4 ms·
I wonder what would be cheaper for Google, et al.: paying lots of engineers to bug hunt all day, or simply going out and buying a bunch or all of the high profi
by skizm 8y ago
I wonder what would be cheaper for Google, et al.: paying lots of engineers to bug hunt all day, or simply going out and buying a bunch or all of the high profile bugs from shady websites and then just publishing them.
- rocqua 8y agoI wouldn't be surprised if the value in project zero is mostly in training the engineers to find these vulnerabilities.
- ufmace 8y agoConsider that the most critical bugs found by black hats probably never make it out into any market, open, shady, or otherwise. They're probably kept internal to the team that found them, or sold/traded directly between organizations with long relationships.