5 ms·

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I

I always wonder if there is anyone making a living of bounties? I've once considered it, but the public bounties that I could find were so laughably low that I just saw no way to make it work. <$500 for a bug that would take at least a week to fix? I guess it's a nice tip if you were going to work on it anyway, but it makes no sense for me to schedule time to work on that bounty when pretty much any other job would pay 5 - 10 times as much. I guess it could work if there were a lot of bounties for a project that you are familiar with, so that you can fix them quickly, but there are so few bounties available that you probably have nothing to do after a week or so.

bashwizard 2y ago
I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.
- langsoul-com 2y ago
  How is it possible to make that much though? Is it like a private bounty board or something?
  - jpgvm 2y ago
    Big money like that is only made one way, security vulns in "software or hardware of interest", sold via brokers to 3 letter agencies (or much less scrupulous actors from time to time).
- ptsneves 2y ago
  This sounds like they are a known figure in the project and are offered consultancy jobs. When I had a company that is what I did when I needed something fixed. It was not cheap either. The point being yes it is possible but it is not a bounty board like in the city town hall. Anyway I find it a bit weird the topic is asked at all. Why didn’t the OP just cold contacted committers?
- newaccount74 2y ago
  Can you elaborate? Who are these people? What kind of bounties do these people go after? Do they work on lots of small bounties or focus on a few big bounties? Do you personally know these people or are you just talking about the security researchers who discovered high impact issues in iOS?
  - bashwizard 2y ago
    I know some of them in person as I'm involved in the bug bounty scene myself. What they work on varies depending on skill set and interest. I do not personally know any security researchers with high impact vulnerabilites in iOS but those people get paid millions and you'll never hear about them. What I do know is that they tend to sell their exploits through exploit brokers like Zerodium.
- andruby 2y ago
  Are you talking about fixing known bugs, or a "security bug bounty" where they are paid to report unknown security issues?
  - bashwizard 2y ago
    Security related vulnerabilities.
    - andruby 2y ago
      That’s very different than what the OP question is about. Both are called “bounties” though. One is getting paid to write code that fixes bugs or adds functionality to open source projects. (Pays very little and we suspect nobody makes a living from) The other is doing security research and reporting on vulnerabilities. Here typically no fix is provided. You are paid for the discovery. Plenty of good researchers make a living on these security bounties
k__ 2y ago
Depends on what you call "a living". You probably won't get rich from doing $500 bug bounties. But there are hackathons with bounties in the $1000-$10000 range. Do 2-4 of those per month and you're good.
- kazinator 2y ago
  You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.
  - manuelmoreale 2y ago
    2 or 4 1k a month puts you either above or way above average salary here in Italy.
    - Suppafly 2y ago
      You have to compare it to being a self employed business owner instead of to a salary from a job. Half of it is going to go to taxes.
      - manuelmoreale 2y ago
        Self employed since 2011. In Italy. I know how this world works. If you get 2 to 4K a month you can easily live an absolutely normal life or even above average.
        Suppafly 2y ago
        I suppose it depends on how you are defining normal. Does that mean owning a home and vehicle and supporting a wife and kids, or does that mean sharing an apartment with multiple people and using public transport and not having any savings? I get that the cost of living is lower in Italy, but different people have different ideas about what constitutes comfortable. Just from googling, the 2k seems like it'd be a bit of a struggle but the 4k seems like it'd be pretty nice.
SOLAR_FIELDS 2y ago
I helped out running a bug bounty program for a company whose large offering was a FOSS product a couple of years ago. Most of the people participating were either in very LCOL countries like Thailand or Montenegro, or were bored C level/founder people who would use the tiny amount of money as an incentive to keep their coding skills sharp since their day to day no longer involved coding.
r3db34rd 2y ago
I spent a decade or so living life off of bug bounties. Smart Contracts are the only way to go these days.

bashwizard 2y ago

I know many people making a very good living from bounties (>$500k/year). If you're good, you'll make bank. If not - don't quit your day job.

langsoul-com 2y ago
How is it possible to make that much though? Is it like a private bounty board or something?
- jpgvm 2y ago
  Big money like that is only made one way, security vulns in "software or hardware of interest", sold via brokers to 3 letter agencies (or much less scrupulous actors from time to time).
ptsneves 2y ago
This sounds like they are a known figure in the project and are offered consultancy jobs. When I had a company that is what I did when I needed something fixed. It was not cheap either. The point being yes it is possible but it is not a bounty board like in the city town hall. Anyway I find it a bit weird the topic is asked at all. Why didn’t the OP just cold contacted committers?
newaccount74 2y ago
Can you elaborate? Who are these people? What kind of bounties do these people go after? Do they work on lots of small bounties or focus on a few big bounties? Do you personally know these people or are you just talking about the security researchers who discovered high impact issues in iOS?
- bashwizard 2y ago
  I know some of them in person as I'm involved in the bug bounty scene myself. What they work on varies depending on skill set and interest. I do not personally know any security researchers with high impact vulnerabilites in iOS but those people get paid millions and you'll never hear about them. What I do know is that they tend to sell their exploits through exploit brokers like Zerodium.
andruby 2y ago
Are you talking about fixing known bugs, or a "security bug bounty" where they are paid to report unknown security issues?
- bashwizard 2y ago
  Security related vulnerabilities.
  - andruby 2y ago
    That’s very different than what the OP question is about. Both are called “bounties” though. One is getting paid to write code that fixes bugs or adds functionality to open source projects. (Pays very little and we suspect nobody makes a living from) The other is doing security research and reporting on vulnerabilities. Here typically no fix is provided. You are paid for the discovery. Plenty of good researchers make a living on these security bounties

k__ 2y ago

Depends on what you call "a living". You probably won't get rich from doing $500 bug bounties. But there are hackathons with bounties in the $1000-$10000 range. Do 2-4 of those per month and you're good.

kazinator 2y ago
You're not good if they are very close to the bottom of your range. Unless you live in a hut in Thailand or something.
- manuelmoreale 2y ago
  2 or 4 1k a month puts you either above or way above average salary here in Italy.
  - Suppafly 2y ago
    You have to compare it to being a self employed business owner instead of to a salary from a job. Half of it is going to go to taxes.
    - manuelmoreale 2y ago
      Self employed since 2011. In Italy. I know how this world works. If you get 2 to 4K a month you can easily live an absolutely normal life or even above average.
      - Suppafly 2y ago
        I suppose it depends on how you are defining normal. Does that mean owning a home and vehicle and supporting a wife and kids, or does that mean sharing an apartment with multiple people and using public transport and not having any savings? I get that the cost of living is lower in Italy, but different people have different ideas about what constitutes comfortable. Just from googling, the 2k seems like it'd be a bit of a struggle but the 4k seems like it'd be pretty nice.

SOLAR_FIELDS 2y ago

I helped out running a bug bounty program for a company whose large offering was a FOSS product a couple of years ago. Most of the people participating were either in very LCOL countries like Thailand or Montenegro, or were bored C level/founder people who would use the tiny amount of money as an incentive to keep their coding skills sharp since their day to day no longer involved coding.

r3db34rd 2y ago

I spent a decade or so living life off of bug bounties. Smart Contracts are the only way to go these days.