6 ms·

Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive

Earlier tweets from this account seem to indicate they believe MS intentionally sabotaged the process so that they could sell the bugs, including to oppressive governments: https://twitter.com/SandboxEscaper/status/1034116189373521920 https://twitter.com/SandboxEscaper/status/103411618937352192... https://twitter.com/SandboxEscaper/status/1034112926045622274 https://twitter.com/SandboxEscaper/status/103411292604562227... EDIT as @dixie_land points out, it appears the author is open to selling indiscriminately.

dixie_land 8y ago
I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.
- qeternity 8y ago
  Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
- deleted 8y ago
  [deleted]
Rotdhizon 8y ago
I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?
- ghostbrainalpha 8y ago
  Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.
mockingbirdy 8y ago
Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.
- daxorid 8y ago
  Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
  - mockingbirdy 8y ago
    Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
    - throwawayjava 8y ago
      And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
      - LinuxBender 8y ago
        If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.
samstave 8y ago
Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.
deleted 8y ago
[deleted]
exikyut 8y ago
Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf

dixie_land 8y ago

I don't know how you reached that conclusion. The tweets read to me that the author is willing to sell to the highest bidder.

qeternity 8y ago
Yeah, fair point. I think the thread that tweet is part of reads better the way you read it. Will edit my comment.
deleted 8y ago
[deleted]

Rotdhizon 8y ago

I'm not understanding. Is this lady mad because she wants to get out of bug hunting, so she found a major MSFT bug and tried to sell it, and they patched it and thwarted her attempt at that?

ghostbrainalpha 8y ago
Definitely not that. Microsoft has not patched the issue. That's why its a big deal that she is posting it on Twitter.

mockingbirdy 8y ago

Please see https://news.ycombinator.com/item?id=17860480 https://news.ycombinator.com/item?id=17860480 before downvoting. From her website - http://sandboxescaper.blogspot.com http://sandboxescaper.blogspot.com: > I'm also transgender. But my transition so far has been really difficult (social isolation, lack of support.. etc), my voice is still really manly and I don't really pass at all (which probably weirds people out.. so I would rather say it upfront so I don't need to have anxiety about it, I have alot of anxiety issues). I also have not been able to change my name yet, legally its still "Thomas". - - - w.r.t. the 0-day release: Well that's some seriously irresponsible stuff right there. I think she has a tough time (she's transgender and doesn't have support from her peers). It's sad that she hasn't found a way to live a happy life although she clearly has serious skills. I hope she'll be fine. It's just annoying that a lot of users are now at risk, I hope the patches will be installed ASAP.

daxorid 8y ago
Full disclosure is not "irresponsible", and plenty of researchers do it even in the absence of armchair psychoanalysis by the Internet.
- mockingbirdy 8y ago
  Most of them follow specific timelines for those disclosures which are communicated with the affected vendor.
  - throwawayjava 8y ago
    And also don't follow up a disclosure with an offer to sell exploits to the highest bidder. Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)
    - LinuxBender 8y ago
      If you sold to a country with standing sanctions, that could be an issue. 0-day's can also be considered munitions in some interpretations of law, though I am not a lawyer nor a weapons dealer.

samstave 8y ago

Are you saying that MSFT wanted to be sure to maintain MSFT's prerogative to sell the exploit to oppressive governments? If this is the case, which I can see how it could be, then this is the bigger story for those outside of Tech circles to understand.

deleted 8y ago

[deleted]

exikyut 8y ago

Both tweets were deleted - but Google still had them cached! \o/ 1st link -> http://archive.is/8xh4z http://archive.is/8xh4z 2nd link -> http://archive.is/KGyCf http://archive.is/KGyCf