6 ms·

It's large when you present it as a single-day payout. If you imagine it might have taken a year of work to discover and exploit these vulnerabilities, with no

by davmre 12y ago

It's large when you present it as a single-day payout. If you imagine it might have taken a year of work to discover and exploit these vulnerabilities, with no guarantee of success, then the money is actually relatively low compared to standard tech benefit packages. Tons of respect for anyone who does this and avoids the urge to go to the black market (or NSA, etc).

hueving 12y ago
>the money is actually relatively low compared to standard tech benefit packages 225K is low compared to the standard? What standard are you talking about?
- perdunov 12y ago
  I think he is talking about the expected value vs a lucky chance. It's like the stock market. In the long run there are no miracles.
  - rudolf0 12y ago
    Skill definitely plays a role too. If you are smart and experienced enough, you can theoretically churn out a valuable exploit once every 1-2 months on average. At a company, you're generally going to get a flat salary. Many vuln research/development companies do offer bonuses for every effective exploit you write though, in which case it probably is better to work for such a company than to rely solely on bug bounties and competitions for income. Unfortunately, those same companies usually sell the exploits to the NSA and the intelligence agencies of other governments.
- birdmanjeremy 12y ago
  It's risk vs reward. If he had a 50% chance of success, and spent a year on the exploits, you could equate it to 112.5k salary+benefits package (assuming it was a full time job to find the exploits). I would call 112.5 low for the tech industry, especially for someone of his caliber. Either way, very impressive and well deserved.
  - pyre 12y ago
    > I would call 112.5 low for the tech industry Depends on location.
  - drinchev 12y ago
    I doubt he got one year or any deadlines in his mind. Most of the hackers do this because they know that there's an exploit somewhere. Come on, how many bugs do you produce, while writing code? Do you bet 500$ that you are bug-free? Do you bet 500$ that the libraries that you are using are bugs-free? I don't. In this sense I think guys like him are having a way of thinking more similar to a gamer : "I need to do this and I come to the next level, but the experience playing is more important than the next level!" So... I doubt he thinks there's a 50% chance. He's just too good "gamer" and he knows the games so good that he actually won the four different versions of it.
- brucedawson 12y ago
  Lee is clearly extremely talented. He wouldn't be making 'standard' salaries, he'd be getting paid extremely well. And, I imagine he'll be getting some pretty impressive job offers now...
criley2 12y ago
>225k is standard? 100k income per year + 33% for employer taxes, medical/fringe benefits, etc, so 133k. 1.5 years of work at 133k/yr = ~200k payout. I wouldn't call that low since it already hinges on massively inflated salaries due to massively inflated cost of living for developers in hubs. That 100k of buying power in SF would come from about a 55-60k salary in my area. (1) (1) http://www.wolframalpha.com/input/?i=moving+from+San+Francisco+to+Atlanta+salary+%24100k http://www.wolframalpha.com/input/?i=moving+from+San+Francis...
- davmre 12y ago
  As birdmanjeremy posted below, you have to discount for risk. This year he got $225k, next year he may get nothing. In any case I think you're underestimating the value of benefits provided by large tech companies. Free food, top-end health insurance, maternity/paternity leave, gym memberships, retirement contributions, bonuses, etc. all add up. I've commonly heard the rule of thumb that total cost-to-employer is roughly $2N for an employee making $N in nominal salary. The point about location is reasonable: it's harder to get a six-figure salary doing remote work, which is effectively what this is. Still I think people shouldn't be shocked about the amount of money in play here. Given the risk, it's a good payout but not a great one for someone of his (clearly very high) skill level.
  - riskable 12y ago
    The 2x salary average is very misleading. The average for all employees everywhere in the US sure, but it's a sliding scale. The higher your salary the less your employer is paying as a percentage of your income. There's very little difference in overhead between someone making $100k and someone making $150k. The overhead difference will only be a few thousand dollars more for the person making $150k.
    - mturmon 12y ago
      "There's very little difference in overhead between someone making $100k and someone making $150k." Logically, you would think so, but remember that many benefits scale with salary/seniority. Things like retirement plan matching and vacation accrual rate. Also perks like better offices, parking, "training" in attractive destinations.
yeukhon 12y ago
But if they are able to find it, they are probably earning enough month-to-month on various bug bounties. Heck, most of them would probably already running or hired by some of the top security research groups.
nullc 12y ago
>avoids the urge to go to the black market (or NSA, etc). You can still sell your exploit to the black(site) market and later collect a bounty on it. You take some risk that someone else finds it or the party you sold it to leaks it. Price accordingly.
- leereeves 12y ago
  > You can still sell your exploit to the black(site) market and later collect a bounty on it. Sounds like a good way to make dangerous enemies.
cryptophreak 12y ago
>the black market (or NSA, etc) Legitimate question: What’s the difference?

by davmre 12y ago

hueving 12y ago

>the money is actually relatively low compared to standard tech benefit packages 225K is low compared to the standard? What standard are you talking about?

perdunov 12y ago
I think he is talking about the expected value vs a lucky chance. It's like the stock market. In the long run there are no miracles.
- rudolf0 12y ago
  Skill definitely plays a role too. If you are smart and experienced enough, you can theoretically churn out a valuable exploit once every 1-2 months on average. At a company, you're generally going to get a flat salary. Many vuln research/development companies do offer bonuses for every effective exploit you write though, in which case it probably is better to work for such a company than to rely solely on bug bounties and competitions for income. Unfortunately, those same companies usually sell the exploits to the NSA and the intelligence agencies of other governments.
birdmanjeremy 12y ago
It's risk vs reward. If he had a 50% chance of success, and spent a year on the exploits, you could equate it to 112.5k salary+benefits package (assuming it was a full time job to find the exploits). I would call 112.5 low for the tech industry, especially for someone of his caliber. Either way, very impressive and well deserved.
- pyre 12y ago
  > I would call 112.5 low for the tech industry Depends on location.
- drinchev 12y ago
  I doubt he got one year or any deadlines in his mind. Most of the hackers do this because they know that there's an exploit somewhere. Come on, how many bugs do you produce, while writing code? Do you bet 500$ that you are bug-free? Do you bet 500$ that the libraries that you are using are bugs-free? I don't. In this sense I think guys like him are having a way of thinking more similar to a gamer : "I need to do this and I come to the next level, but the experience playing is more important than the next level!" So... I doubt he thinks there's a 50% chance. He's just too good "gamer" and he knows the games so good that he actually won the four different versions of it.
brucedawson 12y ago
Lee is clearly extremely talented. He wouldn't be making 'standard' salaries, he'd be getting paid extremely well. And, I imagine he'll be getting some pretty impressive job offers now...

criley2 12y ago

>225k is standard? 100k income per year + 33% for employer taxes, medical/fringe benefits, etc, so 133k. 1.5 years of work at 133k/yr = ~200k payout. I wouldn't call that low since it already hinges on massively inflated salaries due to massively inflated cost of living for developers in hubs. That 100k of buying power in SF would come from about a 55-60k salary in my area. (1) (1) http://www.wolframalpha.com/input/?i=moving+from+San+Francisco+to+Atlanta+salary+%24100k http://www.wolframalpha.com/input/?i=moving+from+San+Francis...

davmre 12y ago
As birdmanjeremy posted below, you have to discount for risk. This year he got $225k, next year he may get nothing. In any case I think you're underestimating the value of benefits provided by large tech companies. Free food, top-end health insurance, maternity/paternity leave, gym memberships, retirement contributions, bonuses, etc. all add up. I've commonly heard the rule of thumb that total cost-to-employer is roughly $2N for an employee making $N in nominal salary. The point about location is reasonable: it's harder to get a six-figure salary doing remote work, which is effectively what this is. Still I think people shouldn't be shocked about the amount of money in play here. Given the risk, it's a good payout but not a great one for someone of his (clearly very high) skill level.
- riskable 12y ago
  The 2x salary average is very misleading. The average for all employees everywhere in the US sure, but it's a sliding scale. The higher your salary the less your employer is paying as a percentage of your income. There's very little difference in overhead between someone making $100k and someone making $150k. The overhead difference will only be a few thousand dollars more for the person making $150k.
  - mturmon 12y ago
    "There's very little difference in overhead between someone making $100k and someone making $150k." Logically, you would think so, but remember that many benefits scale with salary/seniority. Things like retirement plan matching and vacation accrual rate. Also perks like better offices, parking, "training" in attractive destinations.

yeukhon 12y ago

But if they are able to find it, they are probably earning enough month-to-month on various bug bounties. Heck, most of them would probably already running or hired by some of the top security research groups.

nullc 12y ago

>avoids the urge to go to the black market (or NSA, etc). You can still sell your exploit to the black(site) market and later collect a bounty on it. You take some risk that someone else finds it or the party you sold it to leaks it. Price accordingly.

leereeves 12y ago
> You can still sell your exploit to the black(site) market and later collect a bounty on it. Sounds like a good way to make dangerous enemies.

cryptophreak 12y ago

>the black market (or NSA, etc) Legitimate question: What’s the difference?