3 ms·

There was a guy who got thrown in prison for bringing a vulnerability to the attention of AT&T. He was thrown in solitary confinement for over a year. Then his

by jart 10y ago

There was a guy who got thrown in prison for bringing a vulnerability to the attention of AT&T. He was thrown in solitary confinement for over a year. Then his sentence got vacated. What did he do as soon as he was released from prison? He went on CNBC to argue that independent security researchers should start a hedge fund that short sells the stocks of companies affected by vulnerabilities. https://youtu.be/jxUWRRDdhVI https://youtu.be/jxUWRRDdhVI He seems to be of the opinion that this would be a less risky strategy than bringing those issues to the attention of many companies. He also believes that profit incentives for researchers will serve the public interest, because it creates economic disincentives against big companies having insecure software.

spectrum1234 10y ago
This is brilliant. And if companies are going to be so resistant this is the obvious solution.
- netsharc 10y ago
  Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
  - pbhjpbhj 10y ago
    Then the company could contact the fund holders for information and they could tell them "we'll let you know about the vulnerability in a month or two".
noir_lord 10y ago
Company name is TRO LLC. That is hilarious.
3pt14159 10y ago
He didn't "bring the vulnerability to the attention of AT&T" he fucking told Gawker first. Furthermore, he's part of a number of black hat hacker groups, including an anti-semitic one despite the fact that he's Jewish. There are examples of honest people getting fucked over, but this isn't one of them.
evilDagmar 10y ago
Honestly, that guy went to jail for being an asshole more than anything else. If at any point he had attempted to curry favor or at least neutrality, the outcome likely would have been far different. As it stands, literally everyone who would have been in a position to be reasonable was someone he'd actively worked at pissing off. Not in the sense of someone he'd pissed off in the past, but as someone he was actively pissing off in conjunction with this issue. The moral of his story is that there's room for aggressive incident reporting, but not if one is going to be an insufferable jerk about it.

by jart 10y ago

spectrum1234 10y ago

This is brilliant. And if companies are going to be so resistant this is the obvious solution.

netsharc 10y ago
Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
- pbhjpbhj 10y ago
  Then the company could contact the fund holders for information and they could tell them "we'll let you know about the vulnerability in a month or two".

noir_lord 10y ago

Company name is TRO LLC. That is hilarious.

3pt14159 10y ago

He didn't "bring the vulnerability to the attention of AT&T" he fucking told Gawker first. Furthermore, he's part of a number of black hat hacker groups, including an anti-semitic one despite the fact that he's Jewish. There are examples of honest people getting fucked over, but this isn't one of them.

evilDagmar 10y ago

Honestly, that guy went to jail for being an asshole more than anything else. If at any point he had attempted to curry favor or at least neutrality, the outcome likely would have been far different. As it stands, literally everyone who would have been in a position to be reasonable was someone he'd actively worked at pissing off. Not in the sense of someone he'd pissed off in the past, but as someone he was actively pissing off in conjunction with this issue. The moral of his story is that there's room for aggressive incident reporting, but not if one is going to be an insufferable jerk about it.