| ▲ | shengpuerh 5 hours ago |
| Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable. |
|
| ▲ | Hackbraten 4 hours ago | parent [-] |
| How is that sustainable? Are security researchers going to be doing free labor for you indefinitely for exposure? |
| |
| ▲ | stephantul 4 hours ago | parent [-] | | They sell their products using the credentials they gained. I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off. | | |
| ▲ | Hackbraten 4 hours ago | parent [-] | | What happens after a couple of players have obtained marketshare and the market has consolidated? I think there are diminishing returns to be had. |
|
|
