23 ms·
Worth adding that clean money is worth more than dirty money
by b_tterc_p 7y ago
Worth adding that clean money is worth more than dirty money
- jjcm 7y agoIf the money is directly from the government, is it really dirty money?
- bigiain 7y agoYes.
- Supermancho 7y agoDepends which government, I would think.
- TheRealSteel 7y agoKind of what I meant by "Especially considering the lower legal risk" but I guess there's the specific cost of laundering it too. A good point!
- gmanley 7y agoAre there any laws you bump into selling 0-days? Honest question, I know their are laws about the actual hacking part but is it illegal to sell the payload? Obviously this is ethically dirty money I just was curious if it's actually dirty money in a criminal sense.
- tptacek 7y agoIf you sell a bug to someone you know is going to break the law with it, you're getting close to the line for liability. People who sell bugs to the western IC are, as I understand it, virtually always selling to broker firms designated by governments which offer a veneer of plausible deniability; selling to a well-known broker is probably not legally all that risky.
- munk-a 7y agoAs has happened disappointingly in the past - there aren't any actual laws offering safe harbor for ethical hacking, companies just tend not to prosecute responsible disclosure... if your disclosure required you to break interstate commerce laws, run afoul of the CFAA[1] or even just violate a TOS - or even if they can convincingly argue that discovering your disclosure might have - then you can be prosecuted. Now, people who prosecute white hacks that practice responsible disclosure are technically known as "asshole"s but the end result is that there are a ton of laws even innocent computer usage breaks so your liability for any damage to end users usually doesn't need to be considered, there's enough book to throw at people already. [1] Essentially if you touch a computer or computing device it's quite likely you've somehow violated the CFAA, it's _stuuupid_. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- tedunangst 7y agoNone of this seems particularly relevant to the scenario of selling to zerodium.
- lawnchair_larry 7y agoThis has nothing to do with hacking, so none of that applies. You're conflating attacking someone else's computer or network. You don't need safe harbor because analyzing your own property is not a crime. Neither is telling people what you found. Also, please stop using the term responsible disclosure!
- rolltiide 7y agoBug bounties merely needed market pressure for the bounties to rise. Corporations had been unilaterally deciding what the payment for a reported bug would be. They were constantly undervaluing and wasting everyone's time. People would say the same rationale "low liability and clean money is more valuable than dirty money and needing to launder it". Yeah, but not that much more valuable. So now the bounties are reaching their market price.
- segmondy 7y agoNo it's not. Money is money.