3 ms·
24 hours means they don't deserve to be called security researchers. They're exploit creators. Given the material effect this would have on AMD's stock, one mig
by notacoward 9y ago
24 hours means they don't deserve to be called security researchers. They're exploit creators. Given the material effect this would have on AMD's stock, one might also reasonably speculate about their financial interests.
- strictnein 9y agoThis. Especially with the disclaimer that others have noted: > "we may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports"
- tptacek 9y agoOne difference between security researchers and "exploit creators", which is a term I think you just made up, is that exploit creators presumably release exploits. Don't tell HD Moore or the Metapsloit team about this, though. They may cry themselves to sleep tonight.
- notacoward 9y agoCreation and release are two different things. They have created the exploits, or else AMD wouldn't be taking them seriously. They have also contributed more to the re-creation of those exploits by others than they have to security. So you can quibble over whether others use the exact jargon that you would have, but that doesn't change the underlying reality.
- tptacek 9y agoEvery security researcher creates exploits, so I'm not really sure what the distinction you're trying to make is.
- unethical_ban 9y agoVulnerability and Exploit are different.
- pbhjpbhj 9y agoCan you demonstrate a vulnerability without producing an exploit? You have to provide a poc to demonstrate it to others at least, no? Two sides of the same coin
- unethical_ban 9y agoYou can release the concept and description of a vulnerability without releasing an operational exploit.
- davesque 9y agoYou don't have to speculate. They admit having financial interests in the actual text of their report.