2 ms·

They are gig workers. Security gets outsourced to these workers where normally the company would need to pay a salary. The refusal to pay while fixing the bug

by ipaddr 5y ago

They are gig workers. Security gets outsourced to these workers where normally the company would need to pay a salary. The refusal to pay while fixing the bug in 48 hours shows a power inbalance. I fear this is where we are headed in the future as AI pumps out most code all of the remaining work comes in the form of contests where thousands spends 80 hours a week and the company (in the best case) will award one person with a cash prize small enough to not hit minimum wage.

tptacek 5y ago
Google does not use bug bounties instead of paying people salaries to do software security. Google pays more people to do software security than does any company on the planet. They do bug bounties because you get different bugs from them than you would from any employee. If bounty hunters are benefits-eligible employees, then there are virtually no services a company can buy from anybody that don't qualify similarly; read IRS P15-A; there are basically no IRS classification tests that bug bounties hit. Here's the "20 factor test" (condensed from Oregon's condensed version) the IRS uses for employee classification: * Does the company direct where, when, and how the work is done? (You can hunt for bugs from any country in the world, whenever you want, using whichever tools you like.) * Does the company require company-provided training to provide the service? (The first contact Google has from a bounty hunter can be the bug they submit, and Google will pay). * Is the service directly integrated into the business the company provides? (No: Google doesn't provide bug bounty services to other companies, and is not in fact a bug bounty with a small search engine attached.) * Does the company insist on a particular named person to do the work? (No; in fact, until they're actually paid, many bounty hunters are psueodonymous.) * Does the company control who the provider hires to assist in the work? (Nope, you can hire your own team of people to assist with your bountying, and Google does not care.) * Does the company maintain a continuous relationship with the service provider? (Nope, you can submit a bug in June and then come back next April with another one, or come back never). * Does the company determine the schedule on which the work is done, or is the schedule flexible? (Google does not even slightly care what schedule you find bugs on, or even the timeline you use to report bugs on once you find them.) * Does the company demand full-time hours? (Google doesn't set any hours for bounty hunters whatsoever.) * Does the company demand that the service be provided on-site? (Bounty hunters work exclusively from their own facilities.) * Does the company demand that the work be performed in a specific order or sequence? (No, you can look for any combination of bugs in any set of services using whichever set of tests you want to use, be they fuzzing or mitmproxying or scanning, in any order you like.) * Does the company require regular periodic written or oral reports? (Indeed they do not.) * Does the company pay hourly, weekly, or monthly, rather than by the project? (Bounties are paid by the bug.) * Does the company defray expenses for the work? (Nope.) * Does the company provide the tools and materials needed for the work? (Nope, bounty hunters BYO laptops and Burp Suites.) * Does the company provide facilities, office space, etc for the work? (Google doesn't provide even so much as a Slack account for bug hunters.) * Are the earnings from the work predetermined, or can the workers realize greater or lesser profits from the amount of work they put on? (Regardless of the hours committed to bug-hunting, bug hunters earn revenue based on the value of the assets they generate; if you come up with a technique to find dozens of XSS vulnerabilities in a couple hours, you'll make a zillion dollars per hour.) * Is the relationship exclusive? (Of course not, bounty hunters work with multiple companies as a rule.) * Can the worker make similar services available to the public? (Not only can they, but independent consulting is the norm for this kind of work.) * (This is 2 bullets, condensed) Can either party terminate the relationship independently? (Yep.) Bug bounty participants are not, as a general rule, classifiable as employees. People make noise about it because there's drama about Uber --- where the company exerts substantial control over how employees do the work, when and where they do it, where they check in with their cars, &c, and do so while providing the core service the company offers. Someone on a message board is going to try to suggest that Google is in fact a bug bounty program with a small search engine attached to it, but I mean, come on.
- rossjudson 5y ago
  Where's my mic drop ascii thing? Too long anyway.

by ipaddr 5y ago

tptacek 5y ago

Google does not use bug bounties instead of paying people salaries to do software security. Google pays more people to do software security than does any company on the planet. They do bug bounties because you get different bugs from them than you would from any employee. If bounty hunters are benefits-eligible employees, then there are virtually no services a company can buy from anybody that don't qualify similarly; read IRS P15-A; there are basically no IRS classification tests that bug bounties hit. Here's the "20 factor test" (condensed from Oregon's condensed version) the IRS uses for employee classification: * Does the company direct where, when, and how the work is done? (You can hunt for bugs from any country in the world, whenever you want, using whichever tools you like.) * Does the company require company-provided training to provide the service? (The first contact Google has from a bounty hunter can be the bug they submit, and Google will pay). * Is the service directly integrated into the business the company provides? (No: Google doesn't provide bug bounty services to other companies, and is not in fact a bug bounty with a small search engine attached.) * Does the company insist on a particular named person to do the work? (No; in fact, until they're actually paid, many bounty hunters are psueodonymous.) * Does the company control who the provider hires to assist in the work? (Nope, you can hire your own team of people to assist with your bountying, and Google does not care.) * Does the company maintain a continuous relationship with the service provider? (Nope, you can submit a bug in June and then come back next April with another one, or come back never). * Does the company determine the schedule on which the work is done, or is the schedule flexible? (Google does not even slightly care what schedule you find bugs on, or even the timeline you use to report bugs on once you find them.) * Does the company demand full-time hours? (Google doesn't set any hours for bounty hunters whatsoever.) * Does the company demand that the service be provided on-site? (Bounty hunters work exclusively from their own facilities.) * Does the company demand that the work be performed in a specific order or sequence? (No, you can look for any combination of bugs in any set of services using whichever set of tests you want to use, be they fuzzing or mitmproxying or scanning, in any order you like.) * Does the company require regular periodic written or oral reports? (Indeed they do not.) * Does the company pay hourly, weekly, or monthly, rather than by the project? (Bounties are paid by the bug.) * Does the company defray expenses for the work? (Nope.) * Does the company provide the tools and materials needed for the work? (Nope, bounty hunters BYO laptops and Burp Suites.) * Does the company provide facilities, office space, etc for the work? (Google doesn't provide even so much as a Slack account for bug hunters.) * Are the earnings from the work predetermined, or can the workers realize greater or lesser profits from the amount of work they put on? (Regardless of the hours committed to bug-hunting, bug hunters earn revenue based on the value of the assets they generate; if you come up with a technique to find dozens of XSS vulnerabilities in a couple hours, you'll make a zillion dollars per hour.) * Is the relationship exclusive? (Of course not, bounty hunters work with multiple companies as a rule.) * Can the worker make similar services available to the public? (Not only can they, but independent consulting is the norm for this kind of work.) * (This is 2 bullets, condensed) Can either party terminate the relationship independently? (Yep.) Bug bounty participants are not, as a general rule, classifiable as employees. People make noise about it because there's drama about Uber --- where the company exerts substantial control over how employees do the work, when and where they do it, where they check in with their cars, &c, and do so while providing the core service the company offers. Someone on a message board is going to try to suggest that Google is in fact a bug bounty program with a small search engine attached to it, but I mean, come on.

rossjudson 5y ago
Where's my mic drop ascii thing? Too long anyway.