4 ms·

With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a m

With regard to this, maybe there’s an opportunity for a market maker to step in. An “Uber for vulnerabilities”. Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.

niklasb 8y ago
I think the author is referring to third parties which buy and disclose vulnerabilities. Very hard to monetize. There is already a flourishing market for undisclosed vulnerabilities, for obvious reasons.
auslander 8y ago
It is called darknet :)
- TheSpiceIsLife 8y ago
  Sorry, I should have been clearer. I meant a non-darknet market. Like somehow being able to have a third party negotiate payout rates for bug bounties. I have no idea what the might look like.
  - cthor 8y ago
    Probably would look like a union (a dirty word in software), where their collective bargaining allows them to have leverage on software firms and have policies to punish non-payment in an ethical way. Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received before deadline, they get full, private disclosure. If not, then exploit is made public. Union takes a cut. Security researchers don't really need a market maker. (It's not a real market: Actually converting exploits into money is typically antisocial and illegal.) They need someone to negotiate for them.
    - jstanley 8y ago
      That's starting to sound quite close to blackmail. "I have remote code execution in your product, pay me XXX or I'll tell everyone". I don't actually know if it is blackmail, but if it is, hiding behind a union isn't enough to make it not-blackmail.
cthor 8y ago
These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly. The other trouble is that a lot of the damages (or value) of software bugs aren't readily fungible to dollars. For example, to actually profit from the Ashley Madison hack you'd need to blackmail a whole lot of people, which is incredibly time consuming. So software firms would be able to underpay for most exploits: The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility.
- Nerdfest 8y ago
  "The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility." So basically, their value.
  - Too 8y ago
    I wouldn't put it that way. The potential value lost (reputation, downtime, etc) for the vendor could be more than the value an attacker might gain. It's not a slice of cake that is exchanging hands. The attacker might only be interested in the cherry on the top but he could also destroy the rest of the cake in the process.
- dev_dull 8y ago
  > There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. Is this really a thing? Who are these firms and what is their take?
  - icebraining 8y ago
    One example: http://www.zerodium.com/program.html http://www.zerodium.com/program.html
profalseidol 8y ago
> Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome. Yeah. Just look at where we are today. But calling it "perverse outcome" is sugar coating it. If it wasn't for profit being the king of all (and being the current common sense). Then we would've put more time into making software more secure.
- icebraining 8y ago
  Software not made for profit is very often no more secure. The problem is not profit, it's that these security issues don't really lower it enough. I've seen the profit motive working very well in a couple of companies when the threat of lowering them (in the form of large fines) appeared thanks to the GDPR.

niklasb 8y ago

I think the author is referring to third parties which buy and disclose vulnerabilities. Very hard to monetize. There is already a flourishing market for undisclosed vulnerabilities, for obvious reasons.

auslander 8y ago

It is called darknet :)

TheSpiceIsLife 8y ago
Sorry, I should have been clearer. I meant a non-darknet market. Like somehow being able to have a third party negotiate payout rates for bug bounties. I have no idea what the might look like.
- cthor 8y ago
  Probably would look like a union (a dirty word in software), where their collective bargaining allows them to have leverage on software firms and have policies to punish non-payment in an ethical way. Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received before deadline, they get full, private disclosure. If not, then exploit is made public. Union takes a cut. Security researchers don't really need a market maker. (It's not a real market: Actually converting exploits into money is typically antisocial and illegal.) They need someone to negotiate for them.
  - jstanley 8y ago
    That's starting to sound quite close to blackmail. "I have remote code execution in your product, pay me XXX or I'll tell everyone". I don't actually know if it is blackmail, but if it is, hiding behind a union isn't enough to make it not-blackmail.

cthor 8y ago

These already exist. There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly. The other trouble is that a lot of the damages (or value) of software bugs aren't readily fungible to dollars. For example, to actually profit from the Ashley Madison hack you'd need to blackmail a whole lot of people, which is incredibly time consuming. So software firms would be able to underpay for most exploits: The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility.

Nerdfest 8y ago
"The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility." So basically, their value.
- Too 8y ago
  I wouldn't put it that way. The potential value lost (reputation, downtime, etc) for the vendor could be more than the value an attacker might gain. It's not a slice of cake that is exchanging hands. The attacker might only be interested in the cherry on the top but he could also destroy the rest of the cake in the process.
dev_dull 8y ago
> There are darknet firms that independently verify that an exploit is real (staking their reputation that they won't take it and run once shown), and then open it to the market. Is this really a thing? Who are these firms and what is their take?
- icebraining 8y ago
  One example: http://www.zerodium.com/program.html http://www.zerodium.com/program.html

profalseidol 8y ago

> Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome. Yeah. Just look at where we are today. But calling it "perverse outcome" is sugar coating it. If it wasn't for profit being the king of all (and being the current common sense). Then we would've put more time into making software more secure.

icebraining 8y ago
Software not made for profit is very often no more secure. The problem is not profit, it's that these security issues don't really lower it enough. I've seen the profit motive working very well in a couple of companies when the threat of lowering them (in the form of large fines) appeared thanks to the GDPR.