Yeah. This is how it should work IMO. Have a trustworthy organization that confirms bugs, but doesn’t require disclosure before payment. Let researchers plac

Yeah. This is how it should work IMO. Have a trustworthy organization that confirms bugs, but doesn’t require disclosure before payment. Let researchers place a value on their own work via a “buy it now” option and let organizations negotiate to buy bugs affecting their products. The only info shown publicly should be a severity rating. If an exploit is fixed, published, or used before a company buys it, the 3rd party could publish proof of previous knowledge about the exploit. There are a lot of good incentives in that system. The trusted third party will want to do a high quality job of verifying and categorizing exploits because overselling them will deter companies from buying and companies would be increasing their liability when they fail to buy bugs. For example, in this case, what’s the damage? IMO you could do millions of dollars in damage. In fact, if you went hog wild exfiltrating or destroying data, I bet the industry would value the damage over $1 billion dollars when you’re being prosecuted. I wonder what kind of legal hurdles a company would face trying to set something like that up. I think it makes a lot more sense than having companies working on the honor system because they’ve demonstrated they don’t play fair and bugs are severely undervalued. This is a $1 million bug IMO.