7 ms·
One presumes that Spectre/Meltdown-level bugs are each worth substantially more to the computer industry than $250k.
by ISL 9y ago
One presumes that Spectre/Meltdown-level bugs are each worth substantially more to the computer industry than $250k.
- GoToRO 9y agoYou would think. But if you don't buy Microsoft, Apple, Intel, AMD what do you buy? There is no alternative.
- ISL 9y agoThe mitigation and litigation costs to the large players, even in the case of a successful defense, are surely larger than $250k.
- GoToRO 9y agoFor sure. But then you need somebody with vision, that will spend extra money on research so that these kinds of bugs don't happen. Then a new "smart" CEO comes and slashes budgets. Everybody is happy, they have the same sales but lower costs. Then, after years, the bugs are found. Now it's too late. You have to allocate money to mitigate and on top of that you have to spend more money on research and then spend a little on bug bounties. It's too late to go back now. The problem is how do you recognize a truly good CEO vs. a CEO that lowers costs and makes everybody happy.
- tux1968 9y agoMarket pressure will always drive outcomes, so you have to incentivize for the outcome you desire. It's far from clear how to bias such speculative (no pun intended) future costs against immediate returns even if you could identify a truly good CEO.
- anonymfus 9y ago>Market pressure will always drive outcomes Not necessary! Many CPU architectures and implementations were created by academic institutions, so nationalisation of this industry should be considered a possibility.
- eftychis 9y agoMarket does not. CEOs are incentivized to please the markets and thus reduce investing at some point to prepare to exercise their stock options and sell. (There is plenty of discussion on what the exercise date should be and some people are pushing beyond 4 years for that reason.) A lot of companies set a 4 year window for their CEOs. Funneling capital into research, displeases stock holders, as you show reduced earnings. Observe that markets care about steady earning growth; catching these things before they happen in general will not earn you points. That is a sad part of human psychology. Think as a metaphor that an average manager will ask how many bugs did this guy fix and not how many bugs and security issues did this guy caught or saved us from. (See freaking Equifax -- https://www.marketwatch.com/investing/stock/efx https://www.marketwatch.com/investing/stock/efx -- they should have been out of business [my personal opinion]. Their stock price is fine. The only mistake of the CEO as far as SEC is concerned is he used inside information and sold.)
- loosescrews 9y agoThese bugs are probably most valuable against cloud providers (Where else do you get arbitrary code execution on a machine with other's valuable data on it?). Most cloud providers run Linux, not Microsoft (except Microsoft) and definitely not Apple.
- guscost 9y agoMicrosoft also runs the second largest cloud provider in the world.
- foobarian 9y agoThe problem is that even if there is no practical exploit, you still have to patch. At our web company where there are no shared boxes we still spent untold resources upgrading kernels, rebooting servers, and then lost capacity due to performance degradations. Infrastructure is normally patched and rebooted on a regular schedule, but when a bug like this hits and requires an off-cycle upgrade it's a big cost.
- gopalakrishnans 9y agoMicrosoft does have a lot of Linux VMs https://azure.microsoft.com/en-us/services/virtual-machines/ https://azure.microsoft.com/en-us/services/virtual-machines/
- loosescrews 9y agoWhat matters is the host OS, not the guest.
- _emacsomancer_ 9y agoRaspberry Pi? It was unaffected [https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulne...].
- loeg 9y agoYou're joking, right? Raspberry pi is a toy computer — which is entirely related to why it was unaffected by speculation leaks. It does not fulfill the same needs as full size x86 chips.
- ComputerGuru 9y agoMeh. They got lucky because they didn’t use affected hardware due to valuing price over performance. It’s certainly not because of any brilliant insight or preventative measures they took.
- krylon 9y agoI know it is not a realistic alternative for many needs, but Intel's Atom cores are not affected by Meltdown or Spectre.
- Grollicus 9y agoOn the other hand there are always altruists that release these kinds of bugs for free. So why spend money on it? 250k is a huge bug bounty. It's a step in the right direction.
- qaq 9y agoon gray market it's worth 10X that
- xarball 9y agoI think Microsoft is trying to fill in a meaningful, yet tentative part of the pie. It wouldn't be right for them to put forward the full cost of every cloud company's potential losses. At the same time it raises the stakes by begging the question for other cloud providers to fill in by asking "why isn't this higher?" So in that light, the number they've chosen may have served its purpose quite well, by encouraging others to think about what another massive 0-day CPU security flaw might cost them.
- qaq 9y agoApple already had a bounty in the same ball park pretty much 0 takers.
- lpasselin 9y agoIs it legal to sell exploits?
- qaq 9y agoSure there are gov. agencies that will buy them
- tptacek 9y agoIn the general case, yes, but there are specific cases --- and they are probably more common than you'd be comfortable with --- in which the answer is probably "no". It's legally very dangerous to sell a vulnerability to someone who is going to use it to break the law.
- davidkopf 9y agoYes but the question is how much is 250k incentivizing bounty hunters?
- deleted 9y ago[deleted]
- ohf 9y ago5-6 years of living expenses.
- brianwawok 9y agoOr 1 year SV senior developer pay Fixed price anything (job, bounty) means very different things to different people.
- kbenson 9y agoSure, but why would you advertise to those people? There are many very talented people in parts of the world that aren't the premier market for their skills that accept much lower salaries for their skills, or are employed in other industries altogether. I wouldn't be surprised if the number of people that match that criteria and have security research experience is much higher than the number of people in Silicon Valley and the other 5-10 leading tech markets that have the requisite security experience. The world is a big place, and I think exploring security is fairly attractive to the weekend warrior programmer that might find other work hard to come by.
- bluedino 9y agoEven more in many countries
- mkagenius 9y agoThe government should let go the taxes on such bugs (not all).
- icebraining 9y ago
- electrograv 9y agoRelated: Why was the $250k edited out of the title just now? That seems rather relevant (and it reflects the actual article title).
- ohf 9y agoProbably because it isn't the core conversation. What matters is that Microsoft is pushing bug bounties, not how big they are. But it's really splitting hairs. I don't really get it either - just a guess.
- seabird 9y agoThe size does matter. The amount posted for bug bounties is usually pitifully low compared to the magnitude of the bug. If you've got money on your mind, there's pretty much no reason to fill a bug bounty for a large vulnerability when there's people that will pay ten or twenty times more for it.
- dsacco 9y ago> when there's people that will pay ten or twenty times more for it. Ten or twenty times more! But who are these people?! Where do I go to sell them??
- tptacek 9y agoPeople are downvoting Dylan but it'd be neat if for once someone could try answering, as specifically as they can, who exactly he would sell to to beat a bounty price.
- jsjohnst 9y agoHere’s some information you might find useful. https://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ https://tsyrklevich.net/2015/07/22/hacking-team-0day-market/
- 9y ago
- yoodenvranx 9y agoIf I had the choice I would take 250k$ non-sketchy money from MS over any amount of xxx sketchy money from any other company. Yes, youcould get a lotmore money insome cases but MS will be the easiest way to get it.
- rplnt 9y agoIt's not only that the money is sketchy, you'll most likely won't know who you are selling to and how it will be used. Conscience might bite you in the ass.
- brianwawok 9y agoIf you are selling a 0-day exploit on the black market for 7 figures, I am pretty sure you are already accepting that it is being used for evil and not bettering the world.
- okreallywtf 9y agoNot only that, but imagine how many services you and your family and friends use that could be compromised? It could end up costing you unless you and your family pull out of all your online services. The ultimate irony would be if your bank(s) got compromised by your but and some of your money was lost.
- cm2187 9y agoDefine sketchy. Is an israeli company who will be then reselling the exploit to all sort of law enforcement agencies from democratic countries and less democratic countries sketchy? It's certainly safe from a legal point of view.
- Waterluvian 9y agoThe reward doesn't need to be proportional. It has to be sufficient to get people motivated. When I reward you for finding my wallet I don't give you the entire contents of it, even though I would have lost that much money.