3 ms·
Depends. Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and pro
by crankylinuxuser 7y ago
Depends.
Who Google and other service providers are competing against are grayweb exploit dealers. That's the real market, and every popular site, api, and program is subject, regardless if they're on H1 or not.
Sure there's some whitehat types who'd only tell the companies directly. But the rest.... Well.
- tptacek 7y agoNo. People who find drive-by RCE vulnerabilities are in a market with "grayweb exploit dealers". People who find URL whitelist validation bugs are not. The distinction is important and directly reflected in the bounty rates for the different kinds of bugs. And again, it's not a status thing. You can probably make quite a lot of money on bugs like this; you simply find a lot more of them than anyone generates RCE exploits.