4 ms·

> a good capitalist would try to sell the discovery to the highest bidder. Not all security researchers are doing it for the money, 0day markets always exist.

> a good capitalist would try to sell the discovery to the highest bidder. Not all security researchers are doing it for the money, 0day markets always exist. Malicious people who wish to use the vulnerability for profit wouldn't disclose the vulnerability to begin with. So it's not a new problem. > this case, it would probably be Intel, to "catch and kill" widespread knowledge of the exploit. Another high bidder would be an investor in position to exploit a short-term massive short But your comment is insightful - Intel's case is unprecedented. Due to the huge impact of the vulnerabilities, the threat is not coming from the blackhat sellers or black market buyers, but Intel. Intel itself can simply pay researchers with an NDA to keep their mouths shut, while still doing nothing. The impact of the vulnerabilities is also high enough to move the stock market, allowing insider trading.

jefftk 7y ago
If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-fraud-claims-made-infamous-short-seller-gotham-city-research https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)
- segfaultbuserr 7y ago
  >If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Thanks for the information, never thought about that. On the other hand, would purchasing information about a flaw and using the information to bet the stock constitutes insider trading?
  - jefftk 7y ago
    If the person you bought it from would have been allowed to trade on it, that should be ok.
  - mandevil 7y ago
    It would be insider trading if the person you purchased from had a duty to the company to keep the secret (they worked for the company and learned of the vulnerability in the normal course of their job, say). If they are an independent researcher and you are an independent researcher, trade away. Then it is just like using satellites to find out that a shopping mall's parking lot is empty on a big shopping day- trade all you want. If they signed a NDA to cash in on the bug bounty and then sold it to you, I think they are vulnerable to breach of contract, but I don't think you are legally vulnerable, however this is not legal advice, I am not a lawyer, and do you want to go through the expense of finding out?
    - segfaultbuserr 7y ago
      So utilizing information discovered or obtained from independent researches from public sources and personal expertise to trade is not inside trading, albeit how your conclusions are asymmetrical, inaccessible to others, or how impactful they are - since it's inherently no difference from any other type of market analysis, and it's literally the job of financial analysts. And it's also the function of the market: take all these trades as inputs, calculate its output - current price. Makes perfect sense to me now. I now realized I've some serious misunderstanding of insider trading. Thanks for clearing it up for me.
      - mandevil 7y ago
        Check out Matt Levine's Moneystuff email newsletter- it is what clarified this for me, and is amusing every day. Not even any ads or upsell to a pay-for subscription. I suspect if this is a thing you are curious about you will enjoy it.
        segfaultbuserr 7y ago
        Subscribed via RSS! Thanks.
  - jdmichal 7y ago
    Insider information is not about the information itself, but rather the source of the information. The exact same piece of information could be insider information or not depending on who you heard it from. Think of it like a watermark or stain on the information. When the information is generated within the "insider" circle, it is permanently stained until that information is made public. Legally, this stain remains no matter how many hops it goes through. However, if the same information is generated by an "outsider" that figured it out, that same information is not stained. Example: Your neighbor Alice is a hotshot executive at BigCorp. If Alice comes over to your BBQ and starts telling you about how bad their upcoming quarter is going to be, that's probably tainted information. However, if your other neighbor Bob comes to your BBQ, and starts talking about how grumpy Alice has been, and she's always grumpy like this when BigCorp is about to have a bad quarter... That's fair game. Same information, different sources. That said, in the US I think there must be some indication or reasonable expectation that you knew or were willingly blind to the non-public status of the information.
- Khoth 7y ago
  Also not a lawyer, but check what country you're in before you try this. In countries like the UK, many more things are insider trading than in the US.
  - jefftk 7y ago
    Sorry, yes, only trying to talk about the US here
- vadansky 7y ago
  Sounds like "Markets can stay irrational longer than you can stay solvent" would apply here
  - jefftk 7y ago
    The problem in the Gotham case I linked was that markets didn't consider the news to be as significant as Gotham expected them to. The goal with this strategy is to find serious issues that will rightly cause investors to immediately decrease their estimate of the value of the company.
- oefrha 7y ago
  Security researchers aren’t hedge funds, most aren’t swimming in cash, and can’t borrow millions on a whim. Also, pouring your life savings into a bet like this is probably dumb.
  - jefftk 7y ago
    A security researcher could partner with an investment fund, however. I agree this is too risky to be a good idea for most individual researchers to use directly.
- makomk 7y ago
  Yeah. Someone actually tried this with AMD last year, but the security vulnerability they found was a lot less important than their breathless press release claimed and the markets basically shrugged. There was some funny business there too, with them paying third-party security researchers to confirm the bugs based on a more technical report the rest of us didn't get to see and the actual publicly-announced description they were used to lend credibility to being kept from them.

jefftk 7y ago

If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Here's an example of Gotham City Research trying this approach and failing: https://www.thedrum.com/news/2017/09/21/criteo-counters-fraud-claims-made-infamous-short-seller-gotham-city-research https://www.thedrum.com/news/2017/09/21/criteo-counters-frau... (Not a lawyer)

segfaultbuserr 7y ago
>If you discover a flaw in a product, bet against the stock, and publish the flaw, that's not insider trading. Thanks for the information, never thought about that. On the other hand, would purchasing information about a flaw and using the information to bet the stock constitutes insider trading?
- jefftk 7y ago
  If the person you bought it from would have been allowed to trade on it, that should be ok.
- mandevil 7y ago
  It would be insider trading if the person you purchased from had a duty to the company to keep the secret (they worked for the company and learned of the vulnerability in the normal course of their job, say). If they are an independent researcher and you are an independent researcher, trade away. Then it is just like using satellites to find out that a shopping mall's parking lot is empty on a big shopping day- trade all you want. If they signed a NDA to cash in on the bug bounty and then sold it to you, I think they are vulnerable to breach of contract, but I don't think you are legally vulnerable, however this is not legal advice, I am not a lawyer, and do you want to go through the expense of finding out?
  - segfaultbuserr 7y ago
    So utilizing information discovered or obtained from independent researches from public sources and personal expertise to trade is not inside trading, albeit how your conclusions are asymmetrical, inaccessible to others, or how impactful they are - since it's inherently no difference from any other type of market analysis, and it's literally the job of financial analysts. And it's also the function of the market: take all these trades as inputs, calculate its output - current price. Makes perfect sense to me now. I now realized I've some serious misunderstanding of insider trading. Thanks for clearing it up for me.
    - mandevil 7y ago
      Check out Matt Levine's Moneystuff email newsletter- it is what clarified this for me, and is amusing every day. Not even any ads or upsell to a pay-for subscription. I suspect if this is a thing you are curious about you will enjoy it.
      - segfaultbuserr 7y ago
        Subscribed via RSS! Thanks.
- jdmichal 7y ago
  Insider information is not about the information itself, but rather the source of the information. The exact same piece of information could be insider information or not depending on who you heard it from. Think of it like a watermark or stain on the information. When the information is generated within the "insider" circle, it is permanently stained until that information is made public. Legally, this stain remains no matter how many hops it goes through. However, if the same information is generated by an "outsider" that figured it out, that same information is not stained. Example: Your neighbor Alice is a hotshot executive at BigCorp. If Alice comes over to your BBQ and starts telling you about how bad their upcoming quarter is going to be, that's probably tainted information. However, if your other neighbor Bob comes to your BBQ, and starts talking about how grumpy Alice has been, and she's always grumpy like this when BigCorp is about to have a bad quarter... That's fair game. Same information, different sources. That said, in the US I think there must be some indication or reasonable expectation that you knew or were willingly blind to the non-public status of the information.
Khoth 7y ago
Also not a lawyer, but check what country you're in before you try this. In countries like the UK, many more things are insider trading than in the US.
- jefftk 7y ago
  Sorry, yes, only trying to talk about the US here
vadansky 7y ago
Sounds like "Markets can stay irrational longer than you can stay solvent" would apply here
- jefftk 7y ago
  The problem in the Gotham case I linked was that markets didn't consider the news to be as significant as Gotham expected them to. The goal with this strategy is to find serious issues that will rightly cause investors to immediately decrease their estimate of the value of the company.
oefrha 7y ago
Security researchers aren’t hedge funds, most aren’t swimming in cash, and can’t borrow millions on a whim. Also, pouring your life savings into a bet like this is probably dumb.
- jefftk 7y ago
  A security researcher could partner with an investment fund, however. I agree this is too risky to be a good idea for most individual researchers to use directly.
makomk 7y ago
Yeah. Someone actually tried this with AMD last year, but the security vulnerability they found was a lot less important than their breathless press release claimed and the markets basically shrugged. There was some funny business there too, with them paying third-party security researchers to confirm the bugs based on a more technical report the rest of us didn't get to see and the actual publicly-announced description they were used to lend credibility to being kept from them.