4 ms·
It feels like there's a legitimate 'cobras problem' risk with this. Though I guess it's more like hiring and training mercenaries. Because you are training peop
by rocqua 2y ago
It feels like there's a legitimate 'cobras problem' risk with this.
Though I guess it's more like hiring and training mercenaries.
Because you are training people with dangerous skills, promising them money in return. If the money dries up, they will start looking for other ways to employ their skills to make a living.
Not that all, or even most, people with those skills would abuse them. But it doesn't take that many, and things might be worse if you start attracting people with insanely big sums.
- colechristensen 2y agoBlack markets for exploits have been thriving for a long time. There are plenty of security consultants and penetration testing houses out there getting paid already. Turns out people put a lot of value on not having to launder black market earnings or deal with opsec of hiding their participation.
- sitkack 2y agoCobra is already out of the bag, we see corporations loosing billions over dumb mistakes. The contest showed what some skilled individuals or someone else could eventually do. We can't hide behind access. The threats are too big.
- ben_w 2y agoThe cobra effect is another phrase for "perverse incentives", named after the time the British paid people to kill cobras without realising this meant they were paying people to breed cobras, and when they realised and stopped all the bread cobras were released into the wild leaving the area with more cobras than when they started: https://en.wikipedia.org/wiki/Perverse_incentive https://en.wikipedia.org/wiki/Perverse_incentive I think this analogy would only fit if the hackers could somehow "breed" bugs, but as they don't work at the corporations making the buggy software I don't see how that would be possible — but then, I'm British by birth, so perhaps I have a blind spot for creating perverse incentives ;)
- no_time 2y agoThe cobra analogy doesn't work because there is a finite amount of use after frees and buffer overflows to be exploited in any given codebase. Companies could choose to outbid the black market on every single one of them if they wanted to, they just don't.
- jeffreygoesto 2y agoThere will be plenty. A"I" is going to copy them from the past to the future in unreviewable speed.
- boxed 2y agoWhat would be the analogy? That programmers plant exploits in their code, only to quit their job and collect money from the exploits? That seems pretty far fetched. It also seems like something that could be easily fixed by companies suing anyone who does this into the ground for planting backdoors. Or just prosecuting them in a normal court.
- blueflow 2y agoNo need to implant new bugs. Having access to the source code is enough to spot bugs. Instead of reporting them to your internal Jira, you sell it on $website. The buyer can fetch the bounty and will be left with a margin.
- datavirtue 2y agoThen again exposing weaknesses in your development processes.
- belter 2y agoMost likely these were introduced in the code maliciously, then leaked to the teams to get the money....