4 ms·
This isn't a judgment, by the way. I'm naive about this area and genuinely curious. I've found other buyers outside the US, but I had ethical concerns and deci
by petercooper 5y ago
This isn't a judgment, by the way. I'm naive about this area and genuinely curious.
I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).
What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?
- 0des 5y agoCome on, we both know the score here.. There is no ethical purchaser.
- petercooper 5y agoThat was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-) I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.
- netsec_burn 5y agoAnswered here: https://news.ycombinator.com/item?id=27875883 https://news.ycombinator.com/item?id=27875883
- petercooper 5y agoThanks - that was helpful.
- AlexAndScripts 5y agoWestern intelligence agencies?
- manquer 5y agoIn theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.