4 ms·
$6 500 bounty for this is a joke. The black market price would be smth like $6 500 000 or more
by kerenskiy 15d ago
$6 500 bounty for this is a joke. The black market price would be smth like $6 500 000 or more
- sudo_cowsay 15d agoThat's why people like doing bad things. It pays. Why do you think movies like using this single theme over and over again? It's always happening
- kdkdkwkdjej 15d agoI suspect you don’t really know what you are talking about. “It pays.” is not the only reason people like doing bad things. You’re right about the movies bit though, people tend to like black and white narratives as your naive “That’s why people like doing bad things. It pays.” comment perfectly demonstrates.
- tptacek 15d agoThere is probably no black market for this at all. https://news.ycombinator.com/item?id=43025038 https://news.ycombinator.com/item?id=43025038
- parhamn 15d ago> Valuations for server-side vulnerabilities are low, because vendors don't compete for them. Why don't they?
- devmor 15d agoBecause as soon as they are patched, they are worthless. People pay for vulnerabilities because they want to exploit them - if there’s a limited window, there’s limited demand. Even if there’s something worth a lot behind the exploit, a potential criminal would be better off obtaining whatever that is and selling it instead.
- deleted 15d ago[deleted]
- kerenskiy 15d agoOkay, then first download all their sources (perhaps with model weights?) and sell that. Not the bug itself
- tptacek 15d agoNow you're not selling a vulnerability, you're planning a heist. That is a thing you can do!
- lbrandy 15d agoYou and I have both been here on HN nearing 20 years and you’ve been making this comment to that comment about bug bounties and the supposed black market value of exploits for the whole time. I suspect you’ll never run out of threads to correct. Thank you for your service.
- Mohansrk 15d agocurious, the bug allows dumping private repositories of openai, that sure has black market right?
- akerl_ 15d agoWhat criminal enterprise does getting private OpenAI repos fit into?
- loveparade 15d agoI also thought that's crazy. Why even bother for these kind of bounties.
- samtheprogram 15d agoPer the article, that's the price OpenAI is willing to pay for an exploit that covers any account or integration one connects to their OpenAI account. Let that sink in. I don't think the other commenters mentioning how server-side vulnerabilities aren't as lucrative in the black market are making that connection.
- fancythat 15d agoYes. And that's why, if you are in the bug bounty business it is important to focus on companies that understand security and pay well and not on wannabe slave owners like this one. No pay - no audit.