6 ms·

That's an interesting explanation. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 whic

That's an interesting explanation. "We have decided to disclose this exploit as it has reached its end-of-life and it's not affecting Tor Browser version 8 which was released last week. We also wanted to raise awareness about the lack (or insufficient) security auditing of major components bundled by default with Tor Browser and trusted by millions of users." is the explanation provided by Zerodium. End of life? Raise awareness? Sounds like shitty PR to me... There must be other explanations. Anyone has any idea, beyond the one already provided above?

emerongi 8y ago
Maybe there's a slight chance that they just want to undermine Tor and make people question its security. But honestly, the parent's idea seems quite likely.
- rav 8y ago
  If they're in the business of buying and selling Tor browser zero-days, I'd think they shouldn't be undermining the adoption of the Tor browser...?
  - emerongi 8y ago
    Some agency might want to do that. Could have just paid Zerodium to make such a strong statement.
    - loa-in-backup 8y ago
      Cheaper than decrypting and mitm-ing all this traffic. Scare ordinary people away, more likely it is to random pick a valid target
  - dwild 8y ago
    They are in the business of buying and selling any zero-days. Tor browser primary goal is to be secure, unlike any other browser (which may still want to be secure but have many others goals). This zero day isn't exactly one either if you think about it, it only allow to run JS, which is a default feature on any other browser. So they essentially lose nothing over it. People won't stop using internet and move toward written letters... they will just move toward other browser or update their browser, they will still be using something that Zerodium are buying and selling zero days for.
caust1c 8y ago
Occam's Razor. It's good publicity for them. I'd never heard of them until today. Now I have a new company to hate.

emerongi 8y ago

Maybe there's a slight chance that they just want to undermine Tor and make people question its security. But honestly, the parent's idea seems quite likely.

rav 8y ago
If they're in the business of buying and selling Tor browser zero-days, I'd think they shouldn't be undermining the adoption of the Tor browser...?
- emerongi 8y ago
  Some agency might want to do that. Could have just paid Zerodium to make such a strong statement.
  - loa-in-backup 8y ago
    Cheaper than decrypting and mitm-ing all this traffic. Scare ordinary people away, more likely it is to random pick a valid target
- dwild 8y ago
  They are in the business of buying and selling any zero-days. Tor browser primary goal is to be secure, unlike any other browser (which may still want to be secure but have many others goals). This zero day isn't exactly one either if you think about it, it only allow to run JS, which is a default feature on any other browser. So they essentially lose nothing over it. People won't stop using internet and move toward written letters... they will just move toward other browser or update their browser, they will still be using something that Zerodium are buying and selling zero days for.

caust1c 8y ago

Occam's Razor. It's good publicity for them. I'd never heard of them until today. Now I have a new company to hate.