8 ms·

But someone isn't. That's the point. These bugs don't go for $10k on the black market.

by argonaut 10y ago

rl3 10y ago
That's odd considering the potential monetary damage of such bugs can far exceed $10k.
- XMPPwocky 10y ago
  One can smash a car up with a sledgehammer. Is the value of a sledgehammer equal to the value of a car?
  - deleted 10y ago
    [deleted]
  - rl3 10y ago
    >Is the value of a sledgehammer equal to the value of a car? My previous post was poorly worded; I didn't mean to imply equality. To use your analogy, valuing a serious vulnerability on a platform that has 1.65B users in the $5-10k range is tantamount to selling a 30lb sledge hammer for a dollar.
    - ponyfleisch 10y ago
      But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
      - rl3 10y ago
        Rather than torture this analogy further: Obviously exploit pricing is generally efficient and adheres to free market principles. That said, it's hypothetically possible that an exploit against a large tech company could sell for far more if the circumstances are right, considering the price to damage ratio is so skewed in addition to the unique nature of each exploit. Therefore, large tech companies don't really have much to lose by paying far more than they currently do on bounties. Granted, eliminating what's largely a hypothetical edge case is not the primary benefit to paying higher; incentivizing far more white hat researchers is.
  - tptacek 10y ago
    Stealing this.
    - dopamean 10y ago
      Me too. It really gets straight to the point.
- colanderman 10y ago
  The problem with valuing bugs at their damage potential is that the total damage potential of all bugs in any given product is almost certainly magnitudes greater than the total value of the product itself.
peeters 10y ago
Never mind the fact that it does matter to a lot of people whether they are committing a crime. Not everyone is a capitalist sociopath. If someone without a conscience wanted to maximize their profit, they'd probably just sell to both sides.

But someone isn't. That's the point. These bugs don't go for $10k on the black market.

rl3 10y ago

That's odd considering the potential monetary damage of such bugs can far exceed $10k.

XMPPwocky 10y ago
One can smash a car up with a sledgehammer. Is the value of a sledgehammer equal to the value of a car?
- deleted 10y ago
  [deleted]
- rl3 10y ago
  >Is the value of a sledgehammer equal to the value of a car? My previous post was poorly worded; I didn't mean to imply equality. To use your analogy, valuing a serious vulnerability on a platform that has 1.65B users in the $5-10k range is tantamount to selling a 30lb sledge hammer for a dollar.
  - ponyfleisch 10y ago
    But what if producing a sledgehammer only cost 50 cents? Then people would sell sledgehammers for a dollar or less.
    - rl3 10y ago
      Rather than torture this analogy further: Obviously exploit pricing is generally efficient and adheres to free market principles. That said, it's hypothetically possible that an exploit against a large tech company could sell for far more if the circumstances are right, considering the price to damage ratio is so skewed in addition to the unique nature of each exploit. Therefore, large tech companies don't really have much to lose by paying far more than they currently do on bounties. Granted, eliminating what's largely a hypothetical edge case is not the primary benefit to paying higher; incentivizing far more white hat researchers is.
- tptacek 10y ago
  Stealing this.
  - dopamean 10y ago
    Me too. It really gets straight to the point.
colanderman 10y ago
The problem with valuing bugs at their damage potential is that the total damage potential of all bugs in any given product is almost certainly magnitudes greater than the total value of the product itself.

peeters 10y ago

Never mind the fact that it does matter to a lot of people whether they are committing a crime. Not everyone is a capitalist sociopath. If someone without a conscience wanted to maximize their profit, they'd probably just sell to both sides.