You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.

▲

rafram 4 hours ago | parent | next [-]

Not sure that logic really holds up. If the cost of trying is low, why wouldn't you?

	▲	sli 4 hours ago \| parent \| next [-]
		This is where I am, currently. There's a lot of talk about the low opportunity-cost here, but I think that relies on the assumption that there also isn't a single opportunistic person out there with access to the RCE. That doesn't strike me as a strongly supported assumption, in my experience.
	▲	Stevvo 3 hours ago \| parent \| prev [-]
		For all I know, it's a straight up scam. Someone already sent more bitcoin to the address to double the bounty.

▲

echoangle 4 hours ago | parent | prev | next [-]

Shouldn’t the expected value of attempting this somehow include the likelihood of the key actually being on the machine? Surely the probability is much higher than 0? I would guess the expected value for actually being the first one is around $300, not 0

	▲	andersonpico 4 hours ago \| parent [-]
		> Surely the probability is much higher than 0 I genuinely have no idea how to even start calculating this probability. How would we do it? Is there reliable data on honeypots?

▲

zulban 4 hours ago | parent | prev | next [-]

You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.

▲

sgarman 4 hours ago | parent [-]

Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.

	▲	what 4 hours ago \| parent [-]
		The exploit is supposedly so trivial that everyone needed to take down their services until they could patch? There should be nothing to give away here, which I think is the point. Either it’s trivial and you swipe the $500 or it’s not and you save it (assuming you have it). In the latter case you shouldn’t really be worried, since they won’t burn an exploit on you either.

▲

v3ai 4 hours ago | parent | prev [-]

what a pedantic way to look at the world