3 ms·

Moral of story is obvious: Next time sell the exploits on the dark web and skip the blog post.

by dev_hacker 7y ago

m-p-3 7y ago
It's all that PayPal deserves of they get a pass for PCI-DSS non-compliance.
- AnIdiotOnTheNet 7y ago
  I'm sure that'll be a great comfort to the victims of whoever those flaws are sold to.
  - annoyingnoob 7y ago
    Who would you like to be upset with in a case where the black market is more efficient than HackerOne? If the legitimate channels are not working then the system is broken and you should blame PayPal and HackerOne. Be pissed at PayPal for not making it easier to report real issues. Be pissed at PayPal for not finding the issues themselves.
    - AnIdiotOnTheNet 7y ago
      Or, and I know this might be hard to grasp if you're the kind of unscrupulous individual who would sell exploits to criminals, I could also blame the unscrupulous individual who sold exploits to criminals. Are they deserving of a pass for some reason? Fuck them.
      - annoyingnoob 7y ago
        Bad Guys exist and we can't ignore them, like it or not. A head-in-the-sand approach is not good for security either. Yes, fuck the bad guys but seriously fuck those that refuse to acknowledge and fix real issues.
    - prostheticvamp 7y ago
      The failure of the legitimate market causally explains the emergence of a black market. It doesn’t morally vindicate people who sell exploits on the black market. This is, I don’t know, kindergarten-level ethics? I’m flabbergasted at the self-serving rationalizations here.
      - annoyingnoob 7y ago
        To be clear, I am not personally advocating the use of the black market to sell exploits. I'm saying that the black market may be more attractive in cases like this and that anger at the black market in this case is misguided. The failure is with PayPal and/or HackerOne in this case. When the black market is more efficient that is a failure of the legitimate marketplace and you should place your anger with the legitimate marketplace that failed.

Moral of story is obvious: Next time sell the exploits on the dark web and skip the blog post.

m-p-3 7y ago

It's all that PayPal deserves of they get a pass for PCI-DSS non-compliance.

AnIdiotOnTheNet 7y ago
I'm sure that'll be a great comfort to the victims of whoever those flaws are sold to.
- annoyingnoob 7y ago
  Who would you like to be upset with in a case where the black market is more efficient than HackerOne? If the legitimate channels are not working then the system is broken and you should blame PayPal and HackerOne. Be pissed at PayPal for not making it easier to report real issues. Be pissed at PayPal for not finding the issues themselves.
  - AnIdiotOnTheNet 7y ago
    Or, and I know this might be hard to grasp if you're the kind of unscrupulous individual who would sell exploits to criminals, I could also blame the unscrupulous individual who sold exploits to criminals. Are they deserving of a pass for some reason? Fuck them.
    - annoyingnoob 7y ago
      Bad Guys exist and we can't ignore them, like it or not. A head-in-the-sand approach is not good for security either. Yes, fuck the bad guys but seriously fuck those that refuse to acknowledge and fix real issues.
  - prostheticvamp 7y ago
    The failure of the legitimate market causally explains the emergence of a black market. It doesn’t morally vindicate people who sell exploits on the black market. This is, I don’t know, kindergarten-level ethics? I’m flabbergasted at the self-serving rationalizations here.
    - annoyingnoob 7y ago
      To be clear, I am not personally advocating the use of the black market to sell exploits. I'm saying that the black market may be more attractive in cases like this and that anger at the black market in this case is misguided. The failure is with PayPal and/or HackerOne in this case. When the black market is more efficient that is a failure of the legitimate marketplace and you should place your anger with the legitimate marketplace that failed.