4 ms·

Tragedy of our generation is that people who are so smart and determined to find and exploit these vulnerabilities, can't find better uses for their talents.

sfifs 7y ago
Well the smartest talents of the previous generations built and exploded hundreds of nuclear weapons including a couple on innocent civilians, created ICBMs that can destroy civilization in a few minutes and created situations that brought the world to a brink several times, drove a massive population explosion anda fossil fuel consumption binge that may yet destroy civilization. So I definitely think the smartest of more recent generations who are employing their skills in these software hacks and ad tracking are perhaps saintly in comparison :-)
ethanwillis 7y ago
Or maybe society isn't providing them an accessible application for their talents.
- dEnigma 7y ago
  One good application that comes to mind in this case would be the Google Chrome bug bounty program.
  - londons_explore 7y ago
    The writer of this exploit was almost certainly paid more than the bug bounty reward.
    - malux85 7y ago
      Agreed, exploits on the deep Web pay 10x what the big bounty programs do, the mismatch is laughable
    - jasonlfunk 7y ago
      Yeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.
      - mkagenius 7y ago
        > having it fixed is worth to Google For now, I hope. Google can and should pay equivalent amounts.
    - dEnigma 7y ago
      Sure. I'm not saying that the moral way is just as profitable as the alternative; only that it exists.
- malux85 7y ago
  Don't improve the product, just find dumber customers! Don’t lose weight, just buy bigger trousers! Don’t take personal responsibility, just blame society!
  - anovikov 7y ago
    Sadly, i had a big argue with my team and they kept pressing me into doing exactly the first thing. "Success depends on optimizing the sales and optimization is done by money/brains metric". Something i'm not really ready to accept (yet).
  - petra 7y ago
    Of course it's both. Personal responsibility is important. And even if you're bored, there are things to do other than hacking. But working mind-numbing jobs , way below one's skills and talents happens to such a large share of people. Maybe it's a sign to a problem with society ?
tannhaeuser 7y ago
Or, maybe downloading arbitrary code from the internet without even a same-origin check, and being able to dynamically construct executable JavaScript from downloaded binary data masked as image and then have a whole generation of developers depend on this model wasn't so good an idea after all.
- Santosh83 7y ago
  It enables SaaS and makes economic sense and sadly the latter is the only thing that matters when it comes to mass human behaviour.
  - tannhaeuser 7y ago
    Makes economic sense for cloud providers that is. For users, developers, content creators, and all others, not so much.
  - altfredd 7y ago
    eval() has no economic purpose. It hasn't been removed by browsers purely because that would break backward compatibility. Non-same origin Javascript does not have economic purpose either. I believe, that it will be completely eradicated from browsers within this century (if not in couple of decades).
newguy1234 7y ago
In this day and age, it could also be well paid nation state hackers. It is well understood that places like the NSA actively seek out zero day exploits and use them to perform whatever operations they need to do. They don't report them to software devs that can patch them.
- Tepix 7y ago
  His statement remains true.
BLKNSLVR 7y ago
It's not limited to "our generation", these lyrics are from 1966: https://www.azlyrics.com/lyrics/frankzappa/hungryfreaksdaddy.html https://www.azlyrics.com/lyrics/frankzappa/hungryfreaksdaddy...
baybal2 7y ago
> can't find better uses for their talents. Why would they. People who break DRMs for fun and profit look with disdain at their whitehat counterparts. Same with ad fraud. People in that particular business take pride at being able to fool boatload of best and brightest computer scientists who work at bot detection As for people in good old browser exploit scene, I think they have good time laughing at vain efforts, and ineptness of their counterparts too I think people are wrong thinking of it as a money thing

sfifs 7y ago

Well the smartest talents of the previous generations built and exploded hundreds of nuclear weapons including a couple on innocent civilians, created ICBMs that can destroy civilization in a few minutes and created situations that brought the world to a brink several times, drove a massive population explosion anda fossil fuel consumption binge that may yet destroy civilization. So I definitely think the smartest of more recent generations who are employing their skills in these software hacks and ad tracking are perhaps saintly in comparison :-)

ethanwillis 7y ago

Or maybe society isn't providing them an accessible application for their talents.

dEnigma 7y ago
One good application that comes to mind in this case would be the Google Chrome bug bounty program.
- londons_explore 7y ago
  The writer of this exploit was almost certainly paid more than the bug bounty reward.
  - malux85 7y ago
    Agreed, exploits on the deep Web pay 10x what the big bounty programs do, the mismatch is laughable
  - jasonlfunk 7y ago
    Yeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.
    - mkagenius 7y ago
      > having it fixed is worth to Google For now, I hope. Google can and should pay equivalent amounts.
  - dEnigma 7y ago
    Sure. I'm not saying that the moral way is just as profitable as the alternative; only that it exists.
malux85 7y ago
Don't improve the product, just find dumber customers! Don’t lose weight, just buy bigger trousers! Don’t take personal responsibility, just blame society!
- anovikov 7y ago
  Sadly, i had a big argue with my team and they kept pressing me into doing exactly the first thing. "Success depends on optimizing the sales and optimization is done by money/brains metric". Something i'm not really ready to accept (yet).
- petra 7y ago
  Of course it's both. Personal responsibility is important. And even if you're bored, there are things to do other than hacking. But working mind-numbing jobs , way below one's skills and talents happens to such a large share of people. Maybe it's a sign to a problem with society ?

tannhaeuser 7y ago

Or, maybe downloading arbitrary code from the internet without even a same-origin check, and being able to dynamically construct executable JavaScript from downloaded binary data masked as image and then have a whole generation of developers depend on this model wasn't so good an idea after all.

Santosh83 7y ago
It enables SaaS and makes economic sense and sadly the latter is the only thing that matters when it comes to mass human behaviour.
- tannhaeuser 7y ago
  Makes economic sense for cloud providers that is. For users, developers, content creators, and all others, not so much.
- altfredd 7y ago
  eval() has no economic purpose. It hasn't been removed by browsers purely because that would break backward compatibility. Non-same origin Javascript does not have economic purpose either. I believe, that it will be completely eradicated from browsers within this century (if not in couple of decades).

newguy1234 7y ago

In this day and age, it could also be well paid nation state hackers. It is well understood that places like the NSA actively seek out zero day exploits and use them to perform whatever operations they need to do. They don't report them to software devs that can patch them.

Tepix 7y ago
His statement remains true.

BLKNSLVR 7y ago

It's not limited to "our generation", these lyrics are from 1966: https://www.azlyrics.com/lyrics/frankzappa/hungryfreaksdaddy.html https://www.azlyrics.com/lyrics/frankzappa/hungryfreaksdaddy...

baybal2 7y ago

> can't find better uses for their talents. Why would they. People who break DRMs for fun and profit look with disdain at their whitehat counterparts. Same with ad fraud. People in that particular business take pride at being able to fool boatload of best and brightest computer scientists who work at bot detection As for people in good old browser exploit scene, I think they have good time laughing at vain efforts, and ineptness of their counterparts too I think people are wrong thinking of it as a money thing