3 ms·
> I would assume that trying to get a bounty means accepting that you're not selling the vulnerability elsewhere. That is a very mistaken assumption. Even NDA
by jsjohnst 5y ago
> I would assume that trying to get a bounty means accepting that you're not selling the vulnerability elsewhere.
That is a very mistaken assumption. Even NDAs backed by threats from nation state intelligence agencies aren’t sufficient to keep exploits from being resold multiple times.
- cutemonster 5y agoAlso, the ones who sell two or more times, can just claim that the other buyer actually discovered the exploit themselves? Or maybe that someone in the first buyer's organization resold it?