3 ms·
Zerodium and similar 0day sweatshops pays a lot for these 0days. Bug bounty programs directly thru the companies have been documented to screw over researchers.
by b8 2y ago
Zerodium and similar 0day sweatshops pays a lot for these 0days. Bug bounty programs directly thru the companies have been documented to screw over researchers.
- tptacek 2y agoZero-day brokers pay in tranches for completed reliable exploits; bug bounties pay in lump sums for (generally) POCs. It's not an apples-apples comparison.
- kachapopopow 2y agoCan confirm.
- b8 2y agoZDI pays lump sums AFAIU.
- tptacek 2y agoZDI is more like a bug bounty than a grey market broker.