That's really informative but maybe a little overly capitalist-brained.

We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.

▲

JoshTriplett an hour ago | parent [-]

> We shouldn't look to the black market as cost discovery for these vulnerabilities

We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.

	▲	nixon_why69 26 minutes ago \| parent [-]
		That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google. A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".