3 ms·

Some level of submission difficulty makes sense to keep the garbage submissions at bay but that seems a bit over the top? Can't imagine it makes a big differen

by Havoc 1y ago

Some level of submission difficulty makes sense to keep the garbage submissions at bay but that seems a bit over the top? Can't imagine it makes a big difference to them whether google pays out 50k or 2x 50k for high quality bugs relevant to their company

jameshart 1y ago
Right? This gives the impression that there might be people out there who have developed valid attacks but who are holding back from revealing them because they haven’t optimized their strategy to ensure they can win the CTF race. This seems like a perverse incentive creating suboptimal behavior.
- Retr0id 1y ago
  That's why they removed it.
  - markasoftware 1y ago
    no it's not. Google still has a long time between each submission cycle, and people are still holding back their exploits in the hope they'll win the next one. It's just a matter of luck now, rather than a matter of optimizing PoW.
  - jameshart 1y ago
    Still a race though. So you can’t rig it by optimizing your proof of work implementation, people are still going to look for an edge. These are CTF experts, exploiting systems is what they do.
deleted 1y ago
[deleted]
bee_rider 1y ago
At the beginning of the post, they note a default implementation that uses some Google library. So maybe the assumption (which worked out for a while?) was that nobody would bother doing the “over the top” thing and try to beat Google’s library? One option could be to just open up, like, 10 slots instead, right? Most folks might use this implementation (since it has been posted anyway). That way coming second place in the race isn’t so bad…
- internetter 1y ago
  I honestly don't see why there shouldn't be infinite slots. Google has the money. Right now they've created a backlog of an unknowable number of exploits, sequentually being submitted one by one. It is possible the backlog grows faster than it is emptied. If they let them all through at once, there would be an upfront cost but it wouldn't be like that every time, and the pace at which explitable bugs are fixed increases. The only restriction should be that the first submission of a given bug is the one that gets the reward.
overfeed 1y ago
> Can't imagine it makes a big difference to them whether google pays out 50k or 2x 50k for high quality bugs You're brushing over important implemention details - it's not Google running this program but a specific team inside the company that has a fixed budget, a limited headcount and doing the best with what they have. Your argument is similar to "America has trillions in GDP and could afford to provide twice the number of free treatments to kids with cancer" - it sounds reasonable in aggregate, but breaks down in the specifics; the individual hospital systems, teams and care providers are currently working close to their limits.
- Havoc 1y ago
  I wasn't brushing over anything - just didn't know that. idk how google internal finances work...

by Havoc 1y ago

jameshart 1y ago

Right? This gives the impression that there might be people out there who have developed valid attacks but who are holding back from revealing them because they haven’t optimized their strategy to ensure they can win the CTF race. This seems like a perverse incentive creating suboptimal behavior.

Retr0id 1y ago
That's why they removed it.
- markasoftware 1y ago
  no it's not. Google still has a long time between each submission cycle, and people are still holding back their exploits in the hope they'll win the next one. It's just a matter of luck now, rather than a matter of optimizing PoW.
- jameshart 1y ago
  Still a race though. So you can’t rig it by optimizing your proof of work implementation, people are still going to look for an edge. These are CTF experts, exploiting systems is what they do.

deleted 1y ago

[deleted]

bee_rider 1y ago

At the beginning of the post, they note a default implementation that uses some Google library. So maybe the assumption (which worked out for a while?) was that nobody would bother doing the “over the top” thing and try to beat Google’s library? One option could be to just open up, like, 10 slots instead, right? Most folks might use this implementation (since it has been posted anyway). That way coming second place in the race isn’t so bad…

internetter 1y ago
I honestly don't see why there shouldn't be infinite slots. Google has the money. Right now they've created a backlog of an unknowable number of exploits, sequentually being submitted one by one. It is possible the backlog grows faster than it is emptied. If they let them all through at once, there would be an upfront cost but it wouldn't be like that every time, and the pace at which explitable bugs are fixed increases. The only restriction should be that the first submission of a given bug is the one that gets the reward.

overfeed 1y ago

> Can't imagine it makes a big difference to them whether google pays out 50k or 2x 50k for high quality bugs You're brushing over important implemention details - it's not Google running this program but a specific team inside the company that has a fixed budget, a limited headcount and doing the best with what they have. Your argument is similar to "America has trillions in GDP and could afford to provide twice the number of free treatments to kids with cancer" - it sounds reasonable in aggregate, but breaks down in the specifics; the individual hospital systems, teams and care providers are currently working close to their limits.

Havoc 1y ago
I wasn't brushing over anything - just didn't know that. idk how google internal finances work...