5 ms·

Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? I agree that that part is speculative, but I think

by quesera 14y ago

Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? I agree that that part is speculative, but I think his major point (as I read it) is that the monetization of exploits by third parties (bad guys, govts, etc) is predicated on the value of keeping the software exploitable, to the detriment of all but those on the high side of the informational disparity curve. I agree with him that that is unfortunate, but it seems like business as usual to me, in every industry everywhere.

iuguy 14y ago
> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way. The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now. I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.
brohee 14y ago
"Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage?" This hold about as much water as antivirus editors commissioning viruses. Somewhat plausible but worthless without proof.
tptacek 14y ago
Exactly which vulnerability market participants would buy and hide code-sabotage flaws? Oh, right, the same ones who were buying vulnerabilities before ZDI existed.

by quesera 14y ago

iuguy 14y ago

> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage? No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way. The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now. I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.

brohee 14y ago

"Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage?" This hold about as much water as antivirus editors commissioning viruses. Somewhat plausible but worthless without proof.

tptacek 14y ago

Exactly which vulnerability market participants would buy and hide code-sabotage flaws? Oh, right, the same ones who were buying vulnerabilities before ZDI existed.