6 ms·

Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.

• Hackbraten 3mo ago
  How is that sustainable? Are security researchers going to be doing free labor for you indefinitely for exposure?
  • stephantul 3mo ago
    They sell their products using the credentials they gained. I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.
    • Hackbraten 3mo ago
      What happens after a couple of players have obtained marketshare and the market has consolidated? I think there are diminishing returns to be had.
  • hn_throwaway_99 3mo ago
    This is essentially Snyk's business model. Sure, they do upsells, but it seems fully sustainable to me.