logoalt Hacker News

CookieCrisp • yesterday at 11:19 PM • 3 replies • view on HN

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

Replies

altairprime • today at 1:03 AM

The discount Google is getting on bounties versus internal spend is easy to estimate:

  # assumed to be $0.5mil USD or greater
  A := What quantity of salaries-and-benefits and AI-dollars does Google spend on zero-day research?

  # assumed to be greater than zero
  B := How many full sandbox RCEs are they *hoping* to discover per year with that budget?

  # $/RCE budgeted spend
  C := A ÷ B

  # $/bounty
  D := $1000 USD

  # % discount per bounty relative to in-house spend
  E := (C - D) / C
While we lack the data to be sure, it is reasonable to estimate that they're getting a discount of 90% or better versus internal spend on this bounty payment, if one assumes that they do not have many sandbox RCEs left undiscovered. It's unclear whether that assumption holds, but with only a single researcher at an assumed $0.5mil/year (all-inclusive after pay, stock, and benefits) is enough to support the plausibility of that 90% figure, before accounting at market rates for their internal use of the house AIs.

So, the most likely case is that they're greedy and miserly, and hope we don't do the math. However I recognize that there are judgment calls to be made here. Either their internal spending finds hundreds of RCEs per year, or they're significantly discounting bounty payments versus their actual worth, or they're negligent in budgeting for RCE discovery at all, or they assign zero value to the security of the Chromium platform underpinning Edge, Electron, et al. All of these are bad in different ways; one hopes a competent tech reporter actually pursues this line of questioning with them!

➕ show 1 reply
quotemstr • yesterday at 11:41 PM

You let the market decide. Google could purchase the bugs on the same market blackhats do.

➕ show 6 replies
teravor • yesterday at 11:29 PM

ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.

➕ show 2 replies