4 ms·
My criticism doesn't concern Google's ethics, it concerns their practicality. Common sense says that with bounties like that, they won't attract the most serio
by p-e-w 3y ago
My criticism doesn't concern Google's ethics, it concerns their practicality.
Common sense says that with bounties like that, they won't attract the most serious exploits, which isn't an ethical problem, but can absolutely be a security problem.
- renewiltord 3y agoThey only have to beat the prevailing rate on zerodium to get it first. It's not like every exploit is some magically usable thing that can exfil all the googs. People really overrate a bunch of things. There was a crypto company running with all spectre:meltdown mitigation off. And no one took the money until the company went bust and an insider tried to run with it. I also told the world that it was the case so it wasn't secret: https://news.ycombinator.com/item?id=32077583 https://news.ycombinator.com/item?id=32077583 That was a lot of money untraceable if so many of these were exploitable. They're generally not. Google is often the best buyer.
- deleted 3y ago[deleted]