4 ms·
Again, here you have not so much sold a vulnerability as you have planned a heist. I agree, preemptively: you can get a lot of money from a well-executed heist!
by tptacek 11mo ago
Again, here you have not so much sold a vulnerability as you have planned a heist. I agree, preemptively: you can get a lot of money from a well-executed heist!
- rvnx 11mo agoDo you want to execute actions as logged-in user on high-value website XXX ? If yes -> very useful
- tptacek 11mo agoNobody is disputing that a wide variety of vulnerabilities are "useful", only that there's no market for most of them. I'd still urgently fix an XSS.
- rvnx 11mo agoThere is a market outside Zerodium, it's Telegram. Finding a buyer takes time and trust, but it has definitively higher value than 4k USD because of its real-world impact, no matter if it is technically lower on the CVSS scores.
- tptacek 11mo agoReally? Tell me a story about someone selling an XSS vulnerability on Telegram. ("The CVSS chart"?) Moments later Why do people keep bringing up "Zerodium" as if it's a thing?
- rvnx 11mo agoI understand your perspective about the technical value of an exploit, but I disagree with the concept that technical value = market value. There are unorganized buyers who may be interested if they see potential to weaponize it. In reality, if you want to maximize revenue, yes, you need to organize your own heist (if that's what you meant)
- tptacek 11mo agoDo you know this or do you just think it should be true?
- JumpCrisscross 11mo ago> understand your perspective about the technical value of an exploit Going out on the world’s sturdiest limb and saying u/tptacek knows the technical and trading sides of exploits. (Read his bio.)