4 ms·

You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per

You’re significantly underestimating the value of dox-style exploits. Author could have partnered with a black hat vendor who would offer (for example) $25 per lookup. Or they could’ve done bulk scraping of YouTube channels to get emails and sold the dataset. It requires some legwork but they could’ve seen somewhere in the ballpark of 6 figures over 1 year if the exploit wasn’t patched. Oh, and if they had no ethics.

tptacek 2y ago
Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.
- blagie 2y ago
  > not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
  - tptacek 2y ago
    If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
    - blagie 2y ago
      Please read my posts more carefully. Virtually every response is non-responsive to what I wrote: I wrote: "unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal" You wrote: "If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking" That's the exact same thing. You, likewise, didn't notice I was advocating for new statutes in a post above.
      - scarface_74 2y ago
        Someone gives you two kilos of cocaine, doesn’t tell you what’s in the box and tells you not to open it while you transport it across the border and when you get your the other side someone will pay you $20000. You get caught by the DEA. Do you think it’s a valid defense “I didn’t ask what was in the box”? Say the drug dealer you delivered it to got caught and then told authorities you delivered it to them, do you think you would have a valid defense?
        aqueueaqueue 2y ago
        Is that the right analogy? This sounds more like a free speech and free speech exceptions type of issue. (Commenters keep moving the goalposts making for a complex thread where each node in the tree litigates a very different hypothetical situation. Ah HN!) Similar to publishing say... the Anarchists Cookbook.
        scarface_74 2y ago
        > unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal This goes directly to the concept of “willful blindness” https://www.mad.uscourts.gov/resources/pattern2003/html/patt962h.htm#:~:text=%5BA%5D%20willful%20blindness%20instruction%20is,conclude%20that%20an%20inference%20of https://www.mad.uscourts.gov/resources/pattern2003/html/patt...
  - aqueueaqueue 2y ago
    The parent is replying to something different (a $25 a pop dox service), just FYI.

tptacek 2y ago

Does that black-hat vendor already exist? Do they already sell the service of taking $25 to unmask Google users? What calculation does that vendor do about how many customers they'll get before Google notices? Does the exploit developer get a 50% cut? The black-hat vendor is taking all the risk; seems unlikely. Arranging this whole thing is work; finding the "black hat vendor" is work; not getting caught in the process is work; not getting screwed by your partner is work. You pencil out the numbers and this gets less and less plausible as a way to beat a $10,000 lump sum payment. I think the reality though is just that there's literally no buyer for this. You could sell the service yourself! I bet you could make a couple thousand bucks before you and your customers got indicted.

blagie 2y ago
> not getting caught in the process is work Caught for what? If someone sells information about a vulnerability, what law are they breaking? In most jurisdictions, unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal, at least so long as you pay your taxes. If you're doing grey market, it's even more legal. If a dictatorship wants to unmask a critic for assassination, and one is selling this information to a government security agency, it's legal by definition.
- tptacek 2y ago
  If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking. Ask Stephen Watt how this plays out.
  - blagie 2y ago
    Please read my posts more carefully. Virtually every response is non-responsive to what I wrote: I wrote: "unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal" You wrote: "If you sell information about a vulnerability to someone that you know specifically is going to use it to break the law, you are an accessory to that lawbreaking" That's the exact same thing. You, likewise, didn't notice I was advocating for new statutes in a post above.
    - scarface_74 2y ago
      Someone gives you two kilos of cocaine, doesn’t tell you what’s in the box and tells you not to open it while you transport it across the border and when you get your the other side someone will pay you $20000. You get caught by the DEA. Do you think it’s a valid defense “I didn’t ask what was in the box”? Say the drug dealer you delivered it to got caught and then told authorities you delivered it to them, do you think you would have a valid defense?
      - aqueueaqueue 2y ago
        Is that the right analogy? This sounds more like a free speech and free speech exceptions type of issue. (Commenters keep moving the goalposts making for a complex thread where each node in the tree litigates a very different hypothetical situation. Ah HN!) Similar to publishing say... the Anarchists Cookbook.
        scarface_74 2y ago
        > unless you're dumb enough to ask questions about whom your selling to and have active knowledge you're assisting someone in breaking some law, selling to the black market is perfectly legal This goes directly to the concept of “willful blindness” https://www.mad.uscourts.gov/resources/pattern2003/html/patt962h.htm#:~:text=%5BA%5D%20willful%20blindness%20instruction%20is,conclude%20that%20an%20inference%20of https://www.mad.uscourts.gov/resources/pattern2003/html/patt...
- aqueueaqueue 2y ago
  The parent is replying to something different (a $25 a pop dox service), just FYI.