4 ms·
Then they're not researchers, right? I feel like "researchers" should be synonymous with white hats, and disclose to the company when they find something. Peopl
by diafygi 11y ago
Then they're not researchers, right? I feel like "researchers" should be synonymous with white hats, and disclose to the company when they find something. People who find something and don't disclose are black hats, or at least grey hats, but definitely shouldn't be considered researchers.
- tptacek 11y ago"Researchers" here is a term of art in the field; for the most part, vulnerability researchers are not researchers in the academic sense, but rather in the newsgathering sense.
- kenperkins 11y agoPeople who find vulnerabilities purely for the bounty seem to fit the classical definition of Bounty Hunters or Mercenaries. Certainly not researches. They're not in it for the academic benefit or advancing the state of the art. They're in it for the cash.
- tptacek 10y agoThis is a weird kind of ownership you've taken over the word "researcher". There are all sorts of people traditionally described as researchers, and many of them are private and for-profit.
- sgift 10y agoLast time I checked our society tells us that striving for money is the way to go, so why should researches be hold to different standards? If you don't like the game, change the rules - don't blame the players.
- dogma1138 11y agoSo researchers that build weapons aren't researchers?
- deleted 11y ago[deleted]
- 2trill2spill 11y agoSo your saying someone who does security research but does not get paid is a researcher, but if someone else does the same research but they get paid their not a researcher? So what if a security researcher is paid for their work? We don't say Lawyers are not Lawyers because their being paid and not doing work pro bono. Remember security research takes lot's of time, skill and hardware they should be paid to do their work.
- sqeaky 11y agoA person can do research on a salary. Demanding money because you found a 0-day in their software is scarily similar to blackmail. There is plenty of room between blackmail and research. A professional researcher can draw a paycheck and release exploits as found.
- tptacek 10y agoDoing work on your own time, with your own materials, and expecting to be paid for your work product is "scarily similar to blackmail"? Could you go into that a little bit more? Exactly how are these "professional researchers" generating their paychecks? (NB: I was one of those "professional researchers".)
- sqeaky 10y agoOnce a researcher has found an issue, demanding money after the is similar to blackmail. Agreeing on money up front seems like a reasonable way, I also see no problem with bounty programs or even asking for more from bounty programs. Withholding a bug until a bounty is raised is were I would draw the line at blackmail.
- tptacek 10y agoYou haven't explained how it's anything at all like blackmail. Say I'm the researcher and you're the vendor. I'm offering to sell the product of my own work. You're free not to buy it from me. But you are in no way entitled to my work product!
- marcoperaza 11y agoWhat? So unlike every other profession, you're not a real infosec researcher unless you're not in it for the money? Just about everyone does their job for the money. Are we all mercenaries too?
- marcoperaza 11y agoThe big tech companies would love that. If all researchers lived up to your standard, then there would be no vulnerability market—no bug bounties—and researchers would get paid peanuts. They'd be free labor for tech companies. "Researcher" means that you research, not that you work for free.