13 ms·
Microsoft pays $100K bounty to hacker
- kilovoltaire 13y ago"Internet Explorer, ... the world’s most popular browser" That's no longer true, right?
- jamesaguilar 13y agoThe browser formerly known as the world's most popular browser. http://www.w3schools.com/browsers/browsers_stats.asp http://www.w3schools.com/browsers/browsers_stats.asp http://gs.statcounter.com/ http://gs.statcounter.com/ I'm honestly quite amazed. When Chrome first came out, I remember asking my teammates why we were wasting money on developing a browser, thinking it would never be more than a niche product. Another reason why I'm not Google's CEO, apparently.
- mrb 13y agoI like your humility! If only more HN users could be more humble like this.
- welly 13y agoI'm not very good at many things.
- mjolk 13y agoW3Schools is hardly a good reference for anything, but they even tell you why you shouldn't take these stats and extrapolate/generalize. >From the statistics below (collected from W3Schools' log-files over a period of ten years), you can read the long term trends of browser usage. These are the browsers that hit W3Schools, a site for people that need quick reference when making webpages, not across the internet.
- filestar 13y agoStatcounter measures the amount of browsing, not unique people. Netmarketshare attempts to measure the latter and shows IE on top. http://www.netmarketshare.com/browser-market-share.aspx?qprid=1 http://www.netmarketshare.com/browser-market-share.aspx?qpri... So it depends on what your definition of "popular browser" is. Is it the browser that's used by most people? That would be IE. Is it the browser that most browsing happens? That would be Chrome. Of course, this is ignoring the fact that both Statcounter and Netmarketshare are not perfect and don't cover all or even most sites' logs. As others have noted, W3schools only measures hits to the W3Schools site, which is not even close to be being representative of the web.
- jamesaguilar 13y agoTo be honest, I mostly wanted to comment to share my anecdote and make a Prince reference. I'm not really trying to make an argument one way or another for browser popularity. BTW, I personally think the browsing-time metric is better than unique-users, because applying the latter metric to music would have had Rebecca Black as the most popular artist of 2011. Which conclusion, though true under some definitions, might not be quite as useful as other possible conclusions.
- victorf 13y agoAfter I read that she donated the money from her YouTube to a charity to help Japan, she became my favorite pop artist of 2011. I do concede that you're right in general.
- rogerbinns 13y agoThink strategically. It doesn't really matter what the user base of Chrome or Android are. What they do is raise the bar. Competitors and alternatives need to be at least that good. Javascript performance was pretty dismal until Chrome came around, and then everyone had to up their game. Until Android, mobile platforms were tightly controlled walled gardens (although Windows Mobile was amongst the least worse). Now everyone wants Google Mail, Maps and Search on their mobile devices. Google ultimately makes money through usage and the platform + apps/browser don't matter that much financially. Without Chrome and Android, there is a strong possibility of being cut out completely.
- jamesaguilar 13y agoI mean, I know that now.
- mgkimsal 13y ago" It doesn't really matter what the user base of Chrome or Android are. What they do is raise the bar. Competitors and alternatives need to be at least that good." Yes it does matter, at least some. No one even knows what the bar is if no one is using it. Someone could put together a wickedly fast browser with fantastic privacy controls, release it tomorrow, but if no one used it, it wouldn't have any effect on major browser makers. JS performance went up in other browsers due to Chrome only because Chrome was gaining users (even if the base was small at first), mostly because they were able to push Chrome from Google.com itself.
- pippy 13y agoI wonder why MSIE has made a comeback in the last two months. a 4% increase is quite a lot. As a web developer I hope the trend does not continue.
- Semaphor 13y ago10 (and afaik 11) are good browsers, I can't complain about them. I have yet to fix anything specifically in 10.
- magicalist 13y agoyes, and automatic browser updates by default is a great new change as well for IE (unfortunately nothing for people sticking to their XP, though)
- pippy 13y agoMSIE is still lagging far behind in HTML5 standards: http://html5test.com/results/desktop.html http://html5test.com/results/desktop.html While MSIE may be 'good' browser (tastes may vary, I find the UI horrible) it's damaging to the web ecosystem to have MSIE leading the marketshare. It's advantageous for Microsoft to limit new features and keep interoperability between browsers low. As a result the entire web using public loses out on having new features and having a broader choice. Chrome and Firefox are built on open source software, so when an issue occurs you can participate in the process of it being fixed.
- sequence7 13y agohtml5test.com is a test of HTML 5 in the same way that w3schools.com is a school for the w3c. Just take a look at their FAQ http://html5test.com/about.html http://html5test.com/about.html and you can almost instantly dismiss their scoring system. Chrome and Firefox are awesome though.
- logical42 13y agonotorious != popular
- dangrossman 13y agoIt's the second most used by a few percentage points, and in recent months trends have actually reversed -- Chrome is losing share and Internet Explorer is gaining. http://www.w3counter.com/trends http://www.w3counter.com/trends (The bump in the Safari line was the inclusion of Mobile Safari in the Safari share statistic)
- atwebb 13y agoI haven't been able to get Chrome stable in the past month or two and gave up and went back to FF after trying a few different things. I've missed my old buddy Firefox, he's grown up a lot.
- farnsworth 13y agoDo you know why that is? It looks clear from multiple sources that people must be switching from Chrome/FF to IE.
- nl 13y agoPossibly people switching to Windows 8 and trying out IE.
- philliphaydon 13y agoGood on MS for paying out such a large bounty.
- jbrooksuk 13y agoIt must mean a lot to them.
- kamjam 13y agoIt will also hopefully help more people to responsibly disclose vulnerabilities, rather than selling them on the black market. A pat on the back is nice, but nothing says thank you like cold, hard cash!
- rmc 13y agoThat's one of the points of bug bounty programmes, isn't it?
- kamjam 13y agoSure. But when the amount is small/trivial, you simply give credit to to the finder or you send them a t-shirt, you may then be tempted to find alternatives to get a cash incentive.
- rmc 13y agoYep, that's exactly my point. Bug Bounties are supposed to be realistic alternatives to the black market.
- Moral_ 13y agoThis is a huge payout. It's my assumption for such a big payout this security researcher was able to develop or extend upon some of the advanced exploitation techniques we see today. I think, for such a huge payout, and for what they said they would pay this amount for is a _new_ tactic to defeat Microsoft's DEP[0] ASLR[1] and ROP[2]. All of these defence mechanisms have been broken before, but as I mentioned Mr. Forshaw has probably developed a novel new technique to defeat these checks. Lastly, and probably least likely, I know academia and MS Research have been working on ways to sandbox applications. It's possible he has developed a way to break out of the sandboxes. All of this is speculation, I hope soon we will have access to what he was able to accomplish. [0] http://en.wikipedia.org/wiki/W%5EX http://en.wikipedia.org/wiki/W%5EX [1] http://en.wikipedia.org/wiki/ASLR http://en.wikipedia.org/wiki/ASLR [2] http://krebsonsecurity.com/tag/enhanced-mitigation-experience-toolkit/ http://krebsonsecurity.com/tag/enhanced-mitigation-experienc...
- j_s 13y agoa new “exploitation technique” in Windows, which will allow it to develop defenses against an entire class of attacks - the OP new mitigation bypass technique - http://www.contextis.co.uk/news/congratulations-james-forshaw/ http://www.contextis.co.uk/news/congratulations-james-forsha... - http://blogs.technet.com/b/bluehat/archive/2013/10/08/congratulations-to-james-forshaw-recipient-of-our-first-100-000-bounty-for-new-mitigation-bypass-techniques.aspx http://blogs.technet.com/b/bluehat/archive/2013/10/08/congra...
- rowofpixels 13y agoYou could buy a lot of microsoft t-shirts with that much money.
- lutusp 13y agoThe title of this submission: "Microsoft pays $100K bounty to hacker" The title of the article: "Microsoft Corp pays US$100K bounty to hacking expert who uncovered Windows bug that could have been used to launch remote attacks" To me, this level of editorializing approaches arbitrarily close to lying.
- solox3 13y agoIt is probably not intentional. Had it been intentional: Microsoft pays US$100K to hacking expert to launch remote attacks
- Maven911 13y agoYeah not intentional, wrote it out to have a easier to read title
- kissickas 13y agoMaybe if you're living in a vacuum or it's your first time on HN, but I think most readers here would automatically jump to the conclusion that he uncovered a bug. What we need on HN is LESS editing of link titles, in my opinion.
- zheng 13y agoHow exactly is it lying? Microsoft did pay a $100k bounty to a hacker. The HN headline just leaves out extra details (what the bounty was for), but doesn't change the meaning at all. Am I missing something?
- sergiotapia 13y agoHow's this: Guy predicts the higgs boson particle. World renowned physicist Foo Bar, accurantly models existance of boson particle. --- See the difference? The title is BS. I expected a guy from Pakistan or somewhere third world finding the bug.
- freehunter 13y ago
- tptacek 13y agoThat is not actually the origin of the term "zero day"; "zero day" is a tongue-in-cheek #hack expropriation of #warez jargon, where "zero days" refers to the number of days from the official release date of a piece of pirated software.
- JonnieCache 13y agoI thought it referred to the time elapsed between the pirated release being made, and your having access to it. How high up the chain you are. Hence the inevitable escalation to 0hour, 0sec as bandwidth increased over the years.
- Semaphor 13y agoThe time of your access doesn't matter.
- nikcub 13y agohow I remember it, crackers used the term before the warez groups did. it meant having a crack for software on the same day it was released. in warez it was a folder on the ftp server that would list all the latest releases from that day, to save you from navigating all the /pub/whatever folders over your slow 14.4k connection and so that the distributors would only have to grab from one place. and somehow in this history the pronunciation changed from "oh day" to "zero day" and was re-appropriated as an infosec term. edit: just read the definition in OP, it is hilarious.
- tptacek 13y agoI mean, it carries the implication of not giving vendors time to fix, in a way, but that's not at all what it means. There are plenty of zero days vendors know about but haven't patched yet.
- pkinsky 13y agoThose are like advance copies of movies, distributed by media production houses to a select few before any public release.
- maxjus 13y agoHere's a story you guys might appreciate. I found a cross site scripting vulnerability in Bing.com that was kind of hilarious. Searching for: </script><script>arbitrary js</script> in the main search box would execute the code on the results page. I mean, holy shit. I could not believe it. I emailed their whitehat service and they fixed it but I never received a bounty.
- briandear 13y agoHow about MS just open sourcing the browser? Is their browser tech really that trade-secret-filled?
- walshemj 13y agoI think you meant paid his company if your employed as a security researcher his employer will own any rights.