Hacker News Reader

Comment by InitialBP | Hacker News Reader

Penetration tester here - My anecdotal experience:

I've worked on a number of projects where bill rate is something like $250-$400/hr per engineer depending on complexity, access to source code, size of the project, etc.

Usually equating to something like 10-12k for a single engineer on a project for a week. For bigger projects like this I would think it's totally reasonable to see anything from 4 engineering weeks -> 12 engineering weeks depending on different pieces and especially given this is a very high profile project. Based on that estimate of something between ~40k-120k. I know that's a huge range, but just wanted to share what I do know.

View on HN

Would Mozilla blow one engineer's year's salary on such a thing though?

Companies do this because customers have already demanded it or because they know companies will demand it.

It's expensive, but it helps you land customers, which pay you enough to cover it.

On top of just "compliance" or "customers demand it", these types of penetration tests can and do expose real, serious vulnerabilities in software.

Furthermore, I wouldn't underestimate the positive press that having a third party security firm assess your product and share the results publicly. VPN Services have been under special scrutiny lately so I think something like this makes total sense for Mozilla, regardless of the cost.

Why not? it's a one time expense that helps you launch.

If throwing money at a problems solves, that's rarely a hard argument to make.

If you throw engineers at a problem it might get solved, or it might not. Hiring an engineer to work on something is a high risk investment.

side note: Mozilla does have great engineers, when I was there a few years ago the security was also very competent. But it's probably not the same as getting specialized consultants.

It's 1800 yearly subscriptions at $110k, and that's assuming $5/month is pure profit, which it is not.

So this one off audit would have to hit them, say, 6000 extra 1 year subscriptions to pay itself off, let alone turn profit. Sounds like a stretch.

It would certainly be hard to measure.

On that note, how many customers do these public customer oriented VPNs have, typically? 1k's? 10k's? More?

Or just one juicy corporate subscription.

Not sure about that. The major VPNs have similar (not identical) functionality and price. They're competing on the perception that they are more secure than others. In that light, having a passing security audit by a reputable company would be table stakes for a lot of customers. As noted by another commenter already, not having one could also be a deal-breaker on a vendor security assessment by a big company, too.

It's not a one time cost. For it to be valuable, you need to perform additional audits periodically.

For a Berlin-based team like the one Mozilla used, $250-$400/hr/engineer is kinda hard to believe. Probably closer to $150-$200/hr. The average software engineer in Berlin makes $71k/yr. The compensation levels are very different compared to SV.

Don't forget to add the employer's mandatory social security contributions and any additional employee benefits and equipment[0], the USD<>EUR exchange rate, and the fact that even in Berlin a senior security engineer will definitely make more than 71k€.

[0]: The founder of a (Germany-based) IT consulting firm recently told me that, as an estimate, pretty much any engineer at a tech firm costs at least 100,000€/yr.

Still, do you think that Berlin-based company charged $250-400 per engineer-hour?

Not sure about 400 USD/hour but 250 USD (~200 EUR) for a senior? Yeah.

So he is talking about bill rate which is very different than what someone makes. At my company someone might make $50 but their bill rate might be like $175. Your bill rate factors is all sort of costs like having an office building, insurance, taxes, and everything that goes into having an employee above just salary. So even if they are in Berlin their bill rate is most likely comparable.

Yes, I am aware of all of those factors.

I am familiar with Berlin rates and this person is right. 400 USD (337 euros) an hour is unrealistic, unless you are hiring Cure53 specifically because employee X did groundbreaking research on topic Y and that's why you need that expertise; only then would I expect Mozilla to agree to that sort of rate. The range is more likely to be 110 - 250 euros per hour, where both ends are fairly unlikely but it's not as if I have comprehensive industry-wide data on everyone's financials. (I'm not that kind of hacker, heh.)

The sibling commenters are right, though, that the hourly rates charged by the company are not very related to how much you earn as a person. I wish I got my hourly rate as salary, but I see what kind of organisational crap the founder has to do and it's just not worth the headache to me.

Reply on news.ycombinator.com