4 ms·

I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the

I would like to see bounties offered no questioned asked too. That way someone on the payroll of nefarious inc. my decide to share it with Google or Apple the same time as their boss.

nopriorarrests 7y ago
Actually, this is my second question. How much money FB/AAPL are ready to pay for a security researcher who can find 0 day in their software to work full-time for them? Is Nefarius Inc. really competitive with them, salary-wise? I just can't grasp the economics here. Back in 90's, being a bad guy was probably more lucrative, but now, when established IT companies have market cap in trillion zone... what makes people work for nefarius inc?
- zulln 7y ago
  > what makes people work for nefarius inc? No idea about nefarius, but when I talked with someone in a similar role the answer was work conditions. It was apparently easier to get a remote role with a flexible schedule at a more "sketchy" company.
- mywittyname 7y ago
  > what makes people work for nefarius inc? Very good pay; the ability to work remotely; pride/prestige; community; political reasons. Being a good digital thief is still very lucrative, especially for people living in low income areas with relatively lax law enforcement. These people can run encrypted computer extortions, steal bitcoin wallets, run/sell botnets, fence digital goods, run underground ad networks, and consult.
thaeli 7y ago
Brokers ("grey market") usually pay out over time, for this reason. If a seller double-dipped by also selling the vuln to the vendor via a bounty program, it could get fixed before they actually got most of their grey-market money.