5 ms·

That's only true if you have no way to be put in (financial) risk by the vulnerability you're not disclosing to Apple.

• bogwog 6y ago
  If you're a security researcher, you probably know how to cover your tracks.
  • saagarjha 6y ago
    Yes, but the risk if you’re caught is huge.
    • stjohnswarts 6y ago
      not if you're selling them to -your- government. Then you're a patriot but also a rich patriot.
  • searchableguy 6y ago
    Where do security researchers sell their investigation on the black market? Links?
    • shmatt 6y ago
      any company that builds software for government tracking like NSO Group will happily pay, and have very deep pockets
    • nixgeek 6y ago
      Zerodium is probably the closest thing to a “legitimate” acquirer of exploits, those which aren’t being disclosed to the vendor and then fixed.
    • nbk_2000 6y ago
      The following companies buy 0-days. Each has a slightly different business model: Zerodium - http://zerodium.com/ http://zerodium.com/ Azimuth Security - https://www.azimuthsecurity.com/ https://www.azimuthsecurity.com/ NSO Group - https://www.nsogroup.com/ https://www.nsogroup.com/ ZDI - https://www.zerodayinitiative.com/ https://www.zerodayinitiative.com/ SSD - https://ssd-disclosure.com/ https://ssd-disclosure.com/
  • XMPPwocky 6y ago
    Do you? The skills involved in VR and exploit dev don't necessarily mean you're good at opsec.
    • nbk_2000 6y ago
      True, plus "opsec life sucks" so most of us don't do it.