled by resume-screening software. For every whizkid without a degree that managed to finesse their way into some hot startup or Big N company, there are likely ten that are wasting their talents on some irrelevant dead-end job doing data entry or whatever.
  - TheAdamAndChe 6y ago
    100%. Companies don't hire based on capability, they hire based on reputation and the labor supply/demand of the area. If you can do neat stuff but have never proven your capacity to do so, then it's unlikely you'd be hired.
    - indigochill 6y ago
      > If you can do neat stuff but have never proven your capacity to do so, then it's unlikely you'd be hired. And as far as this goes, this feels fair. There are tons of opportunities to show your chops, whether a code jam or CTF or hobby project or whatever (and yes, I know hobby projects aren't for everyone, so find something that is). A skill is only valuable on the job market once you've proved it actually exists. The larger problem that you're touching on is that some companies have streamlined their application process in such a way that any way of demonstrating your capability that isn't a university degree or prior corporate experience is disqualified without consideration, and that I would agree is a serious problem.
yarcob 6y ago
And judging by the blog post he's a talented technical writer as well.
- dugmartin 6y ago
  I came to the comments to say the same thing. Being able to write clearly while holding together a narrative is a gift.
  - poutrathor 6y ago
    https://i.kym-cdn.com/photos/images/newsfeed/001/326/104/e0b.jpg https://i.kym-cdn.com/photos/images/newsfeed/001/326/104/e0b...
  - xyyzy 6y ago
    The CTF part made me confused though, was this bugbounty part of some CTF?
nolok 6y ago
> The dude's in high school and finds stuff like this? Man, you should have seen the european demoscene in the 90s, half of the geniuses had the same main obstacle: homework from school. Despite what it may seem IT is still in its infancy which means that we work in a field where pure affinity for the subject and raw curiosity-driven brain power (or in some case, dedication to the task), as well as a couple hundred euros worth of hardware, is enough to get into the most complex parts and sometime redefine them. Access to all the papers and education you need is insanly open on the internet (unlike other fields), as well as trillions of line of code for you to explore. The only two limits are yourself, and time. Which is not to say that training and experience have no role, but IT as a field is extremly large and for many parts we're still in an early uncharted phase, so discovery is made by explorers and dedicated people[1]. Still, most dev would gain a lot by going through a good algorithmic course. [1] While talking about dedication, special mention to the linux everywhere guys. I will never not smile at the idea that some of the best IT protections in the world, costing millions upon millions, from the Xbox to HD-DVD to whatever, were brought down because someone wanted to run it on linux.
- paulpauper 6y ago
  this is more like front-end dev than IT
  - TheAdamAndChe 6y ago
    Information Technology is technology that involves information manipulation and storage. Development and software engineering are subsets of IT, infrastructure maintenance is another.
    - setr 6y ago
      Computer Science has nothing to do with computers, or science. It is generally a mistake to read the name of something as defining that thing — it has almost certainly shifted meaning since it’s origin, especially if someone is arguing about it.
paulpauper 6y ago
yeah I know. I thought leering about infinite series in HS was impressive but this blows that away. A solid 6-figure salary awaits him . So much for that media narrative about America dumbing down and lowered academic standards. America still produces among the best talent in the world.
- lupire 6y ago
  Lowered academic standards usa concern for the median and lower quartile, not the extreme high end of people who probably didn't learn their exceptional talents in school. You undermine your own point by pointing out that this person is a 1%er.
- deleted 6y ago
  [deleted]
Thaxll 6y ago
The same reasons why some teenagers find exploit in online games, finding exploits is "easy", programs nowdays are so complex that the security vector is pretty open. On the otherside those rock star dev will get their stuff broken because of the above.
ijustwanttovote 6y ago
I was thinking the same thing, makes me wonder wtf I'm doing with my life.

Thorncorona 6y ago

Was the second part of your comment really necessary?

heywherelogingo 6y ago
You seem very sensitive.

jcims 6y ago

I worked at a very large bug bounty program for a short spell a few years back. I’ve been in the infosec world since the 90’s, and the number of ridiculously talented teenagers around the world that were sending in very good reports on sophisticated attacks was pretty mind boggling. Yes there was a lot of garbage too, but that was to be expected. I came away thinking that i hope these kids remain engaged and invested in society lol.

gogopuppygogo 6y ago
I knew some teenagers in the warez scene in the 90’s and early aughts. Insanely talented folks. One even runs a bank now...
- warlog 6y ago
  So, a life of crime?...
  - eru 6y ago
    It's only a crime if you get caught and convicted in a court of law. Innocent until and unless proven guilty.
    - distances 6y ago
      I think that was just a joke towards their career in banking.
      - eru 6y ago
        I was trying to extend the joke---what banks do might be shady by some standards, but they have good enough lawyers and accountants that it's seldom outright illegal enough to get individual bankers criminally liable.

judofyr 6y ago

> The dude's in high school and finds stuff like this? As someone who once got a $500 bug bounty from Facebook in high school, I'll have to say that this is not so surprising. Finding these bugs is 10% knowing about attack vectors (CSRF, XSS etc.) and 90% spending time trying them out in various forms in all the places you can think of. In school (especially if you're already doing well there) you often have lots of spare time and not so many others way of earning money. And with just a few years of experience with programming/computers there are far quicker ways to earn money. It's still super impressive work by the author of course!! They are extremely talented! I'm not trying to dismiss what they accomplished; just commenting on the strange dynamic of software security research.

vmception 6y ago
Also its worth considering that all these applications get updated like every week, so something that was ruled out in the past can be exploitable now.
paulpauper 6y ago
This is not just finding bugs but coding and dev., work. I too found bugs in fakebook but they never paid me, but they did fix them.
- ipaddr 6y ago
  I found many bugs over the years. Never reported any and they were available when I needed them later. Disclosing sounds like a good idea until you realize they hold all of the power. You tell them something is broken they fix it and they get to decide if they want to pay you and how much. The holes into private photos remained open for years. I'm glad no one disclosed.
  - montenegrohugo 6y ago
    Just to clarify: you exploited said hole to access private photos of other people without their consent or knowledge?

tester34 6y ago

That's huge pros of this industry, that all you need to enter is just cheap computer and willingness to put effort and you can make huge career. You don't even need to waste time on college because of the information avaliability, especially when you're already this good before even being able to attend.

TrackerFF 6y ago
> You don't even need to waste time on college Well that completely depends on where you live, and the culture there. You could be a rock-star 10x dev in every sense of the word, but certain places in the world, if you don't have a degree or decades of industry experience, you will almost certainly never even get an interview. You will need to seek out, and network your way into positions where you can actually impress some human being, and not get stonewalled by resume-screening software. For every whizkid without a degree that managed to finesse their way into some hot startup or Big N company, there are likely ten that are wasting their talents on some irrelevant dead-end job doing data entry or whatever.
- TheAdamAndChe 6y ago
  100%. Companies don't hire based on capability, they hire based on reputation and the labor supply/demand of the area. If you can do neat stuff but have never proven your capacity to do so, then it's unlikely you'd be hired.
  - indigochill 6y ago
    > If you can do neat stuff but have never proven your capacity to do so, then it's unlikely you'd be hired. And as far as this goes, this feels fair. There are tons of opportunities to show your chops, whether a code jam or CTF or hobby project or whatever (and yes, I know hobby projects aren't for everyone, so find something that is). A skill is only valuable on the job market once you've proved it actually exists. The larger problem that you're touching on is that some companies have streamlined their application process in such a way that any way of demonstrating your capability that isn't a university degree or prior corporate experience is disqualified without consideration, and that I would agree is a serious problem.

yarcob 6y ago

And judging by the blog post he's a talented technical writer as well.

dugmartin 6y ago
I came to the comments to say the same thing. Being able to write clearly while holding together a narrative is a gift.
- poutrathor 6y ago
  https://i.kym-cdn.com/photos/images/newsfeed/001/326/104/e0b.jpg https://i.kym-cdn.com/photos/images/newsfeed/001/326/104/e0b...
- xyyzy 6y ago
  The CTF part made me confused though, was this bugbounty part of some CTF?

nolok 6y ago

> The dude's in high school and finds stuff like this? Man, you should have seen the european demoscene in the 90s, half of the geniuses had the same main obstacle: homework from school. Despite what it may seem IT is still in its infancy which means that we work in a field where pure affinity for the subject and raw curiosity-driven brain power (or in some case, dedication to the task), as well as a couple hundred euros worth of hardware, is enough to get into the most complex parts and sometime redefine them. Access to all the papers and education you need is insanly open on the internet (unlike other fields), as well as trillions of line of code for you to explore. The only two limits are yourself, and time. Which is not to say that training and experience have no role, but IT as a field is extremly large and for many parts we're still in an early uncharted phase, so discovery is made by explorers and dedicated people[1]. Still, most dev would gain a lot by going through a good algorithmic course. [1] While talking about dedication, special mention to the linux everywhere guys. I will never not smile at the idea that some of the best IT protections in the world, costing millions upon millions, from the Xbox to HD-DVD to whatever, were brought down because someone wanted to run it on linux.

paulpauper 6y ago
this is more like front-end dev than IT
- TheAdamAndChe 6y ago
  Information Technology is technology that involves information manipulation and storage. Development and software engineering are subsets of IT, infrastructure maintenance is another.
  - setr 6y ago
    Computer Science has nothing to do with computers, or science. It is generally a mistake to read the name of something as defining that thing — it has almost certainly shifted meaning since it’s origin, especially if someone is arguing about it.

paulpauper 6y ago

yeah I know. I thought leering about infinite series in HS was impressive but this blows that away. A solid 6-figure salary awaits him . So much for that media narrative about America dumbing down and lowered academic standards. America still produces among the best talent in the world.

lupire 6y ago
Lowered academic standards usa concern for the median and lower quartile, not the extreme high end of people who probably didn't learn their exceptional talents in school. You undermine your own point by pointing out that this person is a 1%er.
deleted 6y ago
[deleted]

Thaxll 6y ago

The same reasons why some teenagers find exploit in online games, finding exploits is "easy", programs nowdays are so complex that the security vector is pretty open. On the otherside those rock star dev will get their stuff broken because of the above.

ijustwanttovote 6y ago

I was thinking the same thing, makes me wonder wtf I'm doing with my life.