6 ms·

Cool bug. Bug bounty money is pathetic.

by normie3000 10mo ago

FloorEgg 10mo ago
Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.
- tuesdaynight 10mo ago
  You are right, but that could (probably not) make them go for the bad route because they would get way more money that way. 4k for a bug that could take control of your customer account sounds disrespectful to me.
  - finghin 10mo ago
    Yeah, my read is that the teenage hacker confronted with this ridiculous payslip sees two ways forward: accept the pay cut for the CV benefit of working with bug bounties, or get a bit better at hiding your ass and make them really pay.
    - james_marks 10mo ago
      If I were 16, I’d be thinking I just made an obscene amount of money ($4,000!) messing with computers for fun, and got to meet people at a famous company. That’s a free car. Free computer. Uber eats for months. And my status with my peers as a hacker would be cemented. I get that bounty amounts are low vs SE salary, but that’s not at all how my 16yo self would see it.
      - finghin 10mo ago
        When I was sixteen I was already familiar with the concept of leverage. I’m not sure if I’d have had the cajones to use it though.
  - grenran 10mo ago
    Playing devils advocate but 4k is probably more money than most kids that age have seen in their life
- finghin 10mo ago
  I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.
  - ascorbic 10mo ago
    And this will help them land that six figure job
    - bbarn 10mo ago
      I mean, as a hiring manager, a fresh grad with multiple bug bounties tells me a lot about their drive and skill, so I'd agree. It's a great differentiator.
  - MeetingsBrowser 10mo ago
    > That's 1-2% of an annual SE salary for someone with similar skillset. I agree $4,000 is way too low, but a $400k salary is really high, especially for security work.
  - degamad 10mo ago
    > That's 1-2% of an annual SE salary for someone with similar skillset. So commensurate for approximately 2 days of work, a little high for two hours of work, and a little low for 8 days of work.
- yieldcrv 10mo ago
  market value is the same regardless, so this was pathetic
tuesdaynight 10mo ago
What is the reason for the low values? I would understand if it was a small company, but we are talking about Discord here.
- charlesabarnes 10mo ago
  Supply and demand. Selling via grey markets is an option, but many white hats don't go that route due to risk. There's plenty of people that will also find vulnerabilities without any money attached.
  - tptacek 10mo ago
    What "grey market" are you talking about? How specific can you be about it?
    - jfindper 10mo ago
      [flagged]
      - tptacek 10mo ago
        There absolutely is. I'm just not familiar with one that buys these vulnerabilities.
  - jijijijij 10mo ago
    That's a limited view. The damage this could cause should be accounted for. People don't have to sell shit, they could fuck things up just for the fun of it. That's something to consider, especially with a bunch of teenagers. Now, these big corpos didn't take the chance to sponsor and encourage these kids early careers and make this fuck-up good PR, at least.
    - Aachen 10mo ago
      That's not how economics works. I can't do my job without a computer or glasses but that doesn't mean I can pay the suppliers of these things most of my salary each. Preventing a 100k€ problem says almost nothing about what the payout should be. As for them just causing chaos for fun, that nets them just about nothing (what's an evening of fun worth, like what are you willing to pay for a cinema ticket?). This is certainly more (hundreds of times more) and so covers that risk as well
bytecauldron 10mo ago
I was going to ask. Isn't 4k from Discord pretty low for the work conducted here? I'm not familiar with bounty payouts. I'm hoping these companies aren't taking advantage of them.
- oxandonly 10mo ago
  4k is sadly discords highest bounty they give out (screenshot from their bugcrowd program: https://imgur.com/a/KNIdeXh https://imgur.com/a/KNIdeXh) even more critical issues then this one get paid the same amount out
some_guy_nobel 10mo ago
What do you expect? a16z-funded and they love to talk about how much they've raised, thought-leader style co-founders, etc.

Cool bug. Bug bounty money is pathetic.

FloorEgg 10mo ago

Supply and demand I guess. Pathetic for a senior SE but pretty awesome for a 16 year old up and coming hacker.

tuesdaynight 10mo ago
You are right, but that could (probably not) make them go for the bad route because they would get way more money that way. 4k for a bug that could take control of your customer account sounds disrespectful to me.
- finghin 10mo ago
  Yeah, my read is that the teenage hacker confronted with this ridiculous payslip sees two ways forward: accept the pay cut for the CV benefit of working with bug bounties, or get a bit better at hiding your ass and make them really pay.
  - james_marks 10mo ago
    If I were 16, I’d be thinking I just made an obscene amount of money ($4,000!) messing with computers for fun, and got to meet people at a famous company. That’s a free car. Free computer. Uber eats for months. And my status with my peers as a hacker would be cemented. I get that bounty amounts are low vs SE salary, but that’s not at all how my 16yo self would see it.
    - finghin 10mo ago
      When I was sixteen I was already familiar with the concept of leverage. I’m not sure if I’d have had the cajones to use it though.
- grenran 10mo ago
  Playing devils advocate but 4k is probably more money than most kids that age have seen in their life
finghin 10mo ago
I hope I'm not assuming too much but I'm really hope the up and coming hacker is smart enough to know that his work was worth more than $4,000. That's 1-2% of an annual SE salary for someone with similar skillset.
- ascorbic 10mo ago
  And this will help them land that six figure job
  - bbarn 10mo ago
    I mean, as a hiring manager, a fresh grad with multiple bug bounties tells me a lot about their drive and skill, so I'd agree. It's a great differentiator.
- MeetingsBrowser 10mo ago
  > That's 1-2% of an annual SE salary for someone with similar skillset. I agree $4,000 is way too low, but a $400k salary is really high, especially for security work.
- degamad 10mo ago
  > That's 1-2% of an annual SE salary for someone with similar skillset. So commensurate for approximately 2 days of work, a little high for two hours of work, and a little low for 8 days of work.
yieldcrv 10mo ago
market value is the same regardless, so this was pathetic

tuesdaynight 10mo ago

What is the reason for the low values? I would understand if it was a small company, but we are talking about Discord here.

charlesabarnes 10mo ago
Supply and demand. Selling via grey markets is an option, but many white hats don't go that route due to risk. There's plenty of people that will also find vulnerabilities without any money attached.
- tptacek 10mo ago
  What "grey market" are you talking about? How specific can you be about it?
  - jfindper 10mo ago
    [flagged]
    - tptacek 10mo ago
      There absolutely is. I'm just not familiar with one that buys these vulnerabilities.
- jijijijij 10mo ago
  That's a limited view. The damage this could cause should be accounted for. People don't have to sell shit, they could fuck things up just for the fun of it. That's something to consider, especially with a bunch of teenagers. Now, these big corpos didn't take the chance to sponsor and encourage these kids early careers and make this fuck-up good PR, at least.
  - Aachen 10mo ago
    That's not how economics works. I can't do my job without a computer or glasses but that doesn't mean I can pay the suppliers of these things most of my salary each. Preventing a 100k€ problem says almost nothing about what the payout should be. As for them just causing chaos for fun, that nets them just about nothing (what's an evening of fun worth, like what are you willing to pay for a cinema ticket?). This is certainly more (hundreds of times more) and so covers that risk as well

bytecauldron 10mo ago

I was going to ask. Isn't 4k from Discord pretty low for the work conducted here? I'm not familiar with bounty payouts. I'm hoping these companies aren't taking advantage of them.

oxandonly 10mo ago
4k is sadly discords highest bounty they give out (screenshot from their bugcrowd program: https://imgur.com/a/KNIdeXh https://imgur.com/a/KNIdeXh) even more critical issues then this one get paid the same amount out

some_guy_nobel 10mo ago

What do you expect? a16z-funded and they love to talk about how much they've raised, thought-leader style co-founders, etc.