4 ms·

Given that “fixing this issue required weeks of intensive work from multiple people”, the price would have to be prohibitively high. More generally, software i

by layer8 1y ago

Given that “fixing this issue required weeks of intensive work from multiple people”, the price would have to be prohibitively high. More generally, software is really, really expensive to produce and maintain. The economics only work at scale, in particular for B2C. (Maybe AI will change that, if it becomes more reliable.)

ffsm8 1y ago
Eh, I think you're underestimating some people perseverance. You generally only need multiple people for timely action, and it usually even slows you down (from the perspective of total hours spent) Like 2k bug bounty? I guarantee you some people would be willing to spend a lot of time for that. But yeah, people which are gainfully employed and have a decent salary - likely not.
- layer8 1y ago
  People will have fun spending their free time on such projects. But it’s virtually impossible to turn it into “an actual thriving business model” that people can make a living on.
  - rjdj377dhabsn 1y ago
    Why not? In much of the world, working on one of those a month would provide a comfortable living.
    - layer8 1y ago
      This $1900 bug bounty is quite an outlier, you generally won’t find one per month. An additional challenge is that it’s hard to predict how much work something will take, or whether there are any showstoppers. Also, if you don’t live in the same country as the client, it will be more difficult to get legal assurance that you’ll receive your money (or for the client that they won’t lose their money).
      - csin 1y ago
        You bought up a lot of points. And I think they are all negligible, compared to the gigantic elephant in the room. Which is, in order for some rando to fix the bug; a company would need to give access to their codebase to some rando. And they don't wanna do that.
- nightshift1 1y ago
  lt could become some sort of leetcode final boss and/or something that you can put on your resume.
TrainedMonkey 1y ago
For many large companies or even teams, there exists a class of bugs / issues / features where dropping 5-10k on a bounty is extremely cost efficient compared to working around the issue or internal development. That might not fund development outright, but at worst it would point out the features people want and serve to inform what to work on next. I think there are a couple reasons why that is not prevalent. Most important one is that highly compensated enterprise teams that would benefit the most from placing bounties tend to avoid software that is lacking features or has bugs. Secondary is not implemented here ego and general disconnect between people in the trenches that know what needs to be done and people controlling ability to place bounties. Imagine FAANG assigning $500 per engineer per year to allocate to feature / bug bounties.
- zozbot234 1y ago
  Most larger companies would probably find it way easier and more sensible to contract with some outside consultancy to work on these issues than just posting a random bounty, even if the latter might potentially be cheaper. See Google Summer of Code projects for a very practical example of how "just pay randos to work on issue X for cheap" can quite often end up in failure.
  - Avamander 1y ago
    > See Google Summer of Code projects for a very practical example of how "just pay randos to work on issue X for cheap" can quite often end up in failure. That potential for failure is there for any "subcontractors". I wonder if anyone has any stats on this.
  - BikiniPrince 1y ago
    Yes, when my org needed a very specific feature from an open source project the company reached out to the authors. I don’t know the terms, but they dropped a chunk of cash. No strings either on the new feature and everyone benefited in the end.
- jaredklewis 1y ago
  I’m confused. Bounties for security holes make sense because you don’t need to submit the patch, just find the hole. And bounties for open source (like in this case) also make sense because you have everything you need to submit a patch. But for everything else (like big tech, startups, and so on) bounties can’t fix bugs because even if I find a bug, how am I going to patch it without access to the source code? How can someone submit a patch to Netflix or whatever? IME your average SV startup has a long list of bugs they are aware of, but just haven’t gotten around to fixing because other priorities are in the way. But people can’t help patch unless you have an open development process. Am I missing something?
29athrowaway 1y ago
And also scarce skills.
wslh 1y ago
While you are completely correct about the bounty price, sometimes there are people who work deeply in the field and can solve those things relatively fast because they have already done similar things in the past.
- mbreese 1y ago
  Especially if you’re talking about a business who takes on these types of bounties routinely. I imagine you’d be able to build up a body of historical knowledge about fixing common issues. You could see how that could be a viable business model.

by layer8 1y ago

ffsm8 1y ago

Eh, I think you're underestimating some people perseverance. You generally only need multiple people for timely action, and it usually even slows you down (from the perspective of total hours spent) Like 2k bug bounty? I guarantee you some people would be willing to spend a lot of time for that. But yeah, people which are gainfully employed and have a decent salary - likely not.

layer8 1y ago
People will have fun spending their free time on such projects. But it’s virtually impossible to turn it into “an actual thriving business model” that people can make a living on.
- rjdj377dhabsn 1y ago
  Why not? In much of the world, working on one of those a month would provide a comfortable living.
  - layer8 1y ago
    This $1900 bug bounty is quite an outlier, you generally won’t find one per month. An additional challenge is that it’s hard to predict how much work something will take, or whether there are any showstoppers. Also, if you don’t live in the same country as the client, it will be more difficult to get legal assurance that you’ll receive your money (or for the client that they won’t lose their money).
    - csin 1y ago
      You bought up a lot of points. And I think they are all negligible, compared to the gigantic elephant in the room. Which is, in order for some rando to fix the bug; a company would need to give access to their codebase to some rando. And they don't wanna do that.
nightshift1 1y ago
lt could become some sort of leetcode final boss and/or something that you can put on your resume.

TrainedMonkey 1y ago

For many large companies or even teams, there exists a class of bugs / issues / features where dropping 5-10k on a bounty is extremely cost efficient compared to working around the issue or internal development. That might not fund development outright, but at worst it would point out the features people want and serve to inform what to work on next. I think there are a couple reasons why that is not prevalent. Most important one is that highly compensated enterprise teams that would benefit the most from placing bounties tend to avoid software that is lacking features or has bugs. Secondary is not implemented here ego and general disconnect between people in the trenches that know what needs to be done and people controlling ability to place bounties. Imagine FAANG assigning $500 per engineer per year to allocate to feature / bug bounties.

zozbot234 1y ago
Most larger companies would probably find it way easier and more sensible to contract with some outside consultancy to work on these issues than just posting a random bounty, even if the latter might potentially be cheaper. See Google Summer of Code projects for a very practical example of how "just pay randos to work on issue X for cheap" can quite often end up in failure.
- Avamander 1y ago
  > See Google Summer of Code projects for a very practical example of how "just pay randos to work on issue X for cheap" can quite often end up in failure. That potential for failure is there for any "subcontractors". I wonder if anyone has any stats on this.
- BikiniPrince 1y ago
  Yes, when my org needed a very specific feature from an open source project the company reached out to the authors. I don’t know the terms, but they dropped a chunk of cash. No strings either on the new feature and everyone benefited in the end.
jaredklewis 1y ago
I’m confused. Bounties for security holes make sense because you don’t need to submit the patch, just find the hole. And bounties for open source (like in this case) also make sense because you have everything you need to submit a patch. But for everything else (like big tech, startups, and so on) bounties can’t fix bugs because even if I find a bug, how am I going to patch it without access to the source code? How can someone submit a patch to Netflix or whatever? IME your average SV startup has a long list of bugs they are aware of, but just haven’t gotten around to fixing because other priorities are in the way. But people can’t help patch unless you have an open development process. Am I missing something?

29athrowaway 1y ago

And also scarce skills.

wslh 1y ago

While you are completely correct about the bounty price, sometimes there are people who work deeply in the field and can solve those things relatively fast because they have already done similar things in the past.

mbreese 1y ago
Especially if you’re talking about a business who takes on these types of bounties routinely. I imagine you’d be able to build up a body of historical knowledge about fixing common issues. You could see how that could be a viable business model.