6 ms·
This is a scary precedent. From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group
by pcl 11y ago
This is a scary precedent.
From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group.
Just skipping it altogether because "we paid a contractor" completely subverts the process. What's stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?
- nxzero 11y agoMakes you wonder who is really "Public Enemy No. 1" now.
- ilyanep 11y agoPublic: enemy no. 1
- kodablah 11y agoHow are they supposed to submit a vulnerability they don't know about? I'm willing to bet they chose to remain willfully ignorant of the details. Are you saying they should not be allowed to outsource the work but instead must obtain the full exploit or nothing? The real scary precedent is that they paid that much without obtaining the vulnerability exclusively and the technical aspect behind it. Or maybe it's not a scary precedent (except in tax monies) that they outsourced the vulnerability without obtaining the know-how to reuse it on a whim. Either way you look at it, it is opaque, regardless of whether it goes through the VEP (and the ERB within) or they use a secret company. Were one way more transparent than the other then we should definitely favor that approach.
- deleted 11y ago[deleted]
- bhuga 11y agoIt's bad enough that the VEP was bypassed, but the high-profile, 7-figure payout for the security researchers who had their hands on the bug is a problem too. Plenty of bug bounty programs have remote code execution at $10k, but the FBI paid _100 times_ that. That's an amount of money that some bug hunters might find very challenging to turn down. And this is "above board", with no shady bitcoin payments from dingy IRC channels.
- zeckalpha 11y agoEven with it 100 times more, its still cheaper than the legal fees they were facing.
- ryanlol 11y agoThe payout wasn't particularly big, bug bounty rewards are just a bit of a joke.
- madaxe_again 11y agoYou assume they were "security researchers" and not, say, a black-hat syndicate based out of Anonymouskaya Oblast.
- bsder 11y agoWhy do you think SAIC has so many government contracts? Part of it is that the government can have SAIC or their subcontractors do the shady things that the government might actually get taken to task for.
- deleted 11y ago[deleted]
- madaxe_again 11y agoWell, what I read this as is "the FBI supports organised crime". I mean, they've paid black hats for an exploit, and are now protecting their identities. What if the FBI colluded with a mobster - oh, Bulger. Yeah, nothing new here, just the same old crooks being the same old crooks.