Slashdot Mirror
Google Patches 10 Chrome Bugs, Pays Out $10K
CWmike writes "Google patched 10 vulnerabilities in Chrome on Thursday, but it didn't award any of the researchers who reported bugs its new top-dollar reward. Google divulged no details of the vulnerabilities and, as is its custom, it blocked public access to its bug-tracking database — a practice meant to keep attackers from using the information before most users have upgraded. Some rivals, such as Mozilla, do the same; others, like Microsoft, do not. Sergey Glazunov banked $4,674 for reporting four bugs, including the previous maximum $1,337 each for two of the quartet. A researcher known as 'kuzzcc,' who has also reported flaws in Opera to that browser's Norwegian maker, took home $2,000 for uncovering a pair of Chrome vulnerabilities. But no one received Google's new biggest bounty, which the company set at $3,133.70 last month, after Mozilla had increased its maximum vulnerability payment to $3,000."
Meritocracy at work. It's nice to see, and I'm sure I will hear all sorts of complaints about how it is neither fair nor effective.
Someone flopped a steamer in the gene pool.
Are they using a static analysis tool to find bugs?
", which the company set at $3,133.70 last month" Great, Easter eggs beyond the code.
you would think you could sell this information to certain other parties for a lot more than that
and the potential for damage that can be done to the company's brand, and with all of the money the company has, you'd think they'd pay at least an order of magnitude more. and get a lot more interest in finding and reporting security flaws to boot
they are playing pennies for gems of information
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Why is it some people are so resolute in their ignorance, they get indignant? At least in the USA stupidity is considered simply a freedom, not a right.
Some of us enjoy a little extra flavour in our language than others.
Home of The Suki Series
how about you make like a tree and get the hell out of here.
I am one of the bad guys :)
I assure you the bugs are worth more. The problem with those who get caught is they are lazy. You have to make personal security priority #1. Most of those in the business don't spend the time and effort to protect themselves from the inevitable risk they are taking. If they keep it up long enough those risks catch up to them. People are stupid. You can't take millions upon millions of dollars without taking some precautions. Hiding doesn't work. You have to stop any one particular thing they might investigate before you get caught to reduce risk and even then make it impossible to discover the problem you created so they can't start to investigate before you have the money in hand. This way they can't track the money back to you. There are ways to make money untraceable. If you don't keep up one activity long enough they won't catch up with you. Deviation is key. The more time they have to learn about how you work they can learn about you the more likely they will catch you. If you deviate frequently they won't be able to connect the dots to catch you. Deviate and they loose your trail. If they don't catch up you still have a problem because the government will be suspicious of anybody with money and no reported source of income. You got to create fake entities to sell something intangible to generate profit and give the appearance of a legitimate business of which you can report to the IRS that'll explain the income you've generated.
There's a 6 month disclosure timing. They likely reported and got paid months ago for these.
WTF does that mean?
Not that this wasn't entirely predictable.
Yesterday, my employer's stock was at $13.37 and I laughed. No one else got the joke. :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Why would Google do that if its updates occur frequently due to they being deltas and of smaller sizes? Would it not make any difference since users are most likely patched up already? I can understand for users who are using the portable versions--like me--unless there are more portable users than there are who install the regular app.
Bollocksing up a common phrase by randomly switching in words is not "flavouring the language." It's "clouding the issue." Use the right phrase, with the right words, or don't use the phrase. You're not avant garde, you're not clever. You're uneducated. If you're ESL, that's one thing, but then you don't claim you're enjoying flavour in your language. Pretty sure you're just a tool.
Canada: The US's more awesome sibling.
The maximum amount paid for a bug is 1,377$ ? I guess someone at google played too much CS.
Ten grand? Is that a typo?
If I find an exploit I'm gonna sell it to the Russian mob. And not for no ten grand.
Why is Chrome version 6 already in beta. Yes, it's fast, but other than that? Meh. Any other company would call it version 1.0.
Google is playing catchup with version numbers.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
how about you make like a tree and get the hell out of here.
Speaking of geek phrases -- "Make like freenode and split"
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
...nor a crime. Yet.
What about it, lawmakers?
...
I agree, maybe they should make like a tree and get the fcuk out of here ;)
Aikon-
If she is made out of wood we can build a bridge out of her.
I'm sorry.
I didn't mean to step on your lawn nazi. He's a cute little lawn ornament.
31373 is my favorite Commodore=64 game. I love blowing things up in my first-person spaceship, and fighting Thargoids.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Tell that to Larry David or Billy Shakespeare.
The reason that Google and alike are offering "bounties" on bugs is that the people behind malware do the same thing. They offer cash for exploits, not hard to find them either, just use a different search engine other than Google.
A little hot under the colander eh?
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
Seeing if he floats should put that fire out.
Of course it can't compete with the black market though but it's a good first step.
And ever since the pushed out fixes, I can't connect to a bunch of SSL sites (such as mail.google.com). Apparently the fixes broke the ability to access SSL sites from behind a corporate firewall in some cases. The fixes made Chrome nearly useless to me :(.
I have plenty of karma. Chrome is a horrible application.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
That's not what either of the did.
Shakespeare in particular made up new phrases and new words. He actually was flavouring the language. What he didn't do is take a commonly used phrase, and then replace two words with near-synonyms in a way that makes the phrase harder to recognize and understand while adding no value.
...to anyone who can identify an exploit that let's me introduce another 5 exploits