Comment by tptacek
6 hours ago
What part of my logic do you not follow? The way you've posed this question, the simplest response would require me to write that whole comment over again.
6 hours ago
What part of my logic do you not follow? The way you've posed this question, the simplest response would require me to write that whole comment over again.
That’s an unnecessarily rude response I think.
I detailed my logic above.
Additionally, part of my businesses remediation services include helping companies set up bug bounty programs. Giving researchers an incentive to report bugs for payouts instead of selling or exploiting them for profits is always the intended goal.
This is probably my highest-rated comment on HN:
https://news.ycombinator.com/item?id=43025038
It's the product of direct interviews with bounty people, FAANG/MAG7 blue teamers, and black market participants. If you want more, there's also an interview online that we did with Mark Dowd, who is one of the best known CNE vendors to the NATO IC. You can just Google [SCW Mark Dowd].
I'm happy to go into more detail, but, like I said, you didn't really respond to my comment in any way that I could expand on. Feel free to disagree with me in some kind of specific way.
This really is simple: if you work in this space, you already know that there's essentially no black market at all for serverside web bugs. But there's a $90k bounty for this one, and 5-figure bounties for others. Reconcile those two facts.
Well thats nice and Im happy for you but internet points don’t really mean much here…
What a vulnerability sells for and how much damage someone could do exploiting it are two different things. Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.
A company paying big bucks isn’t a contradiction. Its incentivizing disclosure over exploitation which could cost them considerably more. Engineering prioritization is… a minor part of it informed by the ease of exploitation, damage it could do (in the case of an RCE or publicly available keys as in this case quite a bit) etc.
I don’t see why you think these things are mutualy exclusive.
8 replies →
[dead]