4 ms·

(Disclosure: I'm working on a med device security startup.) Taking public short positions, then publicizing vulnerabilities is perhaps the shittiest way to ens

by mikekij 10y ago

(Disclosure: I'm working on a med device security startup.) Taking public short positions, then publicizing vulnerabilities is perhaps the shittiest way to ensure patients are not harmed by these vulnerabilities. I wonder if Carson Block would be as enthusiastic about this approach if his grandmother had a St. Jude ICD in her chest.

ISL 10y ago
There may be some white-hat middle ground; disclose the vulnerability to the vendor, wait 90 days, if no patch has been released/recall initiated, it's open season for the short sellers....
- IshKebab 10y ago
  That doesn't exactly incentivise the vendor to prevent future vulnerabilities though.
- tomp 10y ago
  No, the problem is that these companies don't pay the fair price (i.e. what their unvestors stand to lose if knowledge of this vulnerability is disclosed) to the researchers. Personally, I don't feel any kind of moral obligation to essentially sponsor the investors of these companies (if I were a security researcher).
  - dsfyu404ed 10y ago
    If I have a 95% chance of losing a dollar from a vulnerability. I'm not gonna pay you a dollar for it. I have a 100% chance of losing a dollar that way and a 95% chance if I don't. Even if I buy it from you it may cost me 50 cents to fix it. Then I lose $1.50. If I pay you 45 cents then I break even if the process scales up to tons of $1 95% vulnerabilities that can be fixed for 50 cents. Fair price is a pipe dream. But considering the huge sums of money that are involved something more than "here's $500, thanks for your time" would be nice. As it stands if you're good at breaking stuff you can make more money breaking it for the bad guys than for the good guys. No other industry has this problem. E.g. a good lockpicker or safe cracker can make more money performing his/her trade legitimately.
    - SolarNet 10y ago
      I think the point of short selling is an activist way of saying "Have a fair price or see your stock price plummet when we do it the other way."
bink 10y ago
While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to short a stock shouldn't take so long as to delay the release of an advisory. That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.
- chillydawg 10y ago
  Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.
  - SSLy 10y ago
    which sony isn't…
- lawnchair_larry 10y ago
  Or is it the manufacturer being unethical?
- harmegido 10y ago
  I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).
chillydawg 10y ago
I dunno. It forces new entrants to not screw about when it comes to security. If there is a very real threat of a predatory security/short crew trying to take you down, you're going to invest in security and make sure your product is better.
deleted 10y ago
[deleted]
dandermotj 10y ago
This guy has three options: 1) short 2) go long 3) do nothing. Given he knows about this vulnerability, what is the "ethical" thing to do. But the stock? Don't engage? I think, in fact, he has a duty to short the stock.
onewaystreet 10y ago
Unless med companies start paying these security companies to find bugs (which they don't) they will need to find other ways to make money or stop looking all together.
ourmandave 10y ago
Is this an actual thing I have to worry about? Oh noes! The Russian hackers are gonna kill gma unless I pay 'em all the bitcoins!

by mikekij 10y ago

ISL 10y ago

There may be some white-hat middle ground; disclose the vulnerability to the vendor, wait 90 days, if no patch has been released/recall initiated, it's open season for the short sellers....

IshKebab 10y ago
That doesn't exactly incentivise the vendor to prevent future vulnerabilities though.
tomp 10y ago
No, the problem is that these companies don't pay the fair price (i.e. what their unvestors stand to lose if knowledge of this vulnerability is disclosed) to the researchers. Personally, I don't feel any kind of moral obligation to essentially sponsor the investors of these companies (if I were a security researcher).
- dsfyu404ed 10y ago
  If I have a 95% chance of losing a dollar from a vulnerability. I'm not gonna pay you a dollar for it. I have a 100% chance of losing a dollar that way and a 95% chance if I don't. Even if I buy it from you it may cost me 50 cents to fix it. Then I lose $1.50. If I pay you 45 cents then I break even if the process scales up to tons of $1 95% vulnerabilities that can be fixed for 50 cents. Fair price is a pipe dream. But considering the huge sums of money that are involved something more than "here's $500, thanks for your time" would be nice. As it stands if you're good at breaking stuff you can make more money breaking it for the bad guys than for the good guys. No other industry has this problem. E.g. a good lockpicker or safe cracker can make more money performing his/her trade legitimately.
  - SolarNet 10y ago
    I think the point of short selling is an activist way of saying "Have a fair price or see your stock price plummet when we do it the other way."

bink 10y ago

While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to short a stock shouldn't take so long as to delay the release of an advisory. That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.

chillydawg 10y ago
Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.
- SSLy 10y ago
  which sony isn't…
lawnchair_larry 10y ago
Or is it the manufacturer being unethical?
harmegido 10y ago
I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).

chillydawg 10y ago

I dunno. It forces new entrants to not screw about when it comes to security. If there is a very real threat of a predatory security/short crew trying to take you down, you're going to invest in security and make sure your product is better.

deleted 10y ago

[deleted]

dandermotj 10y ago

This guy has three options: 1) short 2) go long 3) do nothing. Given he knows about this vulnerability, what is the "ethical" thing to do. But the stock? Don't engage? I think, in fact, he has a duty to short the stock.

onewaystreet 10y ago

Unless med companies start paying these security companies to find bugs (which they don't) they will need to find other ways to make money or stop looking all together.

ourmandave 10y ago

Is this an actual thing I have to worry about? Oh noes! The Russian hackers are gonna kill gma unless I pay 'em all the bitcoins!