3 ms·

There may be some white-hat middle ground; disclose the vulnerability to the vendor, wait 90 days, if no patch has been released/recall initiated, it's open sea

• IshKebab 10y ago
  That doesn't exactly incentivise the vendor to prevent future vulnerabilities though.
• tomp 10y ago
  No, the problem is that these companies don't pay the fair price (i.e. what their unvestors stand to lose if knowledge of this vulnerability is disclosed) to the researchers. Personally, I don't feel any kind of moral obligation to essentially sponsor the investors of these companies (if I were a security researcher).
  • dsfyu404ed 10y ago
    If I have a 95% chance of losing a dollar from a vulnerability. I'm not gonna pay you a dollar for it. I have a 100% chance of losing a dollar that way and a 95% chance if I don't. Even if I buy it from you it may cost me 50 cents to fix it. Then I lose $1.50. If I pay you 45 cents then I break even if the process scales up to tons of $1 95% vulnerabilities that can be fixed for 50 cents. Fair price is a pipe dream. But considering the huge sums of money that are involved something more than "here's $500, thanks for your time" would be nice. As it stands if you're good at breaking stuff you can make more money breaking it for the bad guys than for the good guys. No other industry has this problem. E.g. a good lockpicker or safe cracker can make more money performing his/her trade legitimately.
    • SolarNet 10y ago
      I think the point of short selling is an activist way of saying "Have a fair price or see your stock price plummet when we do it the other way."