Slashdot Mirror
Top Bug Hunters Make 2.7 Times More Money Than an Average Software Engineer (bleepingcomputer.com)
An anonymous reader shares a report: A survey of 1,700 bug bounty hunters registered on the HackerOne platform reveals that top white-hat hackers make on average 2.7 times more money than the average salary of a software engineer in the same country. The reported numbers are different for each country and may depend on a bug bunter's ability to find bugs, but the survey's results highlight the rising popularity of bug hunting as a sustainable profession, especially in less developed countries, where it can help talented programmers live a financially care-free life. According to HackerOne's report, it pays to be a vulnerability researcher in India, where top bug hunters can make 16 times more compared to the average salary of a software engineer. Other countries where bug hunting can assure someone a comfortable living are Argentina (x15.6), Egypt (x8.1), Hong Kong (x7.6), the Philippines (x5.4), and Latvia (x5.2).
Ok, but how much does an average bug hunter make vs a top software engineer? Or an average bug hunter vs an average software engineer?
I mean this is an Apples vs Oranges comparison there.
You can take the top of nearly any (professional) profession and compare it to the average of others and you see that the best of the best makes more then the average guy does.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
A crappy blog is a great source to get things like "top of something better than average of another". Awesome comparison.
"Not to mention all the idiots who use words like boxen."
Anonymous Coward on Monday August 04, @06:49PM
I thought the Bug Bunters found hugs...
LOL, way to fact check. Latvia is Dr Doom's fictional country.
uh, you are thinking of Latveria actually, http://marvel.wikia.com/wiki/Latveria
Uh... Latvia's a real country, Anonymous Coward. Look it up.
where it can help talented programmers live a financially care-free life.
Security bug hunting and pen test is extremely competitive. Your 2.7x earnings means you're playing with a bunch of workaholics in an all-or-nothing system where partial credit is not an option. You can put 40 hours into a project, only to have victory snatched away by the guy who finished it in 35 hours.
“Common sense is not so common.” — Voltaire
So the top bug hunters make more than the average software engineer? Well slap my ass and call me a cantaloupe!
What about top software engineers compared to average software engineers? What about A-list celebrities vs stuntmen?
I know! How about we compare the top strawmen vs average strawmen?
Dr Doom is from Latveria.
CAPTCHA: contrite
Do the top crappy bloggers make more than the average slashdot poster?
Top software engineers make much more than 2.7x average software engineers.
To everyone complaining about the comparison between the top of bug hunters and the average software engineer, you are clearly missing the point. They aren't trying to present a meaningful comparison of two fields, they are trying to paint a statistically inaccurate picture of luxury in order to flood the market and drive average wages down. C'mon, is this everybody's first day on /. or something?
This is my signature. There are many like it, but this one is mine.
First class airline ticket costs 20 times the average bus fare
Let me wait for the comparison of the average pay of the top 1700 bounty hunters with the average pay of top 1700 software engineers.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Iâ(TM)m a big hunter
37% of white-hat hackers say they hack as a hobby in their spare time (not their primary job).
About 12% of hackers on HackerOne make $20,000 or more annually from bug bounties.
Over 3% o bug hunters are making more than $100,000 per year.
1.1% are making over $350,000 annually.
13.7% say bounties earned represent 90-100% of their annual income.
India (23%) and the United States (20%) are the top two countries represented on the HackerOne platform, followed by Russia (6%), Pakistan (4%), and the United Kingdom (4%).
Nearly 1 in 4 hackers have not reported a vulnerability that they found because the company didn’t have a channel to disclose it.
US companies have paid over $15 million to bug hunters via HackerOne in 2017.
US bug hunters racked over $4.1 million in bug rewards, while Indian white-hat hackers earned over $3 million.
"Websites" was the overwhelming winner to the question of "What is Your Favorite Kind of Platform or Product to Hack?" with a 70.8% score.
"Money" was not the primary motivation for getting into bug hunting. It ranked only fourth.
XSS was the favorite vulnerability white-hat hackers liked to search for.
(Clipped out some slashvertisement pitching something called burp suite. )
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I was planning to be an average developer, but I guess I'll become one of the best bug hunters instead. Because as an average software engineer, I assume that I'd be way better than average at finding bugs than someone who's already made that their career.
Top software developers make probably 4 times what the 'average' ones make. Apples and oranges, msmash, apples and oranges.
Just as with anything, some perspective.
Top actors make millions, they are the minority, most make almost nothing
Top singers/bands make millions, they are the minority most are below poverty level
Top bug hunters, sure they make a ton, but the majority of them probably barely make a living
Top house flippers make a good deal of money, most barely get by, one bad transaction could send them to bankrupcty
Top engineers (software, mechanical, etc) can make a decent income, most don't make even 6 figures
Top lotto winners "made" a lot of money, most don't
Top gamblers can make a lot of money, most don't
Top athletes can make a ton of money, most do not
If you want to shoot for the stars based what the top people in that field earn, go for it, but be prepared to learn you very likely won't be the 1-5% who are in the top of the field earning that top income.
Last time I checked maintenance was still the largest part of software engineering by a wide margin.
Making 2.7 times the salary of someone doesn't mean you make 2.7 times more (unless the other person makes $0). You have to take into account the fact that the other person is getting paid. So that's either "1.7 times more" or "2.7 times the salary".
lucm, indeed.
I am pretty sure that 1 standard deviation rightward on the x axis on any profession makes about 2.7 times what the arithmetic mean of another profession makes, especially for nearly any non-blue-collar or service-industry “profession”. Top bug hunters might even be 2 standard deviations out from the average bug hunter.
From the article:
* About 12% of hackers on HackerOne make $20,000 or more annually from bug bounties.
* Over 3% o bug hunters are making more than $100,000 per year.
* 1.1% are making over $350,000 annually.
1. Have lawyers and contractors create a product for mil/gov and win the bid.
2. Code the product in a nation with low wages. Have lawyers and a person with clearance needed present the code as compliant.
3. Rent the service and support to the mil/gov.
4. Support problems by making more profit locally again in overtime costs.
5. Outsource upgrades.
6. Get the billable hours up for local 24/7 support.
Low wage nations with average IQ workers win bids and keeps costs down for the entire project.
Billable hours for locked in support needed later makes the profit.
Domestic spying is now "Benign Information Gathering"
The Latvia/Latveria mixup was a bug in the AC's AI.
Unfortunately there is no where to report it and claim a bounty.
Worthless post comparing unrelated things. I can't believe I've even wasted the time to reply. Sure as hell not going to bother with the article. Has slashdot become slashmoron?
Top clickbait writers make more on average
Makes me think of that line in Aliens: (discussed here)
PFC Hudson: Is this going to be a stand-up fight, sir, or another bug hunt?
Maybe these guys get better pay but, personally, I'd take less if I could simply nuke things from orbit - you know, to be sure.
It must have been something you assimilated. . . .
I'm a software engineer. I'm no good at finding bugs. It always works on my machine.
who am i to begrudge someone doing such a valuable job?
Didn't we call those testers at one point, before we fired them all?
http://dilbert.com/strip/1995-...
So jack squat?
There was a young lady of Riga,
Who smiled when she rode on a tiger.
They came back from the ride
With the lady inside,
And the smile on the face of the tiger.
What Riga has to do with Latvia, is up to figure by the reader :)
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Russian trolls are everywhere these days. It wouldn't surprise me if his officially state sanctioned atlas was missing the Baltic states entirely.