3 ms·

arbitrary r/w via WebGL, apparently: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142

arbitrary r/w via WebGL, apparently: https://bugs.chromium.org/p/chromium/issues/detail?id=1427865#c49 https://bugs.chromium.org/p/chromium/issues/detail?id=142786... looks like a pretty powerful primitive for only a $10K bounty. what would it go for on Zerodium?

veave 3y ago
Tired of so many web technologies that are very rarely used by most users being potential giant gaping security holes.
- mdaniel 3y ago
  curl https://chromereleases.googleblog.com/search/label/Stable%20updates \ | grep -i "type confusion in v8" I'm pretty sure that ship has sailed; an unholy amount of C++ that runs arbitrary code from the Internet is going as well as can be expected
Veserv 3y ago
Why would they pay more than $10k? It only costs ~$10k in engineering resources to find one and they get a steady stream at this level of cost. It is not like paying more and getting more reports improves lacking quality or decreases your defect rate. You can not buy your way to fixing a insecure design all you can do is paper over it. If they paid more then all that would mean is that people would report more of the expected defects. You have to fix reported defects, so you would then need to deploy more engineering resources to fix them even though it will not make a meaningful dent in the number of defects. So, all increasing the payout would do is increase direct costs, increase the number of defects you know about, and increase the number of engineers you need fixing, now known, defects slowing your feature velocity.
- sterlind 3y ago
  there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k seems quite undervalued, and the only reason they're getting any is because of either 1) the moral code of the researchers who find them, or 2) because the prize is a bonus on top of their other motivations (e.g. bragging rights, research funded by governments or universities.) Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.
  - Veserv 3y ago
    It costs less than $10k to regularly find them. If it cost Google $200k per valid RCE report they would be absolutely flooded with reports of identified defects they would have to pay out and fix with no end in sight. They would be forced to reallocate feature development engineers and resources to fixing the security defects in Chrome. How will they get promotions if all they do is fix defects instead of shipping new features? To be less sarcastic, it would also not help. As I said earlier, a bug bounty does not cause quality improvements; you can not buy your way to low defect rates. What a high bug bounty does is provide incentive for high quality (otherwise you have to keep paying), third party validation (same as above), and a low-hanging net (to catch actual low cost flukes). Put another way, a bug bounty is a externally visible metric. It merely indicates and measures, it does not cause.

veave 3y ago

Tired of so many web technologies that are very rarely used by most users being potential giant gaping security holes.

mdaniel 3y ago
curl https://chromereleases.googleblog.com/search/label/Stable%20updates \ | grep -i "type confusion in v8" I'm pretty sure that ship has sailed; an unholy amount of C++ that runs arbitrary code from the Internet is going as well as can be expected

Veserv 3y ago

Why would they pay more than $10k? It only costs ~$10k in engineering resources to find one and they get a steady stream at this level of cost. It is not like paying more and getting more reports improves lacking quality or decreases your defect rate. You can not buy your way to fixing a insecure design all you can do is paper over it. If they paid more then all that would mean is that people would report more of the expected defects. You have to fix reported defects, so you would then need to deploy more engineering resources to fix them even though it will not make a meaningful dent in the number of defects. So, all increasing the payout would do is increase direct costs, increase the number of defects you know about, and increase the number of engineers you need fixing, now known, defects slowing your feature velocity.

sterlind 3y ago
there are a lot of freelance hackers. if companies pay more for bugs than the bad guys, it makes financial sense for hackers to sell bugs to the good guys. $10k seems quite undervalued, and the only reason they're getting any is because of either 1) the moral code of the researchers who find them, or 2) because the prize is a bonus on top of their other motivations (e.g. bragging rights, research funded by governments or universities.) Zerodium pays out up to $200k for a Chrome RCE without sandbox escape. 20x more! that's insanely tempting.
- Veserv 3y ago
  It costs less than $10k to regularly find them. If it cost Google $200k per valid RCE report they would be absolutely flooded with reports of identified defects they would have to pay out and fix with no end in sight. They would be forced to reallocate feature development engineers and resources to fixing the security defects in Chrome. How will they get promotions if all they do is fix defects instead of shipping new features? To be less sarcastic, it would also not help. As I said earlier, a bug bounty does not cause quality improvements; you can not buy your way to low defect rates. What a high bug bounty does is provide incentive for high quality (otherwise you have to keep paying), third party validation (same as above), and a low-hanging net (to catch actual low cost flukes). Put another way, a bug bounty is a externally visible metric. It merely indicates and measures, it does not cause.