9 ms·
Why not? This is highly specialized research that not even well-paid Google employees were able to do. This is actually quite common in recent years for bug hu
by lawnchair_larry 16y ago
Why not? This is highly specialized research that not even well-paid Google employees were able to do.
This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example.
Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering.
No More Free Bugs, as they say.
They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.
- blocke 16y ago"They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally." What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.
- tptacek 16y agoGoogle employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about. That doesn't mean they're going to find everything, though. At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.
- leif 16y ago"Why not? This is highly specialized research that not even well-paid Google employees were able to do." Correction: not even well-paid Google employees did. They may yet be able, and an existence proof may be all the help they need to find and fix it. Don't give up hope yet.
- sswam 16y agoI can fix it right now. Delete the flash player - problem solved. Chrome still works.
- leif 16y agoSadly, one aspect of security is psychological acceptability. If nobody will do the secure thing, it's not secure.
- watty 16y agoI don't see how Flash can be the culprit or solution considering it is sandboxed. Chrome must contain a massive exploit.
- leif 16y agoI thought the point was that they broke the sandboxing.
- daeken 16y agoThere's absolutely no evidence that this has anything to do with Flash. In fact, even if it was via Flash, there would still have to be another vulnerability to escape the Chrome sandbox, which could very likely be exploited via other means.
- mauriciob 16y agoI doubt Google will hire them. They seem to be a very unprofessional company, even with their skilled people. They may pay to know about this security breach, though.
- _delirium 16y agoPublicly announcing a security vulnerability, claiming that you're sharing it with other clients with the intent of using it for "weaponized ... offensive missions", and then demanding a fee to gain the information to protect against said weaponization, sounds an awful lot like extortion. In the offline world, I don't think you can legally run a business with a strategy of: discover a problem in the security at one of Exxon's plants, publicly announce that you've discovered a vulnerability and will be selling the information to third parties, and then demand $N from Exxon for the details.
- shasta 16y agoThis is probably why they keep repeating that their customer is the government. You could probably sell Exxon's security vulnerabilities to the government and demand $N dollars from them to show them how to fix the problem. It's advertising the vulnerability with posts like this that seems most questionable (similar to extortion) to me.
- _delirium 16y agoYeah, that's the part that seemed odd to me as well, though someone knowledgeable in this area of law (at least in the better-settled offline case) could give some better info. I believe it'd be okay, and probably actually happens, for a private security consultant to do threat assessments for a (non-criminal) client, e.g. prepare a report for DHS on the security of U.S. oil installations. But it seems like they'd be crossing a line if they posted a press release trumpeting a major vulnerability they discovered, mentioning by name which company and approximately where the vulnerability was located, but then refused to disclose it to the company in question. I'm not sure how much it survives, but I believe there was traditionally even a common-law "duty to warn" if you were aware of significant risks to someone's person or property.
- chopsueyar 16y agoGoogle could easily sue them into oblivion for libel. They would be forced to reveal the exploit during proceedings to prove their innocence.