8 ms·

I expect to get downvoted to oblivion for this but whatever. Your comment completely lacks morals. Selling something to the highest bidder implies you have no h

• highwaylights 4y ago
  But the poster is explicitly saying that’s why they have not done this?
• b112 4y ago
  The parent was merely stating the payout is wrong, vs other avenues. An example, if you find a bag of cash, typical finders fee is 10%. Insurance companies, others, often offer this. Meanwhile, Sony is kicking maybe .01% "cash saved" for this vulnerability.
  • LadyCailin 4y ago
    Or perhaps Sony only considers piracy to cause about 200k of damages in actual fact.
    • lupire 4y ago
      200k in damages after recovering funds from lawsuits.
• tetris11 4y ago
  If it was an ethical open source initiative that ultimately benefits the world the one that was being targeted, then yes I'd agree. But if it's a company deeply entrenched in dark patterns, willingly destroys small competition with anticompetitive practices, and trample on basic user rights for triple dollar signs - then, really, who cares? To what detriment to humanity would there be if OP sold to the highest bidder?
  • sjtgraham 4y ago
    • honkler 4y ago
  • tapoxi 4y ago
    What small competition have they destroyed? There's also plenty of competitors in the gaming space with them.
    • thirtyfivecent 4y ago
      Sony are seeding their online community with toxicity. If you have a PSN account look at the available avatars you can use. 1 in 5 have different variations of devils horns on the characters heads. 3 in 5 look like they've been cropped from communist murals around my city. Almost all of the characters look angry and criminal. Browse these avatars and in your mind compare them to Nintendos. The vast majority of users are interacting with each other and seeing these creepy avatars as they're friends virtual faces. What effect is this having on young kids?
• emsixteen 4y ago
  > downvoted to oblivion Wrong website.
• justapassenger 4y ago
  This isn’t about selling guns to killers. Or bugs that allow you to spy on political opponents. It’s selling bugs in customer hardware that can used to reduce control of the manufacturer of it and allow users to run pirated stuff (and homebrew likely as a result). It’s totally in the best interest of the manufacturer to always be the highest bidder. I don’t have any moral issues with people selling those issues on the black market, if manufacturer isn’t interested in rewarding researcher properly.
• cosmodisk 4y ago
  You are right, my initial comment excluded morals altogether. I did it to emphasize the low value attribution to the vulnerability discovery. If I were to actually face such dilemma, it would include much more complex thought process, including morals. I understand that nobody has to do the research of any sort but my point is that these skills and effort involved are being commoditised very quickly and become comparable to gig economy. Bounty programmes are very very cheap to large corps, compared to the returns involved. Building a substantial infosec division that could match the crowdsourced model is way more expensive.
  • sjtgraham 4y ago
    A very thoughtful reply. Thank you. For the avoidance of doubt, you clearly do not lack morals yourself :)
• polartx 4y ago
  >Your comment completely lacks morals Try not to regard things in such an all-or-nothing perspective. At worst it indicates a psychological disorder, at best—a high conflict personality. Either way, it wont benefit you or the people that interact with you. I also disagree that it ‘completely’ lacks morals. If OP is being truthful, then he has a desire to work hard and put in the time necessary to fulfill a virtuous (albeit under-compensated) calling. However, OP is also cognizant of a hypothetical (albeit realistic) temptation that will most likely confront him, should he carry out these pursuits: ethical conflicts which would force him to choose between large financial gains (selling exploits to bad actors), or the less lucrative (and often thankless) white hat approach of reporting it in good faith, and expecting (but not necessarily receiving) equal measures of good faith from corporations (like Sony in this case). Having an awareness of one’s own weaknesses or susceptibilities to temptation isn’t a weakness to be admonished from atop a digital soap box. Instead, recognize and reinforce OPs desire to do good—it costs little more energy to encourage the good in people, rather than shaming them for not having an unshakable moral fortitude. Have a Happy Father’s Day.
  • sjtgraham 4y ago
    • cosmodisk 4y ago
      Why? He's right to the dot.
      • sjtgraham 4y ago
        Let’s assume this is a good faith question: 1. OP isn’t qualified to do so, neither are you for that matter. 2. It stigmatizes mental illness. 3. It doesn’t refute my point. It’s not germane to the point of being mean-spirited, contrary to HN guidelines.
        • polartx 4y ago
          Hey, I’m sorry and I’d genuinely feel bad if my comment seemed like I was targeting you; I will re-read and look for ways to communicate better. I wasn’t being mean-spirited, truly. I was just trying to convey my feelings about how we all could do better to try and move the cursor of focus on the the good intentions of peoples’ struggles; People and things are so rarely black and white. Your first comment sounds like you are a person of high personal ethical standards. Since I don’t know you beyond this thread, I choose to believe that, (after all, why not?). Perhaps you hold others to the similar standards, standards that you’ve earned, and ideally others will earn too. The world would be a better place if we all held high, un-temptable, ethical standards. But holding everyone to that expectation just isn’t realistic, but that doesn’t mean, we can’t, in good faith, try and encourage others to have that goal. I’m just trying to leave the door open to the idea that those that have not made it there yet, will often respond better to encouragement instead of admonishment. I realize that this comment and my previous one will be construed by many as admonishment—I don’t mean it to be. I admire you for your character and simultaneously relate to the OPs self awareness. With each other’s help, we can all be better.
• woodruffw 4y ago
  I won't downvote this, even though I disagree with many of the particulars. One of note: the "criminals" in this context are, at best, homebrew developers and users who'd like to unlock the full potential of the hardware they bought. At worst, they're "pirates" (the industry term, not mine) and game cheats. Nobody likes a cheater in a video game, but I don't know if I'd go as far as to make ethical prescriptions about it. Sony feels comfortable paying a pittance for these vulnerabilities because the market for them is relatively soft. But that doesn't mean that the underlying asset actually lacks value; it means that Sony has successfully criminalized applications of the asset, artificially lowering their salability.
  • woodruffw 4y ago
    Replying, to avoid edit confusion: you're the CEO of a financial services company that seems to employ reverse engineering to figure out private banking APIs. In the (not-very-distant) past, that was potentially criminal under both DMCA and ECPA. Your position affords you a unique opportunity to have some perspective here.
    • sjtgraham 4y ago
      Thanks for noticing. I do have a unique perspective indeed, and that is exactly the activity we engage in. It was never criminal. Reverse engineering for interoperability has always been permitted by law.
      • woodruffw 4y ago
        > Reverse engineering for interoperability has always been permitted by law. It's not that straightforward (even if I wish it was). First, it requires a judge and jury who understand "interoperability" to include "connecting to a server you don't own and sending it payloads that it isn't expecting." Second, it requires a lenient interpretation of EULAs under the DMCA: the DMCA promotes otherwise legal reverse engineering activities into illegal activities by allowing companies to establish "acceptable use," which can include prohibiting reverse engineering activities that circumvent restrictions on copyrighted or other controlled material. A bank may plausibly (in the eyes of attorneys) claim that third-party uses of its APIs compromise the bank's ability to comply with federal regulations, since no law requires that compliance and operation be integral operations.
• boopmaster 4y ago
  In this case, "Crime Pays Much Better" is a valid criticism, relative to the award. It really shouldn't be the case here. This is very much a "worst case scenario" for Sony if publicly released. The award amount IMHO is excessively paltry for the level of effort and the relative impact that this could have caused their business if not reported in an ethical way. An award amount this low, is as other points out and the poster, approaches levels of "deterrent to doing the right thing."
• kvirani 4y ago
  Let's not let our morals get in the way of doing what's right.
• yieldcrv 4y ago
  The market is telling people what the price of a bug is, as the legal monetization paths get more and more numerous, alongside the illegal ones. Its literally only the corporation beneficiaries of having their own product fixed that are paying the wrong amount. Inching up the payout amounts ever so slowly. Anything that makes those corporations pay out better is also a moral outcome, and doing things that supports this status quo lacks ethics as well. (We actually agree that selling to some bidders, and some actions, lack ethics)
• selfmodruntime 4y ago
  You don‘t need „morals“ when the topic is about billion dollar companies who lowball you and nobody gets hurt if you do sell the exploit on the black market
• notjoemama 4y ago
  I see it as a broken social contract, and this behavior has kept me out of white hat too. While selling to the highest bidder isn't what we collectively want to happen, neither should we want large companies to fail rewarding individuals for improving their systems, particularly security. I don't want a landscape of pirated software, but I can't apply moral judgement to someone who chooses to sell the information elsewhere because the owner won't offer in-kind value. It seems to me the first immoral action is actually being made by the company. I wonder if a proper way of addressing this is for individuals to negotiate higher awards through a non-profit specializing in legal and monetary law. But what hasn't worked and will continue to not work is using social moral condemnation. I think we all find "you wouldn't download a car" funny, right? Worse for this situation is the context of the growing economic divide worldwide in 2022. Under that lens I wouldn't be surprised to see this happening more. The more oligarchies show individuals that they don't care, why should individuals show they care about the oligarchies?
• car_analogy 4y ago
  Sony TVs spy on what their viewers are watching, and Playstations specifically are designed to prevent their "owners" from using their property as they wish. And let's not forget the rootkit Sony installed on buyers of their music CDs, for which no Sony employee or executive went to jail. That Sony is not the criminal here is a reflection of our inadequate laws, not morals, and selling vulnerabilities to them is just as bad.
• Rotdhizon 4y ago
  This has always been a heated debate. IMO, the whole concept of "ethical hacking" doesn't exist. The whole concept of morals and ethics is nothing but smoke. It's something someone made up one day to get people to not do bad things and in the modern day companies use it to give out terrible bounty rewards. If I find a high tier vuln and the company isn't giving reasonable bounties, it's going straight onto Zerodium or similar platforms and I won't lose a second of sleep over it.
• HideousKojima 4y ago
  >Your comment completely lacks morals Nah, copyright is immoral, bypassing it is the morally right thing to do.