Comment by kasey_junk
9 hours ago
You think that most security researchers that can find an exploit are all willing to commit a heist with that exploit?
I’m not in the security industry but that strains credulity.
9 hours ago
You think that most security researchers that can find an exploit are all willing to commit a heist with that exploit?
I’m not in the security industry but that strains credulity.
Where did I say that? Being capable of exploiting something and willing to are two different things.
The point is that bounties create an incentive to find and disclose vulns. That doesn’t require a black market for the exploits.
“Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.”
I’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it.
What you’re responding to and what you’re saying it says are two different things.
1 reply →