6 ms·

Ask HN: How do you find developers for open source bug bounties?

64 points by freedomben 2y ago

Background: There's a WebRTC Chromium bug that is making life difficult for us. I'd like to pay a developer to fix it, but I don't know where/how to find people. But this leads to a higher level question. When you want to sponsor open source bug fixes and/or feature and there isn't a clear "sponsor" link or button, how do you find qualified people? For example, is there a site/app you typically search?

pabs3 2y ago
There are lots of open source consultancies (Igalia for example does a lot of work on web browser and lower layers), and some projects have lists of available consultants: https://github.com/fossjobs/fossjobs/wiki/Resources#freelancing https://github.com/fossjobs/fossjobs/wiki/Resources#freelanc...
orliesaurus 2y ago
Very interesting question. Fun fact today I was looking at some OSS projects like OpenAdapt and apparently they use algora.io for theirs...maybe a starting point?
mickael-kerjean 2y ago
1. git clone the project you're interested in 2. extract emails of the contributors that are involved in what you need using something like this: git log --pretty=format:"%ad - %ae - %ce" 3. make them an offer
- nox101 2y ago
  4. keep upping the offer until they say yes note: I mean to imply, the person that asked the question likely has a budget far lower than the person qualified to do the work is willing to accept.
  - dboreham 2y ago
    Bingo.
    - eastbound 2y ago
      Open-source is often free, and it seems like a good system that projects can be initialized easily with a low cost, but to use it in a business, businesses should pay the costs of the boring production pipeline, ie the security bounties.
asattarmd 2y ago
Igalia is a consultancy that specializes in fixing bugs/building features in Browsers. My company uses them regularly
- jononor 2y ago
  This is the real answer.
chrommmer 2y ago
> There's a WebRTC Chromium bug that is making life difficult for us. I'd like to pay a developer to fix it, but I don't know where/how to find people. Have you filed a bug in the project's issue tracker? Has the project team not followed up? Is there a link to this issue?
- Euphorbium 2y ago
  Filing a bug report properly is work and it is easier to pay.
  - nox101 2y ago
    Seems to me, describing the problem for the person you're going to pay is the exact same amount of work as filing a bug. They can't read your mind so you'll have to detail what you want fixed. Show how to repo the problem so they can prove they fixed it. Sounds like a bug report to me
    - Timber-6539 2y ago
      Depends. No work is involved if problem is easily reproducible. Just need to describe the bug & environment to the "bounty hunter" and they will take care of the rest. Anything more than that would necessitate filing the actual issue yourself.
- DocTomoe 2y ago
  I have stopped writing bug reports altogether. I believe to write good bug reports, and put serious effort in it to provide test cases, describe the environment the bug thrives in, make assumptions on what may be wrong, etc. A good bug report takes half an hour of my time, easily. Only to then be ignored for 15+ years and eventually silently closed because "we don't use that architecture anymore". Looking at you, KDE, and Atlassian (= the problem exists regardless on the monetarization format). It's just no longer worth my time.
- deleted 2y ago
  [deleted]
jpt4 2y ago
Pay successful bounty submissions on a faster than net 180 time frame. A friend was interested in the rather extensive Expensify bug bounty programme [0], but the red tape involved created far too long a turnaround time between claiming a ticket and receiving compensation. [0] https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aissue+label%3A%22Help+Wanted%22 https://github.com/Expensify/App/issues?q=is%3Aopen+is%3Aiss...
- Suppafly 2y ago
  Do they get to claim it and then work on it, or do they need to have a solution already to claim it? net 180 wouldn't be bad if you could reserve several of them to work on at a time. It'd suck to work 'for free' that first few months, but then you'd have consistent income coming in regularly after that.
  - MiscCompFacts 2y ago
    I think I would prefer whomever fixed the bug first, I know that’s not ideal for people who put the time and effort in.
    - Suppafly 2y ago
      I guess it depends if you're the one doing the paying or the one receiving the pay .
dboreham 2y ago
You're going to hire a Google employee?
burcs 2y ago
I've heard a lot of people talk about algora.io I haven't used them myself though.
newaccount74 2y ago
I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. <$500 for a bug that would take at least a week to fix? I guess it's a nice tip if you were going to work on it anyway, but it makes no sense for me to schedule time to work on that bounty when pretty much any other job would pay 5 - 10 times as much. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.
- bashwizard 2y ago
  I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.
  - langsoul-com 2y ago
    How is it possible to make that much though? Is it like a private bounty board or something?
    - jpgvm 2y ago
      Big money like that is only made one way, security vulns in "software or hardware of interest", sold via brokers to 3 letter agencies (or much less scrupulous actors from time to time).
  - ptsneves 2y ago
    This sounds like they are a known figure in the project and are offered consultancy jobs. When I had a company that is what I did when I needed something fixed. It was not cheap either. The point being yes it is possible but it is not a bounty board like in the city town hall. Anyway I find it a bit weird the topic is asked at all. Why didn’t the OP just cold contacted committers?
  - newaccount74 2y ago
12thhandyman 2y ago
Seem to recall a site for bounties posted at some point on HN. Not sure if this is the one, or if it’s “any good” but [1] exists. [1] https://www.openbugbounty.org/ https://www.openbugbounty.org/
vidyesh 2y ago
Finding qualifying people is hard, but with bug bounties you don't have to worry about it right? You only pay when you approve that PR.. I've seen algora being used a lot by many popular projects and recently heard about polar.sh also supporting bug bounties.
csomar 2y ago
There isn’t a market for that, really. You can open bounties for your project and this might interest some developers to do some work with their goal of being hired, eventually. Or maybe they are looking to build a portfolio but then they’ll be picking the bounties to solve. Or the problems are kinda repetitive, so that they can solve the $200 bounty in a single day and they can make it work at scale. What you are asking for seems very specific, however. It’ll cost thousands in developer hours just to understand the bug and determine if it is really a bug. That assuming you find the right person for this job. Your best bet is to try and work it out with the chromium team. They are already on Google’s payroll and that’s their job.
CJefferson 2y ago
Not the same question, but related. Over the years I feel I've got very good at tracking down reasons for crashes in C and C++ programs, and I quite enjoy the experience of tracking down such bugs. I've often fancied a way to monetise this, maybe even a "no fix, no fee" system (assuming you can give me a way of reasonably predictibly reproducing the crash, even if it needs a while / has a random element). It would require the company giving out their source code to me, and giving me a way to build it, so I imagine in most situations it wouldn't be worth the effort, unless the bug was absolutely mission-critical.
- chrisldgk 2y ago
  We’ve found him, we’ve found the one guy that likes debugging. Honestly though, good for you. There need to be more people like this in the world.
  - eitland 2y ago
    Ey, next to teaching it is the favorite part of my profession! (I like modeling systems and greenfield development as well, but I feel my time is absolutely best utilized when I can train others or crack hard bugs that are worth paying someone good money to crack.)
    - ungamedplayer 2y ago
      Please add me to your newsletter.
      - eitland 2y ago
        I can't find your email address, send me a mail if you want.
  - jlokier 2y ago
    I assure you there's at least two of us :-)
  - hyperman1 2y ago
raybb 2y ago
Coolify has had at least some success using the bounty platform https://algora.io/ https://algora.io/
throwaway81523 2y ago
> Background: There's a WebRTC Chromium bug that is making life difficult for us. I'd like to pay a developer to fix it, but I don't know where/how to find people. HN has a "who is hiring" post on the first weekday of every month. You could try posting there. It shouldn't be difficult to bring someone on through a normal consulting arrangement. Lots of people with good qualifications are looking for work these days. Doing it through a "bounty" means that you're asking people to work on the issue speculatively, with no guarantee of getting paid (PR is not accepted, someone else gets it first, etc). So FOSS bounties (unless they are quite large) tend to be seen as recognition for basically altruistic work. And who wants to work altruistically on a Google product of all things, especially if Google itself is unresponsive to the bug report? There was just another post about someone collecting $2 million as a security bug bounty for some cryptocurrency app. The person found a bug that would have allowed takeover of the entire blockchain for that currency. It looks from https://bughunters.google.com/about/rules/android-friends/6171833274204160/android-and-google-devices-security-reward-program-rules https://bughunters.google.com/about/rules/android-friends/61... that Google's highest offer for Android exploits is $1 million but there are a lot of smaller ones that are still in six figures. Of course security issues are "unknown unknowns" and are a different challenge than simply fixing a known bug in a known feature, but just the same, the above shows that getting people's attention with pure financial incentives can take some pretty big amounts. If you're really up for that and are credible, then the approach can work. Anyway, in the case of a project with a public bug tracker, you can always open an issue and make your offer as part of it. There doesn't have to be a "sponsor" button for that.
Havoc 2y ago
I’d cold mail the people who have a contribution history on the area of the project already. Much more likely to be a quick buck for someone already familiar with the code base
ayushm2003 2y ago
https://www.bountycaster.xyz/start/bounty https://www.bountycaster.xyz/start/bounty this is crypto-adjacent so will probably get thrown ut of HN but still, the platform is pretty incredible for finding and posting bounties both highly technical and non technical. happy to connect you to the founder if interested, maybe she can post on your behalf if you don't wanna sign up for the platform
- bnchrch 2y ago
  Great app! Got a logo designed without leaving farcaster
ayewo 2y ago
There are a number of ways you could approach this. 1. Post here on HN. On the 1st work day of every month, the whoishiring bot posts 3 Ask HN threads and you can use the Ask HN: Freelancer? Seeking freelancer? thread to post an ad stating the specific skills that you are looking for. You are more likely to get inquiries if you include a budget. Here are 2 examples: https://news.ycombinator.com/item?id=38846044 https://news.ycombinator.com/item?id=38846044 (Jan 2024) and https://news.ycombinator.com/item?id=38514744 https://news.ycombinator.com/item?id=38514744 (Dec 2023). 2. There is also Algora (https://console.algora.io/ https://console.algora.io/) and they support the very use case you are asking about though they have a take rate of about 25% for each bounty[1]. Here's an example of Scott Chacon using Algora to sponsor a bounty in the Zed repo https://github.com/zed-industries/zed/issues/4440 https://github.com/zed-industries/zed/issues/4440. He posted about his experience on Twitter here: https://x.com/chacon/status/1770005036170375594 https://x.com/chacon/status/1770005036170375594. 3. One limitation of Algora mentioned in #2 is that there is a high representation of application software (web apps, desktop apps etc) compared to system software (web browsers, databases etc) meaning many of the bounties available are in "mainstream" languages like JavaScript/TypeScript, Golang, Rust. There are only a handful of bounties that require C/C++ expertise (which I imagine is what you'll need to work on Chromium) so it might be a struggle to get the right developers on Algora. One solution would be to post the bounty on Algora then do targeted outreach in WebRTC communities so the bounty can reach the right audience. For instance, Sean DuBois, who runs the Pion WebRTC community, has posted in the past on behalf of WebRTC folks looking for a role e.g. https://x.com/_pion/status/1780286789074252176 https://x.com/_pion/status/1780286789074252176 so you could consider reaching out to him and similar communities to see if they can help with match-making folks that might be interested in your bounty. 1: https://github.com/nuxt/nuxt/issues/15639#issuecomment-1986675823 https://github.com/nuxt/nuxt/issues/15639#issuecomment-19866...
rsingireddy 2y ago
Hey we would be happy to take this on at Hydra (https://hydraoss.io/ https://hydraoss.io/). We're an agency built for this kind of problem - finding people to fix things in open source. In contrast to a bug bounty program, we manage everything end to end, and the customer just pays us the invoice and doesn't have to deal with anything else. We specialize in Rust but we've had customers from everywhere. Let us know!
- kapple14 2y ago
  [dead]
danlugo92 2y ago
What is the bug?
grandinj 2y ago
Companies like Collabora (for general linux stuff) and Igalia (for browser type stuff) exist to do things like this. They employee a bunch of people who work on open-source stuff, and you can pay that company to get stuff done on various open-source projects. The stumbling block is that the cost is almost always much much more than you would be willing to pay, because, surprise surprise, our line of work is very very expensive.

k__ 2y ago

Depends on what you call "a living". You probably won't get rich from doing $500 bug bounties. But there are hackathons with bounties in the $1000-$10000 range. Do 2-4 of those per month and you're good.

kazinator 2y ago
You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.
- manuelmoreale 2y ago
  2 or 4 1k a month puts you either above or way above average salary here in Italy.
  - Suppafly 2y ago
    You have to compare it to being a self employed business owner instead of to a salary from a job. Half of it is going to go to taxes.
    - manuelmoreale 2y ago
      Self employed since 2011. In Italy. I know how this world works. If you get 2 to 4K a month you can easily live an absolutely normal life or even above average.
      - Suppafly 2y ago
        I suppose it depends on how you are defining normal. Does that mean owning a home and vehicle and supporting a wife and kids, or does that mean sharing an apartment with multiple people and using public transport and not having any savings? I get that the cost of living is lower in Italy, but different people have different ideas about what constitutes comfortable. Just from googling, the 2k seems like it'd be a bit of a struggle but the 4k seems like it'd be pretty nice.
        manuelmoreale 2y ago
        2k/mo pre taxes as a self employed would allow you to live a normal life meaning you’d not struggle to get through the month. 4k/mo would allow you to easily buy a house and live an above average life. This is obviously true for most of the country and it’s different if you want to live in one of the big cities but that goes without saying.
        kazinator 2y ago
        If you happen to be supporting a four-member family on that 2K, it's barely above the poverty line. Even when you're young and single, it behooves you to think about retirement; it's sooner than you think. You need a safety net in case something happens, leaving you unable to work for a long time. If you support a family, you have to think about things like education funds for the kids, and what happens if you suddenly die.
        manuelmoreale 2y ago
        Agree on the family but if 2 people are working (which is normal) with two 2k salaries you’re doing just fine. Retirement is provided by the state here so it’s not something I have to plan for. Again, just to reiterate, the original post was using 2k/mo as the absolute minimum and the point I was trying to make is that a few Ks a month is a reasonable living in way more places that people realize. But I suspect a non negligible % of people here on HN have a distorted view of the world and how much living cost.
        newaccount74 2y ago
        In Austria, 2k/mo before taxes is roughly what you earn as a part-time employee filling shelves at the supermarket [1]. [1]: Typical supermarket job in Austria: https://jobs.aldi-hofer.com/hofer-karriere-at/job/Linz-BACKBOX-&-Regalbetreuer-%28mwd%29-Spittelwiese-6%2C-4020-Linz-Ober-4020/719967001/?feedId=245101 https://jobs.aldi-hofer.com/hofer-karriere-at/job/Linz-BACKB... The advertised salary for 21 hours/week of 1330€ is paid 14 times per year and comes to a total income of ~15.7k€ after taxes. If you make 24k€ a year as a self-employed person, you will have to pay ~400€ taxes + 6.5k€ pension + health insurance leaving a total of ~17k€ after taxes.
- maccard 2y ago
  $4000/mo pre-tax is an above average salary for the UK. You'd live just fine in most places in the UK (london aside).
  - newaccount74 2y ago
    Can't really compare a salary to bounties. With a salary, you can rely on the income. If you have irregular income, you need to plan for a lot more since you'll always have slow months with no income, or customers that don't pay or pay much later than you expected, and you have a lot of costs that employees don't (eg. you need to pay for your own hardware, office space, accountant, tax advisor, health care, pensions, unemployment insurance, etc).
  - kazinator 2y ago
    Are you including two kids and a retirement plan in the picture?
newaccount74 2y ago
That sounds somewhat feasible, but are there enough of those hackathons around? Can you take part in 20-50 hackathons a year? Most hackathons also require some kind of preparation, I doubt you can just show up, work for 15 hours, and collect $1000? I'd really love to hear from someone who is making a living from bounties or hackathons, because it just seems very hard or impossible to me.