5 ms·

>the money is actually relatively low compared to standard tech benefit packages 225K is low compared to the standard? What standard are you talking about?

by hueving 12y ago

perdunov 12y ago
I think he is talking about the expected value vs a lucky chance. It's like the stock market. In the long run there are no miracles.
- rudolf0 12y ago
  Skill definitely plays a role too. If you are smart and experienced enough, you can theoretically churn out a valuable exploit once every 1-2 months on average. At a company, you're generally going to get a flat salary. Many vuln research/development companies do offer bonuses for every effective exploit you write though, in which case it probably is better to work for such a company than to rely solely on bug bounties and competitions for income. Unfortunately, those same companies usually sell the exploits to the NSA and the intelligence agencies of other governments.
birdmanjeremy 12y ago
It's risk vs reward. If he had a 50% chance of success, and spent a year on the exploits, you could equate it to 112.5k salary+benefits package (assuming it was a full time job to find the exploits). I would call 112.5 low for the tech industry, especially for someone of his caliber. Either way, very impressive and well deserved.
- pyre 12y ago
  > I would call 112.5 low for the tech industry Depends on location.
- drinchev 12y ago
  I doubt he got one year or any deadlines in his mind. Most of the hackers do this because they know that there's an exploit somewhere. Come on, how many bugs do you produce, while writing code? Do you bet 500$ that you are bug-free? Do you bet 500$ that the libraries that you are using are bugs-free? I don't. In this sense I think guys like him are having a way of thinking more similar to a gamer : "I need to do this and I come to the next level, but the experience playing is more important than the next level!" So... I doubt he thinks there's a 50% chance. He's just too good "gamer" and he knows the games so good that he actually won the four different versions of it.
brucedawson 12y ago
Lee is clearly extremely talented. He wouldn't be making 'standard' salaries, he'd be getting paid extremely well. And, I imagine he'll be getting some pretty impressive job offers now...

>the money is actually relatively low compared to standard tech benefit packages 225K is low compared to the standard? What standard are you talking about?

by hueving 12y ago

>the money is actually relatively low compared to standard tech benefit packages 225K is low compared to the standard? What standard are you talking about?

perdunov 12y ago

I think he is talking about the expected value vs a lucky chance. It's like the stock market. In the long run there are no miracles.

rudolf0 12y ago
Skill definitely plays a role too. If you are smart and experienced enough, you can theoretically churn out a valuable exploit once every 1-2 months on average. At a company, you're generally going to get a flat salary. Many vuln research/development companies do offer bonuses for every effective exploit you write though, in which case it probably is better to work for such a company than to rely solely on bug bounties and competitions for income. Unfortunately, those same companies usually sell the exploits to the NSA and the intelligence agencies of other governments.

birdmanjeremy 12y ago

It's risk vs reward. If he had a 50% chance of success, and spent a year on the exploits, you could equate it to 112.5k salary+benefits package (assuming it was a full time job to find the exploits). I would call 112.5 low for the tech industry, especially for someone of his caliber. Either way, very impressive and well deserved.

pyre 12y ago
> I would call 112.5 low for the tech industry Depends on location.
drinchev 12y ago
I doubt he got one year or any deadlines in his mind. Most of the hackers do this because they know that there's an exploit somewhere. Come on, how many bugs do you produce, while writing code? Do you bet 500$ that you are bug-free? Do you bet 500$ that the libraries that you are using are bugs-free? I don't. In this sense I think guys like him are having a way of thinking more similar to a gamer : "I need to do this and I come to the next level, but the experience playing is more important than the next level!" So... I doubt he thinks there's a 50% chance. He's just too good "gamer" and he knows the games so good that he actually won the four different versions of it.

brucedawson 12y ago

Lee is clearly extremely talented. He wouldn't be making 'standard' salaries, he'd be getting paid extremely well. And, I imagine he'll be getting some pretty impressive job offers now...