3 ms·

I hate it when Schneier talks about things he knows very little about, because he tends to be listened to and treated as an expert when he might not really know

by iuguy 14y ago

I hate it when Schneier talks about things he knows very little about, because he tends to be listened to and treated as an expert when he might not really know much. This is one of those cases. A lot of what he describes are clearly assumptions and it's hard to get facts, but because he hasn't described them as so, many people will accept them as a primary source because of who he is. I don't blame Schneier for this, but it's important to remember he's just a guy with a blog writing an article about his thoughts. He doesn't sell vulnerabilities, he's not active in the marketplace.

daeken 14y ago
I'd really love to hear your thoughts on what's wrong in his view. I tend to agree that he's wrong, but I can't put my finger on why, honestly. Personally, the zero-day market is beginning to look very interesting to me; I went from reverse-engineering things in public, to working as a security consultant, to now working as a software dev. After everything I've seen of the security world, it seems to me that the vulnerability market is the most interesting, lucrative part of the industry. I just wish that there was more information available; behind-closed-doors meetings introduced by friends-of-a-friend seem to me to not only be dangerous (to me and everyone else) but inefficient from a market perspective.
- iuguy 14y ago
  I posted a comment explaining my view on where Schneier was wrong here: http://news.ycombinator.com/item?id=4053210 http://news.ycombinator.com/item?id=4053210
- tptacek 14y ago
  Vulnerability markets are definitely not the most lucrative part of the industry. It's just the most lucrative high-status part of the industry.
quesera 14y ago
Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? I agree that that part is speculative, but I think his major point (as I read it) is that the monetization of exploits by third parties (bad guys, govts, etc) is predicated on the value of keeping the software exploitable, to the detriment of all but those on the high side of the informational disparity curve. I agree with him that that is unfortunate, but it seems like business as usual to me, in every industry everywhere.
- iuguy 14y ago
  > Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way. The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now. I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.
- brohee 14y ago
  "Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage?" This hold about as much water as antivirus editors commissioning viruses. Somewhat plausible but worthless without proof.
- tptacek 14y ago
  Exactly which vulnerability market participants would buy and hide code-sabotage flaws? Oh, right, the same ones who were buying vulnerabilities before ZDI existed.

by iuguy 14y ago

daeken 14y ago

I'd really love to hear your thoughts on what's wrong in his view. I tend to agree that he's wrong, but I can't put my finger on why, honestly. Personally, the zero-day market is beginning to look very interesting to me; I went from reverse-engineering things in public, to working as a security consultant, to now working as a software dev. After everything I've seen of the security world, it seems to me that the vulnerability market is the most interesting, lucrative part of the industry. I just wish that there was more information available; behind-closed-doors meetings introduced by friends-of-a-friend seem to me to not only be dangerous (to me and everyone else) but inefficient from a market perspective.

iuguy 14y ago
I posted a comment explaining my view on where Schneier was wrong here: http://news.ycombinator.com/item?id=4053210 http://news.ycombinator.com/item?id=4053210
tptacek 14y ago
Vulnerability markets are definitely not the most lucrative part of the industry. It's just the most lucrative high-status part of the industry.

quesera 14y ago

Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? I agree that that part is speculative, but I think his major point (as I read it) is that the monetization of exploits by third parties (bad guys, govts, etc) is predicated on the value of keeping the software exploitable, to the detriment of all but those on the high side of the informational disparity curve. I agree with him that that is unfortunate, but it seems like business as usual to me, in every industry everywhere.

iuguy 14y ago
> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way. The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now. I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.
brohee 14y ago
"Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage?" This hold about as much water as antivirus editors commissioning viruses. Somewhat plausible but worthless without proof.
tptacek 14y ago
Exactly which vulnerability market participants would buy and hide code-sabotage flaws? Oh, right, the same ones who were buying vulnerabilities before ZDI existed.