←back to thread

406 points vk6 | 2 comments | | HN request time: 0s | source
Show context
Etheryte ◴[] No.41867389[source]
Given the severity, I can't help but feel that this is underpaid at the scale Google is at. Chrome is so ubiquitous and vulnerabilities like these could hit hard. Last thing they need to do is to send the signal that it's better to sell these on the black market.
replies(9): >>41867499 #>>41867548 #>>41867653 #>>41867666 #>>41867873 #>>41868146 #>>41868628 #>>41868995 #>>41869073 #
thrdbndndn ◴[] No.41867548[source]
I hate that every time a vulnerability is posted, someone has to argue about whether the bounty is high enough. It’s always followed by, "blah blah, they're pushing whitehats to sell it on the black market."

Vulnerabilities will always sell for more on the black market because there’s an added cost for asking people to do immoral and likely illegal things. Comparing the two is meaningless.

To give a straightforward answer: no, I don’t think $20k is underpaid. The severity of a bug isn't based on how it could theoretically affect people but on how it actually does. There's no evidence this is even in the wild, and based on the description, it seems complicated to exploit for attacks.

replies(2): >>41867627 #>>41867954 #
n2d4 ◴[] No.41867627[source]
> The severity of a bug isn't based on how it could theoretically affect people but on how it actually does

No, it's priced on demand and supply like anything else; bug bounties are priced to be the amount that Google thinks it takes to incentivise hunters to sell it to them, vs. to black hats.

replies(7): >>41867670 #>>41867692 #>>41867853 #>>41868419 #>>41868768 #>>41868849 #>>41869671 #
luismedel ◴[] No.41867692[source]
I know not everyone shares my world-view, but I need to be literally starving to consider selling whatever I discover to a criminal.

principles > wild market

replies(5): >>41867706 #>>41867707 #>>41867839 #>>41867975 #>>41868715 #
1. graemep ◴[] No.41867706[source]
I think many people have internalised a purely profit driven world view, and it is what they expect to be the main motivator or themselves and others.
replies(1): >>41867977 #
2. TeMPOraL ◴[] No.41867977[source]
TL;DR: a random stranger is most likely a nice and honest and principled human being. A sufficiently large population of random strangers behaves approximately like a population of amoral(ish), rational(ish) economic actors. If your process involves continuously drawing a stranger at random from a population, then you can't avoid taking the economic view, because you eventually will draw a crazy or malevolent or economically-rational stranger.

--

GP wouldn't sell their discoveries to the criminals. But would they consider selling them to a third party as an intermediary, perhaps one that looks very much above board, and specializes in getting rewards from bug bounties in exchange for a percentage of payout?

I don't know if such companies exist, but I suspect they might - they exist for approximately everything else, it's a natural consequence of specialization and free markets.

Say GP would say yes; how much work would they put into vetting the third party doesn't double-dip selling the exploit on the black market? How can they be sure? Maybe there is a principled company out there, but we all know principled actors self-select out of the market over time.

Or, maybe GP wouldn't sell them unless starving, but what if agents of their government come and politely ask them to share, for the Good of their Country/People/Flag/Queen/Uniform/whatever?

Or, maybe GP wouldn't sell them unless starving, but what is their threshold of "starving"? For many, that wouldn't be literally starving, but some point on a spectrum between that and moderate quality-of-life drop. Like, idk, potentially losing their home, or (more US-specific I guess) random event leaving them with a stupidly high medical bill to pay, etc.

With all that in mind, the main question is: how do you know? How does Google know?

The reason people take an economic view of the world is because it's the only tool that lets you do useful analysis - but unlike with the proverbial hammer that makes everything look like a nail, at large enough scale, approximately everything behaves like a nail. Plus, most of the time, it only takes one.

GP may be principled, but there's likely[0] more than one person making the same discovery at the same time, and some of those people may not be as principled as GP. You can't rely on only ever dealing with principled people - like with a game of Russian roulette, if you pull the trigger enough times, you'll have a bad day.

--

[0] - Arguably, always. Real breakthrough leaps almost never happen, discoveries are usually very incremental - when all the pieces are there, many people end up noticing it and working on the next increment in parallel. The first one to publish is usually the only one to get the credit, though.