5 ms·
On the other hand there are always altruists that release these kinds of bugs for free. So why spend money on it? 250k is a huge bug bounty. It's a step in the
by Grollicus 9y ago
On the other hand there are always altruists that release these kinds of bugs for free. So why spend money on it?
250k is a huge bug bounty. It's a step in the right direction.
- qaq 9y agoon gray market it's worth 10X that
- xarball 9y agoI think Microsoft is trying to fill in a meaningful, yet tentative part of the pie. It wouldn't be right for them to put forward the full cost of every cloud company's potential losses. At the same time it raises the stakes by begging the question for other cloud providers to fill in by asking "why isn't this higher?" So in that light, the number they've chosen may have served its purpose quite well, by encouraging others to think about what another massive 0-day CPU security flaw might cost them.
- qaq 9y agoApple already had a bounty in the same ball park pretty much 0 takers.
- lpasselin 9y agoIs it legal to sell exploits?
- qaq 9y agoSure there are gov. agencies that will buy them
- tptacek 9y agoIn the general case, yes, but there are specific cases --- and they are probably more common than you'd be comfortable with --- in which the answer is probably "no". It's legally very dangerous to sell a vulnerability to someone who is going to use it to break the law.
- Grollicus 9y agoNot that I'd ever find something like Spectre but I would not want to sell it to people who use it to kill people. On the other hand, I'd like to get something for my work. Also, I think the temptation to go black hat is a lot lower than if the choices were "nothing" vs "millions"
- qaq 9y agoWell you can look at similar programs from Apple etc. and see how many takers they had. So while it's nice to imagine what "I" would do in such a situation it looks like people who actually can do this on average take the high $ payout route. It has nothing to do with black hat btw. There are gov. agencies that will pay for this stuff.
- Grollicus 9y agoAnd the same gov. agencies will then use it against people who report on the next Snowden leaks. It has everything to do with black hat.
- stagbeetle 9y agoOff-topic, but Snowden is seen as controlled opposition in a good amount of infosec circles -- the one's that aren't plugged into the infosec clique machine atleast. Not to defend the government, but Snowden was hyped up when in return his leaks brought us nowhere new, but giving the laymen new words to throw around.
- duxup 9y agoYeah, clean money has some extra value.
- jsjohnst 9y agoHow do you define “clean money”? Do you call government agency money “unclean”? I could easily see someone making that statement with justification, but your post is a bit vague so wanted to ask.
- dsacco 9y agoWhere do I go to sell?