Dan Guido

Did I find 1k bugs or 1 bug 1k times? Is this a vuln or a random crash? No one pays for crashes.

@berendjanwever is evaluating 2500 crashes per day on major browsers. This yields about 1 vuln per month. For a sample, check #DailyBug.

Dumb fuzzing yields poor results on browsers today. @berendjanwever's fuzzers understand the DOM and coordinate to find complex interactions

MemGC in IE made 90% of his use-after-free bugs practically unexploitable. "This took a bite out of my income."

MemGC is not a cure-all. A few UAFs are still exploitable. He's also finding type confusion, out of bounds reads/writes. UAFs are declining.

BugID automatically performs common crash analysis steps. Goal was make more $ by reporting faster to bounty programs.

BugID is a wrapper around CDB on Windows. It is similar to !exploitable but with more useful output. !exploitable was never useful for him.