3 ms·
Quite frankly I also blame the criminalization of responsible bug reporting. For example, Barret Brown ( http://www.democracynow.org/2013/7/11/jailed_journalis
by pm24601 13y ago
Quite frankly I also blame the criminalization of responsible bug reporting.
For example, Barret Brown ( http://www.democracynow.org/2013/7/11/jailed_journalist_barrett_brown_faces_105 http://www.democracynow.org/2013/7/11/jailed_journalist_barr... ) is facing jail time.
Others have tried to report security issues and been threaten or charged with hacking. ( I will let you google for examples - there are quite a bit)
At DefCon there have been cases where presenters were threatened with charges for reporting security issues.
Selling the vuln "solves" the problem for the responsible hacker.
I know if I found a bug - I would be unlikely to report it - too dangerous.
- ontoillogical 13y agoBarret Brown wasn't really involved in bug hunting. He is charged with posting a link to an email dump (hacked by someone else) that contained financial data among other things. You're probably thinking of weev, although what he didn't wasn't exactly "responsible bug hunting either", if you follow the common definition of that term.
- preter 13y agoIt's sad but accurate. The safest route for the reporter is to sell it to people who want to attack their enemies, the vendor wont bully them, administrators wont attack them and you're shielded from criticism. It's unfortunately common for administrators to believe security is the state of perpetual ignorance of vulnerabilities that affect them, if Windows Update says "No updates available" then you're secure. If you tear them from that blissful ignorance, then they get angry and shoot the messenger. Security researchers do not introduce insecurity, they expose it. This is apparently a very hard concept to grasp for a lot of people.