If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched.

Further: a vulnerability is probably not worth that much either, even if it's a hypercapable vulnerability, because the grey market buys full enablement kits, not vulnerability information. People making 6 figures on vulnerabilities are selling fully enabled full chain exploit systems, not just intelligence about a sandbox escape.

▲

nixon_why69 2 hours ago | parent | next [-]

That's really informative but maybe a little overly capitalist-brained.

We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.

▲

JoshTriplett an hour ago | parent [-]

> We shouldn't look to the black market as cost discovery for these vulnerabilities

We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.

	▲	nixon_why69 25 minutes ago \| parent [-]
		That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google. A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".

▲

0xbadcafebee 3 hours ago | parent | prev | next [-]

How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?

▲

tantalor 2 hours ago | parent | next [-]

The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.

	▲	toomuchtodo 17 minutes ago \| parent [-]
		There is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.

▲

randyrand 3 hours ago | parent | prev [-]

That’s not how things are valued. That’s moreso how the absence of something is valued.

	▲	wat10000 22 minutes ago \| parent [-]
		Go without air for a few minutes and you’ll die, and yet they give the stuff away for free.

▲

fr2029 2 hours ago | parent | prev [-]

[flagged]

▲

doubletwoyou 22 minutes ago | parent | next [-]

Mate, it’s a style thing that depends on which style guide you’re following

AP recommends spaces around them, whereas Chicago doesn’t

besides if we’re critiquing incorrect following of English orthography

—Sentences should be capitalized

—The word “don’t” requires an apostrophe

—End sentences with a period

—That’s incorrect usage of an em-dash at the end there — but what does it matter anyways ;)

▲

itsTyrion an hour ago | parent | prev | next [-]

Books I've read would disagree. Are you the emdash police?

▲

altmanaltman an hour ago | parent [-]

Books you have read have told you to use spaces after emdash? Mostly in writing we do not use spaces even though there is no fixed rule as such. https://www.merriam-webster.com/grammar/em-dash-en-dash-how-...

And yes you cannot care about grammar that is fine but calling someone a personal insult because they pointed out something impersonal in your comment is not ideal also and is unusually catty.

	▲	ukuina an hour ago \| parent [-]
		> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.

▲

altmanaltman an hour ago | parent | prev [-]

they put spaces there so their AI generated text looks a bit more human, when in reality humans rarely use em dashes for casual comments or text. The only use for it prior to AI cuntwriting was in high brow literature, philosophy and wannabe high brow internet writing. But ai thinks that just how we talk

▲

idiotsecant 29 minutes ago | parent [-]

Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too.

I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.

	▲	Heythatsfunny 22 minutes ago \| parent [-]
		> the emdash has become the little hitler moustache of punctuation Legendary. Miss that shit too. Ez way to shit on Windows users who had to double up endashes like they were impoverished. I guess in your analogy the double endash is Stalin’s mustache and the Soviet Union in general - Gaudy, excessive, starving for more