2 ms·
The only way you're going to reduce the amount of vulnerabilities being sold on black markets is to provide sufficient financial and social incentive. There are
by jplayer01 8y ago
The only way you're going to reduce the amount of vulnerabilities being sold on black markets is to provide sufficient financial and social incentive. There are enough people with dubious morals who don't care how illegal it is to find and exploit them, who will eagerly take the biggest payday. Combine no guarantee you'll get paid, poor treatment by authorities and employers and the (albeit low) risk of getting your shit kicked in, I'm not surprised people aren't lining up at the door to report vulnerabilities.
- 3pt14159 8y agoI agree completely, but the issue is that the vulnerability value is asymmetric. It's about $1m to get an iPhone no-click RCE. Up to about $4m for one with a seemingly long shelf life. Apple is not going to pay $Xm for their bug bounty. That said, that there will be some that continue to engage in illegal activity doesn't mean we shouldn't make it illegal in the first place. I'd even be in favour of treating certain classes of vulnerability sale as an act of terrorism or treason or arms export violation. I know it is hard, but we have to try to solve this.
- jplayer01 8y agoYeah, I'd rather not make security research any more taboo and frowned upon than it already is. Regulation should be put towards forcing companies to put bug bounty programs into place and forcing companies to put the necessary money into it, not disincentivizing the absolutely crucial and important work that researchers do. Apple can easily afford it.
- 3pt14159 8y agoI agree that regulation should be put into place, I've blogged about it in the past and I've argued that it should scale with number of affected users, but that doesn't mean we shouldn't make certain acts illegal. Selling a iOS 0day to the Saudis should be illegal.