3 ms·

Seems like infosuck folks are squabbling over "who can be the most-est-est ethical". Im like, if I do a reporting over a vuln, you can pay me. Ive been stiffed

by pierat 3y ago

Seems like infosuck folks are squabbling over "who can be the most-est-est ethical". Im like, if I do a reporting over a vuln, you can pay me. Ive been stiffed over the last 2 where a real vuln is claimed as "not a problem", and then patched. Im looking at selling to graymarket dealers my vulns instead. At least they pay.

piva00 3y ago
Trying to have some ethics in this space makes sense though, you probably don't want to be directly responsible for causing pain and stress to users, yes, the company developing the software should do better security-wise, it does not remove your responsibility from selling it to the gray market and potentially causing massive issues to end users who have no horse in the race in your fight against the developers, you are potentially making victims for a quick pay off and making a statement. Are you working on this to make software more secure or is it simply about money? You can make more money if you cozy up with some criminals, where will you draw the line?
- saltyspaghetti 3y ago
  I really hate this take. If a company refuses to pay more than the gray market is offering, then they are the ones at fault for putting their users at risk. Go and guilt trip the entities who are undervaluing the time and effort spent finding vulnerabilities. I place zero blame on researchers selling vulns unless the software company is willing to pay at least as much as the gray market.
  - piva00 3y ago
    And I really hate this take. It's basically a hostage situation then "pay us as much as those criminals there would pay or else... Your users will suffer the consequences". Yes, it's the company's fault for putting the users at risk by creating an exploitable issue, there's the other side of the coin where it will be the "researcher's" fault for selling it to the highest bidder damned be the consequences. Both sides have their ethical issues, I think the company should pay but also that researchers should look quite deep into their souls if it's ethical to fuck with users because an entity they have no control over (the company) fucked up. To me it sounds like an immature tantrum, unfortunately from my experience with security researchers it feels to be a field with quite a few rage-tantrums. Ethics do matter, on both sides.
    - saltyspaghetti 3y ago
      Why shouldn’t there be bidding wars to determine the value of an exploit? These large software companies have zero issue with exploiting capitalism when it benefits their bottom line, and yet it’s suddenly unethical for a researcher to demand to be paid market value for their work? Look at Google, a 1.6 trillion dollar company. They have virtually limitless resources when it comes to paying for secure software, and yet they offer less than half the $ for an Android zero click when compared to Zerodium. Pay people the fair market value for their work and all of this becomes a non-issue. They can afford to do it.
      - piva00 3y ago
        The ethical issue is when this capitalist fight between market prices for exploits have very real damaging consequences for unwitting users that have nothing to do with the bullshit. Why should they pay the ultimate price because a company is trying to fleece security researchers? Is that the only way to make them pay, to cause damage to what amount to "civilians" in this war? That's my point, these people, very real people, have nothing to do with the whole bullshit, they trusted in a 3rd party to use their product, they can't audit every single 3rd party they use for security holes, even less research themselves ways to exploit them before using their products, you are saying that it's ok for these people to suffer because Google didn't want to pay for an exploit that was discovered. It boils down to the same question: why are the researchers doing this job? If it's because they believe they are helping make software more secure then ethically they shouldn't be putting unwitting end users into harm. If they are just looking for a paycheck then it's just morally corrupt to use users as hostages to get a ransom. I repeat what I said: this is the ethical discussion I'd like to see happening, not this immature "they didn't pay me, so fuck all the users, I will blow it all!", that just sounds like children throwing tantrums. Again: why do researchers do this job? Underneath that you can judge if it's ethical to just sell to the highest bidder, capitalism is amoral, we as humans imbue some sense of morality into it... This approach of "pay what the market is paying or else I will fuck your users" is, in my opinion, ethically wrong, if a researcher is serious about the job they are performing to make the world a less shit place then they need to have some moral guideline to follow, if not it's all bullshit and they are just mercenaries, and I don't support mercenaries.

by pierat 3y ago

piva00 3y ago

Trying to have some ethics in this space makes sense though, you probably don't want to be directly responsible for causing pain and stress to users, yes, the company developing the software should do better security-wise, it does not remove your responsibility from selling it to the gray market and potentially causing massive issues to end users who have no horse in the race in your fight against the developers, you are potentially making victims for a quick pay off and making a statement. Are you working on this to make software more secure or is it simply about money? You can make more money if you cozy up with some criminals, where will you draw the line?

saltyspaghetti 3y ago
I really hate this take. If a company refuses to pay more than the gray market is offering, then they are the ones at fault for putting their users at risk. Go and guilt trip the entities who are undervaluing the time and effort spent finding vulnerabilities. I place zero blame on researchers selling vulns unless the software company is willing to pay at least as much as the gray market.
- piva00 3y ago
  And I really hate this take. It's basically a hostage situation then "pay us as much as those criminals there would pay or else... Your users will suffer the consequences". Yes, it's the company's fault for putting the users at risk by creating an exploitable issue, there's the other side of the coin where it will be the "researcher's" fault for selling it to the highest bidder damned be the consequences. Both sides have their ethical issues, I think the company should pay but also that researchers should look quite deep into their souls if it's ethical to fuck with users because an entity they have no control over (the company) fucked up. To me it sounds like an immature tantrum, unfortunately from my experience with security researchers it feels to be a field with quite a few rage-tantrums. Ethics do matter, on both sides.
  - saltyspaghetti 3y ago
    Why shouldn’t there be bidding wars to determine the value of an exploit? These large software companies have zero issue with exploiting capitalism when it benefits their bottom line, and yet it’s suddenly unethical for a researcher to demand to be paid market value for their work? Look at Google, a 1.6 trillion dollar company. They have virtually limitless resources when it comes to paying for secure software, and yet they offer less than half the $ for an Android zero click when compared to Zerodium. Pay people the fair market value for their work and all of this becomes a non-issue. They can afford to do it.
    - piva00 3y ago
      The ethical issue is when this capitalist fight between market prices for exploits have very real damaging consequences for unwitting users that have nothing to do with the bullshit. Why should they pay the ultimate price because a company is trying to fleece security researchers? Is that the only way to make them pay, to cause damage to what amount to "civilians" in this war? That's my point, these people, very real people, have nothing to do with the whole bullshit, they trusted in a 3rd party to use their product, they can't audit every single 3rd party they use for security holes, even less research themselves ways to exploit them before using their products, you are saying that it's ok for these people to suffer because Google didn't want to pay for an exploit that was discovered. It boils down to the same question: why are the researchers doing this job? If it's because they believe they are helping make software more secure then ethically they shouldn't be putting unwitting end users into harm. If they are just looking for a paycheck then it's just morally corrupt to use users as hostages to get a ransom. I repeat what I said: this is the ethical discussion I'd like to see happening, not this immature "they didn't pay me, so fuck all the users, I will blow it all!", that just sounds like children throwing tantrums. Again: why do researchers do this job? Underneath that you can judge if it's ethical to just sell to the highest bidder, capitalism is amoral, we as humans imbue some sense of morality into it... This approach of "pay what the market is paying or else I will fuck your users" is, in my opinion, ethically wrong, if a researcher is serious about the job they are performing to make the world a less shit place then they need to have some moral guideline to follow, if not it's all bullshit and they are just mercenaries, and I don't support mercenaries.