5 ms·
The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have cu
by xutopia 15y ago
The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers.
The net result is probably safer software for all.
- alanh 15y agoThe net result in this case is the government owning a zero-day root exploit for every Chrome/Win citizen’s computer. It’s worse than zero-day because we have no reason to expect a patch, so the window of attack will stay open.
- kin 15y agoOut of speculation, would this tie in at all to an article I saw on HN a while back about the Government hiring 3rd parties to hack Google for some reason?
- GrandMasterBirt 15y agoIs it wrong for our government to do any security research? I mean can good things not come out of it? Be thankful it was reported.
- kin 15y agoI never said if anything was right or wrong, nor did I assume any of it, I just asked if it was related. Good to know curiosity gets flagged around here.
- deleted 15y ago[deleted]
- sswam 15y agomaybe Govt is envious because Google is already more powerful and capable and certainly better liked than it!
- AndrewMoffat 15y agoOn an exploit like this, I expect a patch. I'm sure people at Google and abroad (if the exploit exists in Chromium) are scrambling to find it, both for the e-cred and just to make other people safer.
- SkyMarshal 15y agoAgreed, no need to freak out, the sky's not falling. I expect Google will either find the spoit on their own, or pay what to them is a pitance to become a customer and acquire it that way. Sounds like a good company to have on the payroll anyway, doing what three years of Pwn2own hasn't managed to.
- cop359 15y agoIf if Google does find a serious security flaw, how can they be sure it's the same one?
- piaskal 15y agoJust ask vupen if their exploit still works on new version.
- Tyrannosaurs 15y agoUnless you're a customer of theirs why would you expect an answer to that?
- schrototo 15y agoWouldn't "the government" keep quiet about even having found an exploit? Why let VUPEN publicize this if they intend to use it?
- lukeschlather 15y agoThe government is generally more worried about keeping foreign governments out of high-tech firms like Google than about their ability to hack high-tech firms like Google.
- CGamesPlay 15y agoWhich government are you referring to?
- sswam 15y agoso, avoid .gov and similar :) it's a silly TLD anyway. Did the .gov pwn TPB and put their exploit up there?
- deleted 15y ago[deleted]
- wmf 15y agoOTOH, if they weren't paid then maybe the bugs would never be found and people wouldn't get owned.
- tptacek 15y agoSo your theory is that they, unlike organized criminals with 6-7 figure budgets, are atomic supermen?
- rsoto 15y agoI'm confused. Why would the government want to break Chrome? Also, if they are not going to release the exploit soon (especially to Google), why are you saying 'safer software for all'?
- bjonathan 15y agoyou know that there is more than one government on earth... and all of them arent pro free-speech :) Safer software for all, because it's a better thing that VUPEN discover the bug than if it's discovered by some criminals who keep it secret and scam/hack
- jonknee 15y ago> Safer software for all, because it's a better thing that VUPEN discover the bug than if it's discovered by some criminals who keep it secret and scam/hack I suppose it depends on the point of view, but having it exclusively in the hands of governments can easily mean it's limited to criminals who keep it secret and hack.
- rsoto 15y agoThanks for your response, but my question remains. Why would a entity as big as "the government" would invest in breaking one browser used by a minority (~10%) of users in the web? Wouldn't it be much easier to just compromise their Internet connections?
- deleted 15y ago[deleted]
- sswam 15y agoLet's say that, like most everyone else in the world, they already know how to break firefox and internet explorer, etc. They don't want to spy on your net, they want to steal your files.
- quanticle 15y agoArguably, that's exactly what VUPEN is doing here. They're keeping it secret, and only letting those who are willing to pay have the necessary knowledge regarding this vulnerability and any possible workarounds. It might not be a scam, but I do find it morally questionable to hide the details of a bug of this significance.
- ChuckMcM 15y ago"The net result is probably safer software for all." I don't think that follows. Clearly there are folks in some governments who would fund finding zero day exploits so that they can use them to conduct cyber-warfare operations. Stuxnet comes to mind and the HBGary emails were telling in this regard. It seems there is a market for 0 day attacks that are not known to the manufacturer. So while Google would clearly give them $13,373 for the bug report but that is no doubt mouse nuts compared to what the someone would pay them while it's not in the 'known' state. So I find Vupen's business model not unlike the business of creating munitions. No doubt profitable but not something I'd personally want to participate in.