Comment by estearum
5 hours ago
I don't see how the "you should want to know all avenues of exploit" goal is different depending on how many avenues of exploit there are
5 hours ago
I don't see how the "you should want to know all avenues of exploit" goal is different depending on how many avenues of exploit there are
They're just relevant to each other.
You should want to know avenues of exploit so you can be defensive with security. You have little control over the offensive side of vulnerability exploitation.
Right, so why would that not be a justification for essentially unbounded GoF research?
How much should you spend on security?
Both lines of research are limited by some sense of waste: in time or money.
When should you stop? When some acceptable standard is reached and a certain amount of risk is accepted.
In the case of GoF, if it wasn't somehow profitable, then the research would likely cease to exist.