4 ms·

While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to sho

by bink 10y ago

While what he's doing is completely unethical, I don't know if I'd go so far as to say it's putting anyone at risk. Placing a call to an investment firm to short a stock shouldn't take so long as to delay the release of an advisory. That being said I don't like what I'm seeing in some parts of the security community as of late. Security is becoming a misnomer as companies and groups are actively hoarding and selling vulnerabilities and making us all less safe.

chillydawg 10y ago
Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.
- SSLy 10y ago
  which sony isn't…
lawnchair_larry 10y ago
Or is it the manufacturer being unethical?
harmegido 10y ago
I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).

by bink 10y ago

chillydawg 10y ago

Companies like google, facebook and microsoft are forced to spend bajillions either finding their own bugs and fixing them or buying the bugs and fixing them. Can you imagine the fallout of a massive google or facebook data breach? It's probably their single biggest risk. I rest easy at night knowing $100bn+ firms have a very strong economic incentive to find and fix security flaws of all kinds.

SSLy 10y ago
which sony isn't…

lawnchair_larry 10y ago

Or is it the manufacturer being unethical?

harmegido 10y ago

I don't view this as unethical. I think it actually promotes security. Consider that there are lots of products out there with serious vulnerabilities that no one knows about. A bad actor has tons of incentive to try to find these and keep it secret while exploiting it (for whatever their nefarious aims are). White hats have very little incentive to do so - bug bounties are a joke. So it may be worthwhile for a black hat to spend millions in security research, but it wouldn't for a white hat. The incentives are out of balance. This type of action presents a way to balance out the incentives. The good actor here only benefits by telling the world about the vulnerability, at which point any users can demand a fix or stop using the product (I realize this specific product is a bit tougher to stop using, but the point remains for most other cases).