Well thats nice and Im happy for you but internet points don’t really mean much here…

What a vulnerability sells for and how much damage someone could do exploiting it are two different things. Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.

A company paying big bucks isn’t a contradiction. Its incentivizing disclosure over exploitation which could cost them considerably more. Engineering prioritization is… a minor part of it informed by the ease of exploitation, damage it could do (in the case of an RCE or publicly available keys as in this case quite a bit) etc.

I don’t see why you think these things are mutualy exclusive.

▲

tptacek a day ago | parent | next [-]

Having given up on the original argument ("Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.") you've now transitioned to a new one: that vulnerabilities can be used by the hackers who find them to plan heists. And that is true. It doesn't set any kind of market-clearing price, and selects for actors who are comfortable ending up in prison, but it is indeed a statement that aligns with reality.

▲

ofjcihen 21 hours ago | parent [-]

My original comment explicitly said “selling or exploiting them for profits.” You are just ignoring the second half for some reason.

I think you need to breathe a bit and then re-read my comment. I’m not coming at you, I’m saying that what an exploit sells for and what it could cost a company if exploited are entirely different things. That’s where you’re hung up.

Companies have an obvious financial incentive to encourage discovery and disclosure before exploitation.

	▲	tptacek 21 hours ago \| parent [-]
		I just don't care at this point. We're talking past each other. I quoted the argument that I was responding to, in the comment you just replied to.

▲

kasey_junk a day ago | parent | prev [-]

You think that most security researchers that can find an exploit are all willing to commit a heist with that exploit?

I’m not in the security industry but that strains credulity.

▲

ofjcihen a day ago | parent [-]

Where did I say that? Being capable of exploiting something and willing to are two different things.

The point is that bounties create an incentive to find and disclose vulns. That doesn’t require a black market for the exploits.

▲

kasey_junk a day ago | parent [-]

“Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.”

I’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it.

▲

ofjcihen a day ago | parent [-]

What you’re responding to and what you’re saying it says are two different things.

	▲	kasey_junk a day ago \| parent [-]
		Sounds good. Thanks.