5 ms·

>...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "ind

>...can't pay someone that found a bug impacting all their clients?...he could have just sold the vulnerability to the highest bidder This attitude is why "independent security researchers" offering to present unsolicited findings to companies in exchange for payment feels exactly like extortion.

zdimension 2y ago
At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.
- unclebucknasty 2y ago
  >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
  - bongodongobob 2y ago
    It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
    - worewood 2y ago
      Great response, entirely agree.
    - unclebucknasty 2y ago
      You just manufactured a completely different scenario. The comment I responded to was this: >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.
      - bongodongobob 2y ago
        I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.
        unclebucknasty 2y ago
        >I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical. The following two sentences read the same to me: "To remove my incentive to harm you, you should pay me". "To remove my incentive to share information with others who may harm you, you should pay me". And, the threat is pretty clear IMO.
        bongodongobob 2y ago
        Do you not lock your doors because you feel you shouldn't have to worry about people stealing your stuff because it's morally wrong to steal or do you do it to mitigate risk? Suggesting someone should mitigate potential risk is all we are talking about.
        unclebucknasty 2y ago
        You're making a different argument now. https://news.ycombinator.com/item?id=40577683 https://news.ycombinator.com/item?id=40577683
  - pixl97 2y ago
    At the end of the day your enemy has no ethics, and we share the public internet with enemies. If paying to find security flaws means it's more likely people will find your flaws rather than sell them to someone that will use them for nefarious means then it is the better bet.
    - unclebucknasty 2y ago
      Making an argument for what's practical and what's ethical are two different things. My comment was about the latter. Yours appears to be about the former. Ransomware victims have sometimes found it practical to pay the ransom. They're still victims of extortion.
notactuallyben 2y ago
while beg bounty people can be annoying, you have to remember that people aren't obligated to sit down and find free bugs for any company (especially not a big one) - why would i sit down and look at some code for free for some giant corp when i could go to the beach instead?
- unclebucknasty 2y ago
  No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.
  - imadr 2y ago
    I would agree with everything you said, If we ignore the fact that the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean for them. Do you think it's reasonable to say the the ethics of what you call "extortion" should depend with how big the company is? I'm obviously not advocating for making a small company pay more than they can manage
    - unclebucknasty 2y ago
      >the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean That framing is strange to me. If they want to offer a bug bounty, then they can. But, it's their choice. Maybe they'd instead rather engage a security firm of their own selection. But, whatever the case, to say "they should pay the money because they can afford to" isn't right to me. I don't believe the definition of extortion changes based on how big the target is or whether it can afford to pay. In fact, the line of thinking in some of the comments here is so far off from what seems obviously ethical to me that I've had to re-read a few times to ensure that I'm not missing something.
  - depressedpanda 2y ago

zdimension 2y ago

At the same time, Cox is a commercial entity that makes money by providing services. Cyberattacks make them lose money, so it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. We're not talking about a grandma losing her wallet with 50 bucks in it and not giving money to the guy that found it and gave her back.

unclebucknasty 2y ago
>it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
- bongodongobob 2y ago
  It's not the definition of extortion. If I walk past a business and notice the locks on their windows are rusted and I happen to be a lock guy and say hey, I noticed your locks are fucked, I'd be happy to consult for you and show you how and why they are broken, that's just doing business. Extortion is telling them, hey, your locks are fucked and I'm telling everyone unless you pay me. It requires a threat.
  - worewood 2y ago
    Great response, entirely agree.
  - unclebucknasty 2y ago
    You just manufactured a completely different scenario. The comment I responded to was this: >it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those. That comment includes the threat ("instead of easily and anonymously selling those"). So, yes. That is the definition of extortion.
    - bongodongobob 2y ago
      I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical.
      - unclebucknasty 2y ago
        >I think preventing people from having that incentive vs an actual threat are not the same, which is how I read the hypothetical. The following two sentences read the same to me: "To remove my incentive to harm you, you should pay me". "To remove my incentive to share information with others who may harm you, you should pay me". And, the threat is pretty clear IMO.
        bongodongobob 2y ago
        Do you not lock your doors because you feel you shouldn't have to worry about people stealing your stuff because it's morally wrong to steal or do you do it to mitigate risk? Suggesting someone should mitigate potential risk is all we are talking about.
        unclebucknasty 2y ago
        You're making a different argument now. https://news.ycombinator.com/item?id=40577683 https://news.ycombinator.com/item?id=40577683
- pixl97 2y ago
  At the end of the day your enemy has no ethics, and we share the public internet with enemies. If paying to find security flaws means it's more likely people will find your flaws rather than sell them to someone that will use them for nefarious means then it is the better bet.
  - unclebucknasty 2y ago
    Making an argument for what's practical and what's ethical are two different things. My comment was about the latter. Yours appears to be about the former. Ransomware victims have sometimes found it practical to pay the ransom. They're still victims of extortion.

notactuallyben 2y ago

while beg bounty people can be annoying, you have to remember that people aren't obligated to sit down and find free bugs for any company (especially not a big one) - why would i sit down and look at some code for free for some giant corp when i could go to the beach instead?

unclebucknasty 2y ago
No, they aren't obligated. So, if there's no bug bounty program in place, then they should either go to the beach or be willing to find bugs for the public good. The idea that the company owes them anything for their unsolicited work is misguided. And, if they present the bugs for money under the implicit threat of selling the information to people who would harm the company, then it's extortion.
- imadr 2y ago
  I would agree with everything you said, If we ignore the fact that the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean for them. Do you think it's reasonable to say the the ethics of what you call "extortion" should depend with how big the company is? I'm obviously not advocating for making a small company pay more than they can manage
  - unclebucknasty 2y ago
    >the company has billions of dollars in revenue and paying a bug bounty is a drop in the ocean That framing is strange to me. If they want to offer a bug bounty, then they can. But, it's their choice. Maybe they'd instead rather engage a security firm of their own selection. But, whatever the case, to say "they should pay the money because they can afford to" isn't right to me. I don't believe the definition of extortion changes based on how big the target is or whether it can afford to pay. In fact, the line of thinking in some of the comments here is so far off from what seems obviously ethical to me that I've had to re-read a few times to ensure that I'm not missing something.
- depressedpanda 2y ago