3 ms·

If I'm taking the lion share of the risk on shipping a product, I'm also collecting the lions share of rewards or I'm not interested in participating. As new vu

If I'm taking the lion share of the risk on shipping a product, I'm also collecting the lions share of rewards or I'm not interested in participating. As new vulnerabilities are found every day, I'd expect those rewards to be ongoing, so they would look more like royalties, I'll need to be paid as long as you are using the software. Further I'll need to be able to invalidate that license when I no longer wish to carry the risk. I think under those conditions most firms would prefer to own the risk themselves.

IncRnd 5y ago
Those conditions aren't realistic for an employee, since anyone working for someone else who feels that way is bound to be extremely frustrated. The point that you missed, however, is that an employee should not accept the risk but should transfer the risk by notifying the employer. Otherwise, articles such as this are fodder for putting the blame of exploited vulnerabilities squarely on employees who knew of the risk and, according to some of the comments here, plotted not to tell their employers.