2 ms·

Finding security vulnerabilities is an industry that gains by the type of wide and open disclosure that is done. And revels and enjoys the process and profits f

by gist 7y ago

Finding security vulnerabilities is an industry that gains by the type of wide and open disclosure that is done. And revels and enjoys the process and profits from it. An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. How about if I say 'hey Paul Graham' (using him as an example) I will give you 90 day to remove your home address from public records and if you don't I will then publish that address in the open. Of course anyone can find the info just like I could (let's say). But my act of making the info more widely know would put Paul at greater risk than he'd be if I didn't do that. Now let's say I find a way to profit from that activity. Now multiply that.

falcor84 7y ago
>An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. There are two ways I can read it, the first being almost a tautology (if no one pursues it, then it won't likely be found by accident), and the second (if white-hats don't pursue it, then it won't be found by black-hats either) sounds very unreasonable to me. The black market for zero-days is quite active, with prices for a single vulnerability in the millions [0,1]. So I'd appreciate if you can provide any citation that the "overwhelming majority" of security researchers are white hats. I'd find that to be as surprising as a statement that an overwhelming majority of people breaking into houses are locksmiths. [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...

by gist 7y ago

falcor84 7y ago

>An overwhelming majority of vulnerabilities if not actively pursued and discovered would never be known so as to be exploited other than in extreme cases. There are two ways I can read it, the first being almost a tautology (if no one pursues it, then it won't likely be found by accident), and the second (if white-hats don't pursue it, then it won't be found by black-hats either) sounds very unreasonable to me. The black market for zero-days is quite active, with prices for a single vulnerability in the millions [0,1]. So I'd appreciate if you can provide any citation that the "overwhelming majority" of security researchers are white hats. I'd find that to be as surprising as a statement that an overwhelming majority of people breaking into houses are locksmiths. [0] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits [1] https://arstechnica.com/information-technology/2019/01/zeroday-exploit-prices-continue-to-soar-especially-for-ios-and-messaging-apps/ https://arstechnica.com/information-technology/2019/01/zerod...