3 ms·
You were a inexperienced beginner finding and exploiting tens of bugs over a 10-15 week course. In between other courses and learning you only had hours to mayb
by Veserv 3y ago
You were a inexperienced beginner finding and exploiting tens of bugs over a 10-15 week course. In between other courses and learning you only had hours to maybe a few days per bug. On Zerodium [1], a generic Linux LPE pays 50 K$. At normal experienced exploit developer costs that buys you ~200 person-hours. That is professionals spending 10-100x as much time as you spent.
Just think of the gap between the first time in the woodworking shop and a carpenter, first time pottery versus a master, a new painter and a professional artist. Think of how many things the master can do that it is literally impossible for the new person to do. Then add another 10-100x as much time on that. That is the gap.
[1] https://zerodium.com/program.html https://zerodium.com/program.html
- rfoo 3y agoIt makes your point even stronger, but > a generic Linux LPE pays 50 K$. At normal experienced exploit developer costs that buys you ~200 person-hours. $250 per hour? I must be living in the wrong part of the world then, where can find an exploit developer job like this :o
- bawolff 3y agoI don't work in that space, so i don't know what is normal, but that sounds reasonable to me. Its a niche field that requires quite a bit of low level skill. I'd expect it to pay significantly more than web dev jobs
- buggeryorkshire 3y agoThey pay more than that in certain parts of the UK and US - didn't do it myself, but know people who did and they were definitely in demand.
- Veserv 3y agoCosts, not salary. Overhead is usually 1.5x-3x salary and I was throwing in some profit for good measure. So the number I threw out is more in the 150 k$-300 k$ range, not the 500 k$ range like you are thinking.
- Manouchehri 3y agoI went from having previously written 0 exploits (aside from IoT fails with command injection), to my first Chrome exploit in about 15 weeks. I did probably put in about 1,000 hours though.