3 ms·
> In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it. That sounds like black market buyers (ma
by dsl 9y ago
> In reality, if your bug isn't a drive-by clientside in a popular client, it is unlikely that anyone wants to buy it.
That sounds like black market buyers (maybe we disagree on where the "gray" line is). Governments are very interested in bugs that allow pivoting and lateral movement.
- daddyo 9y agoHow would one, hypothetically, go about selling exploits/bugs to governments as a freelancer?
- big_youth 9y agoPlenty of brokers exist, I'm personally familiar with Exodus Intelligence and Zerodium
- dsacco 9y agoThe nature of the work is such that: 1. If you have to ask this question, you are quite far from being able to do it any time soon (and that's assuming you can find the vulnerabilities!), 2. You will predominantly sell your vulnerabilities, preferably weaponized as complete exploits, to firms that specialize in "vulnerability research" and "exploitation development" with close ties to government agencies. It's much easier to find a firm that can act as a broker between you and the government agency than it is to knock on the right doors to sell it on your own, with no background or prior contact.