| ▲ | Gander5739 a day ago |
| > Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them. Is this really true? After all, reselling the exploit would be illegal, and most people don't want to break the law to earn income. |
|
| ▲ | jack_pp a day ago | parent | next [-] |
| most people who care about legality don't work in that field either. whoever gets into this probably starts by being ok with doing shady stuff, I imagine. |
| |
| ▲ | mapontosevenths a day ago | parent | next [-] | | Many start in the military and eventually move to private sector. However, an ever growing percentage just straight up go to college to learn the skills. Cyber companies are in the fortune 100 now, and it's not like it used to be back when you actually had to be interested in it and dedicate your life to learning the skillz from shady forums. Now it's just a job to most practitioners. | | |
| ▲ | jack_pp a day ago | parent [-] | | what use are 0-days to private cybersecurity companies? | | |
| ▲ | IrishTechie a day ago | parent | next [-] | | Huge marketing/PR benefit. | | |
| ▲ | mapontosevenths a day ago | parent [-] | | Yes, but also there is also a huge value to individual contributors and their careers. I broke into the field after landing a few relatively high profile CVE acknowledgements for big companies. Responsible disclosure is good for your career. On the other hand, if the value of that drops you can expect to see some folks start taking the wrong path. |
| |
| ▲ | shimman 20 hours ago | parent | prev [-] | | Probably extremely useful for the companies that can sell exploits to state governments. |
|
| |
| ▲ | saagarjha a day ago | parent | prev [-] | | Plenty of people in this space who work on entirely legal things |
|
|
| ▲ | graemep a day ago | parent | prev | next [-] |
| Most people do not, but it needs only some people who do so for it to be a problem. Most people do not steal, but I still lock my front door. |
|
| ▲ | micromacrofoot a day ago | parent | prev [-] |
| there are enough people operating in countries that would not charge them for hacking an American company for it to matter, $90k can be a life-changing sum |
