4 ms·

Can I ask why you decided to disclose this exploit rather than sell it to a company like Zerodium? Is it a matter of ethics, or is the money not worth it for yo

by cedws 3y ago

Can I ask why you decided to disclose this exploit rather than sell it to a company like Zerodium? Is it a matter of ethics, or is the money not worth it for you?

junaru 3y ago
> Zerodium customers are government institutions (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities. How does this even openly exist in post Stuxnet world? If this is not clear evidence of government working with criminals i don't know what is.
- streb-lo 3y ago
  >clear evidence evidence is not what someone writes on their landing page
- londons_explore 3y ago
  Governments only say they don't work with criminals.
  - redundantly 3y ago
    Government officials are often criminals themselves.
  - okasaki 3y ago
    Or the company is lying. It's not like anyone can check.
Unroll0201 3y ago
For me it is about the ethics among other things. I do not know to which goverments Zerodium is selling, much like any other zeroday broker. Additionally, I wouldn't be surprised if selling to Zerodium is illegal to begin with. By taking the KernelCTF approach I get my bounty, I don't get into legal trouble, and I get to contribute to the Linux kernel VR community which means a lot to me
- ok_dad 3y ago
  Thank you for having morals and giving this away to the community. Governments already have enough power that they don’t need more. I respect this very much, it’s hard to find people on hacker news who aren’t dyed in the wool capitalists.
  - Shocka1 3y ago
    There is a diverse mix here and always has been - it's one of the best things about this place. Rolling up a statement to apply to a whole group of people is defined as stereotyping and not the highest version of critical thought. To state all Capitalists on HN would sell a CVE to the highest bidder is just as ridiculous as saying a Communist/Libertarian/Socialist would.
- buggeryorkshire 3y ago
  Thank you, appreciated.
caskstrength 3y ago
You are being downvoted, but as an outside observer I have also always been interested in ethics of security research.

by cedws 3y ago

Can I ask why you decided to disclose this exploit rather than sell it to a company like Zerodium? Is it a matter of ethics, or is the money not worth it for you?

junaru 3y ago

> Zerodium customers are government institutions (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities. How does this even openly exist in post Stuxnet world? If this is not clear evidence of government working with criminals i don't know what is.

streb-lo 3y ago
>clear evidence evidence is not what someone writes on their landing page
londons_explore 3y ago
Governments only say they don't work with criminals.
- redundantly 3y ago
  Government officials are often criminals themselves.
- okasaki 3y ago
  Or the company is lying. It's not like anyone can check.

Unroll0201 3y ago

For me it is about the ethics among other things. I do not know to which goverments Zerodium is selling, much like any other zeroday broker. Additionally, I wouldn't be surprised if selling to Zerodium is illegal to begin with. By taking the KernelCTF approach I get my bounty, I don't get into legal trouble, and I get to contribute to the Linux kernel VR community which means a lot to me

ok_dad 3y ago
Thank you for having morals and giving this away to the community. Governments already have enough power that they don’t need more. I respect this very much, it’s hard to find people on hacker news who aren’t dyed in the wool capitalists.
- Shocka1 3y ago
  There is a diverse mix here and always has been - it's one of the best things about this place. Rolling up a statement to apply to a whole group of people is defined as stereotyping and not the highest version of critical thought. To state all Capitalists on HN would sell a CVE to the highest bidder is just as ridiculous as saying a Communist/Libertarian/Socialist would.
buggeryorkshire 3y ago
Thank you, appreciated.

caskstrength 3y ago

You are being downvoted, but as an outside observer I have also always been interested in ethics of security research.