3 ms·
You've missed my point. I'm saying that the market value of actually performing an illegal act of extortion is higher than the market value of a zero-day, eith
by ohazi 6y ago
You've missed my point.
I'm saying that the market value of actually performing an illegal act of extortion is higher than the market value of a zero-day, either on one of these markets or via bug bounty.
I'm arguing that the price is different because of the risk of getting caught and going to jail, not that there isn't a market for security researchers to sell exploits to criminals without otherwise getting their hands dirty.
- smabie 6y agoExactly, you need the risk adjusted prices to match up. Getting paid a bug bounty isn't very risky, so the price is always going to be lower than selling or using the exploit yourself. That being said, I still think bug bounties are too low, even when risk adjusting.
- hombre_fatal 6y agoI also don't think they're empathizing with what it would actually be like to sell a zero day. Taking the certain $10k is the better deal over hunting for a shady buyer on shady sites who might send you some bitcoin if the deal even pans out or if they even pay. That's a lot more work and uncertainty while they act like it's just the choice between which lever to pull. A bird in the hand…