4 ms·

This logic could apply to any profession. You just happen to be on the expert side for this one. Should a surgeon ask you for millions? After all he saved your

This logic could apply to any profession. You just happen to be on the expert side for this one. Should a surgeon ask you for millions? After all he saved your life. What about the mechanic that finds an issue with your breaks? If you paid someone not for the work done, but for the resulting loss if criminals exploited something, a lot of professions would ask for crazy prices.

athorax 5y ago
Or maybe a biomedical researcher discovers you have a special mutation that makes your kidney worth millions on the black market and informs you instead of the guys with a tub full of ice ready to go
Gimpei 5y ago
You're thinking about this in moralistic terms of deservedness. The shock I encountered at the 40K was that it wasn't enough to incentive future security researchers to find bugs. This just seems like a bad business decision.
- asah 5y ago
  I think people underestimate how much work it is to find and report security issues... Including the unpaid labor of training... Anyway, seems like an NFT with the instructions would've sold for far more than 40k...
  - onionisafruit 5y ago
    Aren’t the contents of NFTs public before the sale? I agree with your general point that there were buyers willing to pay more, but NFT might not be the right vehicle for it.
    - cwilkes 5y ago
      It could be an NFT of the digitally signed exploit. Or something, NFTs confuse me
      - hunter2_ 5y ago
        The way I see it, they're like a certificate of authenticity. It just proves that the accompanying asset (which can be freely copied) is the original work, by way of the known creator of the original work signing the NFT, and the NFT itself not being forgeable.
    - ffggvv 5y ago
      the NFT is just a dumbass complication and doesnt add anyhting. people have been selling exploits forever. its like saying ill paint the instructions onto a canvas and sell it
_carbyau_ 5y ago
If I don't have millions I can't give it to you. If there are 50 others who can fix my brakes, one of them will likely try to undercut your price so as to get my business. In this case, M$ could have paid ten times that amount and it would still be pocket money both in terms of their ledger AND vs the damages the PR could cause alone. M$ does have black market competitors that would have paid far more. Doing the right thing morally is good. But when people see time and again that simply cashing out once could set you up for life.(Maybe not in this case but maybe in others.) That is an awfully tempting risk to take and I wouldn't blame them. We're literally saying it doesn't pay to be moral.
- deleted 5y ago
  [deleted]
- gregoryl 5y ago
  If MS forked out $400k for a security flaw, I'm not convinced it would be great thing for PR.
  - cutemonster 5y ago
    Yes, and, hmm, maybe if $360k of that was in MS stocks it'd seemed more ok? Hmm At the same time, these discussions about then paying to little aren't good PR either
sumedh 5y ago
The person who finds the exploit can give it to some shady group and make lot more money and then if the exploits become public it damage MS. In the examples you mentioned can you do the same?
- EpicEng 5y ago
  If I found your wallet on the street with $1k in it I could just keep it, but that would be wrong, so I return it to you. Maybe you give me $50 for my trouble.
  - sumedh 5y ago
    If I am in the business of protecting wallets of other people then me losing my wallet is huge reputation risk so I give significantly more than $50 and you make it an official policy so there is no maybe. There was a story on HN a while some guy just got 100K for an Apple account takeover exploit. That is a huge exploit, paying 100K is peanuts for 2 Trillion dollar company.

athorax 5y ago

Or maybe a biomedical researcher discovers you have a special mutation that makes your kidney worth millions on the black market and informs you instead of the guys with a tub full of ice ready to go

Gimpei 5y ago

You're thinking about this in moralistic terms of deservedness. The shock I encountered at the 40K was that it wasn't enough to incentive future security researchers to find bugs. This just seems like a bad business decision.

asah 5y ago
I think people underestimate how much work it is to find and report security issues... Including the unpaid labor of training... Anyway, seems like an NFT with the instructions would've sold for far more than 40k...
- onionisafruit 5y ago
  Aren’t the contents of NFTs public before the sale? I agree with your general point that there were buyers willing to pay more, but NFT might not be the right vehicle for it.
  - cwilkes 5y ago
    It could be an NFT of the digitally signed exploit. Or something, NFTs confuse me
    - hunter2_ 5y ago
      The way I see it, they're like a certificate of authenticity. It just proves that the accompanying asset (which can be freely copied) is the original work, by way of the known creator of the original work signing the NFT, and the NFT itself not being forgeable.
  - ffggvv 5y ago
    the NFT is just a dumbass complication and doesnt add anyhting. people have been selling exploits forever. its like saying ill paint the instructions onto a canvas and sell it

_carbyau_ 5y ago

If I don't have millions I can't give it to you. If there are 50 others who can fix my brakes, one of them will likely try to undercut your price so as to get my business. In this case, M$ could have paid ten times that amount and it would still be pocket money both in terms of their ledger AND vs the damages the PR could cause alone. M$ does have black market competitors that would have paid far more. Doing the right thing morally is good. But when people see time and again that simply cashing out once could set you up for life.(Maybe not in this case but maybe in others.) That is an awfully tempting risk to take and I wouldn't blame them. We're literally saying it doesn't pay to be moral.

deleted 5y ago
[deleted]
gregoryl 5y ago
If MS forked out $400k for a security flaw, I'm not convinced it would be great thing for PR.
- cutemonster 5y ago
  Yes, and, hmm, maybe if $360k of that was in MS stocks it'd seemed more ok? Hmm At the same time, these discussions about then paying to little aren't good PR either

sumedh 5y ago

The person who finds the exploit can give it to some shady group and make lot more money and then if the exploits become public it damage MS. In the examples you mentioned can you do the same?

EpicEng 5y ago
If I found your wallet on the street with $1k in it I could just keep it, but that would be wrong, so I return it to you. Maybe you give me $50 for my trouble.
- sumedh 5y ago
  If I am in the business of protecting wallets of other people then me losing my wallet is huge reputation risk so I give significantly more than $50 and you make it an official policy so there is no maybe. There was a story on HN a while some guy just got 100K for an Apple account takeover exploit. That is a huge exploit, paying 100K is peanuts for 2 Trillion dollar company.