5 ms·

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chr

by dig1 1y ago

Sandbox escape with high-quality report in Chrome: $250k [1], yet Mozilla will offer you $20k [2] for that... [1] https://bughunters.google.com/about/rules/chrome-friends/5745167867576320/chrome-vulnerability-reward-program-rules#memory-corruption-vulnerabilities https://bughunters.google.com/about/rules/chrome-friends/574... [2] https://www.mozilla.org/en-US/security/client-bug-bounty/ https://www.mozilla.org/en-US/security/client-bug-bounty/

mosselman 1y ago
Have you looked at the financial health of the one company vs the other? I am pretty sure Google is making more than 10x the money Mozilla is making.
MrGilbert 1y ago
According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percentage.
- FirmwareBurner 1y ago
  >According to Wikipedia, that's 0.0012% of their net income. How much of the Mozilla foundation's income goes into product development nowadays?
  - MrGilbert 1y ago
    260 Mio. USD, as answered by the linked article, though the numbers only go up to 2023. So "nowadays" is a bit of a stretch.
  - Ray20 1y ago
    Do you imply that it's not 5x, but 500x of what Google pays? /s
- deleted 1y ago
  [deleted]
- morpheuskafka 1y ago
  But Chrome is paying more as a percentage of their browser units' income, no? Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free, for competitors via Project Zero.
  - victorbjorklund 1y ago
    The browser totally has zero to do with google ads. Totally no connection at all.
    - alxeder 1y ago
      the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.
      - deleted 1y ago
        [deleted]
      - Arnt 1y ago
        People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/ https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.
        Rohansi 1y ago
        Don't forget about YouTube!
- fny 1y ago
  Do you pay a software engineer for their time based on your revenue or his skill?
  - tossandthrow 1y ago
    Mostly based on revenue - or at least that is the way we are going. That is why you see equivalent skill levels being paid differently in big tech compared to other places. And why you see millions in salaries at some big techs Ai hiring.
    - ponector 1y ago
      Not at all. Corporation always pays as little as possible. Unless we are talking about CEO levels...
  - yaseer 1y ago
    Both - these are the two sides of the market, aka supply and demand.
  - LauraMedia 1y ago
    If you don't have the revenue, you don't pay them at all, because you don't actually employ them. It's really no secret that higher revenue means higher potential pay/more devs...
  - ndr 1y ago
    Be somewhat competitive to what such developers could get on the black market. Discounting the ethics. Surely a bug on Chrome is worth more than a bug on Firefox.
    - UncleMeat 1y ago
      Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?
      - fkyoureadthedoc 1y ago
- woadwarrior01 1y ago
  If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168 https://news.ycombinator.com/item?id=24132168
  - exizt88 1y ago
    Is their CEO comp not in line with the market?
    - deleted 1y ago
      [deleted]
    - Almondsetat 1y ago
      Are Mozilla's earning in line with the market?
      - deleted 1y ago
        [deleted]
    - ToucanLoucan 1y ago
      That's a bad rubric to judge by, in this case. CEO pay is at a historic high, in fact I'm pretty sure the last time the gap in wage between median workers and CEOs was this high was the roaring 20's, which famously went quite well for the economy.
    - amiga386 1y ago
      No. More than 80% of Mozilla Corp's income is a yearly payment from Google. [0] The payment will stop immediately if Google thinks it's no longer needed, or if federal prosecutors (who have determined this payment is illegal) decide the remedy is to stop the payment. [1] The CEO's job is simple. Say "I think we should take Google's money again this year", and then pocket several million of it. Ca-ching! What are your plans for post-Google-money? Uh uh... AI? Sell out our users to advertisers? [2] It's not looking good. The Firefox market share continues to dwindle. The board continues to hob-nob with San Francisco socialites and "activists" and use Mozilla as a piggybank to fund their chums. [edit: removed line about Mitchell Baker as she does seem to have finally left] [0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances [1] https://www.bloomberg.com/news/articles/2024-08-05/google-loses-doj-antitrust-suit-over-search https://www.bloomberg.com/news/articles/2024-08-05/google-lo... [2] https://news.ycombinator.com/item?id=43185909 https://news.ycombinator.com/item?id=43185909
rvz 1y ago
Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.
- markdown 1y ago
  > Tells you who is more serious about security. Yup, clearly Mozilla. $250k is loose change for Google.
- perching_aix 1y ago
  Really doesn't tell me piss all, as I'm not privy to their respective overall cash flow. Are you, considering you say it does for you? Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously, by the way? Sounds a bit backwards to me.
  - rvz 1y ago
    What I call backwards is Mozilla paying their executives multi-millions of dollars for failure and the decline of Firefox. Maybe had they ran the company competently, they could to afford to pay their engineers and offer larger bounties instead. > Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously. Many such researchers would rather sell their 0day to the black market if the effort + price offered is too low and not worth it. It is up to the vendor (Mozilla) to set a fair price to prevent that exploit from reaching the black market for a much higher price. So given all the above, Mozilla is not serious.
- tossandthrow 1y ago
  Just like you personally obviously don't care about your personal security when you do not pay a team of body guards 250k a year.
camdroidw 1y ago
* Compare income * Compare market share * Compare market share normalised by likelihood of attack yielding benefit, in short-- fx users would be power users probably more likely to have other ways to mitigate an attack * Or basically just compare black market prices which already taken the above 3 into account
xbmcuser 1y ago
Chrome has 15-20 times the users that firefox in the blackmarket the bug would sell for similar ratio. Safari might go for more as it has more rich and tech security illiterate users.
- catsma21 1y ago
  disagree. more marketshare does not mean juicier targets, which, in this case, would be tor users. in addition, you don't buy an exploit to use it en masse, that would get it burned really quickly
  - tptacek 1y ago
    More market share does in fact impact availability of targets, but in the case of Firefox it's just as much a factor that there are more bugs and exploits floating around.
tptacek 1y ago
The grey market also offers much less for Firefox vulnerabilities, for reasons of both supply and of demand.
jancsika 1y ago
It'd be fun to do a sketch that's a montage of an array of HN armchair quarterbacks rolling up their sleeves and taking short-lived shots at CEO for Mozilla. Marching into the home office, kicking butt, and pointing at the whiteboard for their favorite pet project: * Mozilla focusing on privacy * Mozilla focusing on web standards * Mozilla focusing on speed * Mozilla (apparently, here) focusing on maximizing the size of payouts for bug bounties Inspiring, Rocky-style music plays in the background. In the foreground, a red line continuously traces slowly downward, with no perceivable relationship to the scenes in the montage.

by dig1 1y ago

mosselman 1y ago

Have you looked at the financial health of the one company vs the other? I am pretty sure Google is making more than 10x the money Mozilla is making.

MrGilbert 1y ago

According to Wikipedia, that's 0.012% of their net income. [0] While I'm being told in the comments that this is not the way to look at it, it means that this is, percentage wise, 50x the amount that Google is paying. Sounds fine to me. [0]: https://en.wikipedia.org/wiki/Mozilla_Corporation https://en.wikipedia.org/wiki/Mozilla_Corporation //Edit: Had a typo in my percentage. 20.000 of 157.000.000 is, indeed, 0.012% - that makes it 50x the amount of Google's percentage.

FirmwareBurner 1y ago
>According to Wikipedia, that's 0.0012% of their net income. How much of the Mozilla foundation's income goes into product development nowadays?
- MrGilbert 1y ago
  260 Mio. USD, as answered by the linked article, though the numbers only go up to 2023. So "nowadays" is a bit of a stretch.
- Ray20 1y ago
  Do you imply that it's not 5x, but 500x of what Google pays? /s
deleted 1y ago
[deleted]
morpheuskafka 1y ago
But Chrome is paying more as a percentage of their browser units' income, no? Virtually all of Mozilla's income comes from the browser (via the Google search agreement). The vast majority of Google's revenue comes from ad revenue on search, YouTube, and Adsense. Not from Chrome directly. So they had less incentive to reward its security, but did so anyway. And they also do some of the best work in the industry, free, for competitors via Project Zero.
- victorbjorklund 1y ago
  The browser totally has zero to do with google ads. Totally no connection at all.
  - alxeder 1y ago
    the browser did limit the capabilities of adblockers quite drastically lately, but this is surly a coincidence.
    - deleted 1y ago
      [deleted]
    - Arnt 1y ago
      People keep saying that. There are two problems with that, namely ① Google's own ads are easy to block using the new API and ② the new API is effective at blocking various evil attacks. If Google wanted to get rid of ad blockers, I'm sure they could come up with an API that does a better job than that. https://textslashplain.com/2024/10/13/content-blocking-in-manifest-v3/ https://textslashplain.com/2024/10/13/content-blocking-in-ma... shows a ten-line ad blocker that blocks Google's ads, https://github.com/extesy/hoverzoom/discussions/670 https://github.com/extesy/hoverzoom/discussions/670 is a list of polite email messages from people who'd like to have elevated access to browsers.
      - Rohansi 1y ago
        Don't forget about YouTube!
fny 1y ago
Do you pay a software engineer for their time based on your revenue or his skill?
- tossandthrow 1y ago
  Mostly based on revenue - or at least that is the way we are going. That is why you see equivalent skill levels being paid differently in big tech compared to other places. And why you see millions in salaries at some big techs Ai hiring.
  - ponector 1y ago
    Not at all. Corporation always pays as little as possible. Unless we are talking about CEO levels...
- yaseer 1y ago
  Both - these are the two sides of the market, aka supply and demand.
- LauraMedia 1y ago
  If you don't have the revenue, you don't pay them at all, because you don't actually employ them. It's really no secret that higher revenue means higher potential pay/more devs...
- ndr 1y ago
  Be somewhat competitive to what such developers could get on the black market. Discounting the ethics. Surely a bug on Chrome is worth more than a bug on Firefox.
  - UncleMeat 1y ago
    Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?
    - fkyoureadthedoc 1y ago
woadwarrior01 1y ago
If only they'd use a similar rubric to rein in their CEO comp[1]. [1]: https://news.ycombinator.com/item?id=24132168 https://news.ycombinator.com/item?id=24132168
- exizt88 1y ago
  Is their CEO comp not in line with the market?
  - deleted 1y ago
    [deleted]
  - Almondsetat 1y ago
    Are Mozilla's earning in line with the market?
    - deleted 1y ago
      [deleted]
  - ToucanLoucan 1y ago
    That's a bad rubric to judge by, in this case. CEO pay is at a historic high, in fact I'm pretty sure the last time the gap in wage between median workers and CEOs was this high was the roaring 20's, which famously went quite well for the economy.
  - amiga386 1y ago
    No. More than 80% of Mozilla Corp's income is a yearly payment from Google. [0] The payment will stop immediately if Google thinks it's no longer needed, or if federal prosecutors (who have determined this payment is illegal) decide the remedy is to stop the payment. [1] The CEO's job is simple. Say "I think we should take Google's money again this year", and then pocket several million of it. Ca-ching! What are your plans for post-Google-money? Uh uh... AI? Sell out our users to advertisers? [2] It's not looking good. The Firefox market share continues to dwindle. The board continues to hob-nob with San Francisco socialites and "activists" and use Mozilla as a piggybank to fund their chums. [edit: removed line about Mitchell Baker as she does seem to have finally left] [0] https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances [1] https://www.bloomberg.com/news/articles/2024-08-05/google-loses-doj-antitrust-suit-over-search https://www.bloomberg.com/news/articles/2024-08-05/google-lo... [2] https://news.ycombinator.com/item?id=43185909 https://news.ycombinator.com/item?id=43185909

rvz 1y ago

Tells you who is more serious about security. A quarter of $1M is a fair price for this type of bug. Won't complain about that.

markdown 1y ago
> Tells you who is more serious about security. Yup, clearly Mozilla. $250k is loose change for Google.
perching_aix 1y ago
Really doesn't tell me piss all, as I'm not privy to their respective overall cash flow. Are you, considering you say it does for you? Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously, by the way? Sounds a bit backwards to me.
- rvz 1y ago
  What I call backwards is Mozilla paying their executives multi-millions of dollars for failure and the decline of Firefox. Maybe had they ran the company competently, they could to afford to pay their engineers and offer larger bounties instead. > Is monetary expenditure on vulnerability payouts really the primary determinent of who's taking security more seriously. Many such researchers would rather sell their 0day to the black market if the effort + price offered is too low and not worth it. It is up to the vendor (Mozilla) to set a fair price to prevent that exploit from reaching the black market for a much higher price. So given all the above, Mozilla is not serious.
tossandthrow 1y ago
Just like you personally obviously don't care about your personal security when you do not pay a team of body guards 250k a year.

camdroidw 1y ago

* Compare income * Compare market share * Compare market share normalised by likelihood of attack yielding benefit, in short-- fx users would be power users probably more likely to have other ways to mitigate an attack * Or basically just compare black market prices which already taken the above 3 into account

xbmcuser 1y ago

Chrome has 15-20 times the users that firefox in the blackmarket the bug would sell for similar ratio. Safari might go for more as it has more rich and tech security illiterate users.

catsma21 1y ago
disagree. more marketshare does not mean juicier targets, which, in this case, would be tor users. in addition, you don't buy an exploit to use it en masse, that would get it burned really quickly
- tptacek 1y ago
  More market share does in fact impact availability of targets, but in the case of Firefox it's just as much a factor that there are more bugs and exploits floating around.

tptacek 1y ago

The grey market also offers much less for Firefox vulnerabilities, for reasons of both supply and of demand.

jancsika 1y ago

It'd be fun to do a sketch that's a montage of an array of HN armchair quarterbacks rolling up their sleeves and taking short-lived shots at CEO for Mozilla. Marching into the home office, kicking butt, and pointing at the whiteboard for their favorite pet project: * Mozilla focusing on privacy * Mozilla focusing on web standards * Mozilla focusing on speed * Mozilla (apparently, here) focusing on maximizing the size of payouts for bug bounties Inspiring, Rocky-style music plays in the background. In the foreground, a red line continuously traces slowly downward, with no perceivable relationship to the scenes in the montage.