5 ms·

People will decry this, but I'd argue a free and open market for vulnerabilities would be a great thing. Here's why: 1) It would result in more vulnerabilities

by kauffj 12y ago

People will decry this, but I'd argue a free and open market for vulnerabilities would be a great thing. Here's why: 1) It would result in more vulnerabilities found This is fairly axiomatic. An open market increases the price of vulnerabilities which in turn increases the number of vulnerabilities found (unless you want to argue the ability to find vulnerabilities is inelastic for some reason). 2) It would result in more vulnerabilities being disclosed to the proper authorities rather than malicious parties This is more debatable, but since there should always be significantly more incentive on good actors to prevent the exploit (i.e. the software creators and/or community) than bad actors, the good actors should always win the bid. Indeed, one could argue that it is only the prevention of free negotiation in the sale of vulnerabilities is the reason an exploit is ever sold to bad actors (e.g. if I found a Windows vulnerability and told Microsoft $10m or else, I'm a criminal). 3) It would ultimately increase the quality of software Given more vulnerabilities are found and more vulnerabilities would be disclosed to good actors, the quality of software increases. I believe that 2) is essentially the Coase theorem (http://en.wikipedia.org/wiki/Coase_theorem http://en.wikipedia.org/wiki/Coase_theorem), but I am only an arm-chair economist. Also, I'm not sure that what Mitnick is doing actually is a free and open market for vulnerabilities.

melville_X 12y ago
I mostly disagree with arguments to rationalize the sale of exploits, they create a massive power balance towards bad actors, but we have to be honest with ourselves, and like drugs, 0days are not going away. Our only proper response is secure software development practices, employment of security reseachers, and adoption of security-centric practices in critical systems... such as the Linux kernel. Which is embarassingly not the case at the moment. For ex: http://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel http://unix.stackexchange.com/questions/59020/why-are-the-gr...
hawkice 12y ago
I upvoted, not because I agree, but because I believe the people downvoting you are downvoting because they disagree and not because your comment shouldn't be heard. Imagine he had said: I believe a free and open market for weapons would be a good thing, because it would reduce the number of defenseless people, would result in a power imbalance that puts generally-okay actors at an advantage (say what you will, but the mob doesn't have 1% of the resources the US government does), and would therefore reduce crime. I do not personally find that argument compelling (and it is of identical structure to the above), but me disagreeing with it does not mean it isn't of sufficient quality for Hacker News.
- kauffj 12y ago
  Thanks. I was disappointed to see downvotes rather than engagement in the argument. You prompt a fascinating hypothetical: suppose all the world's atomic weapons were put up in a free, transparent auction? (i.e. bidders and bids are disclosed) I'd argue that most would end up in the hands of good actors (e.g. the world bands behind the Dalai Lama to buy and destroy them all), but who knows? Good debate topic for happy hour, though.
  - justizin 12y ago
    Unfortunately, the size of the world's nuclear arsenal being what it is, it doesn't much matter if "most" of the nuclear weapons end up in the hands of good actors.
    - mentat 12y ago
      I think this is also the case for vulnerabilities as well unfortunately.
      - justizin 12y ago
        That was my point.
- drewblaisdell 12y ago
  > I do not personally find that argument compelling (and it is of identical structure to the above) Replacing "vulnerabilities" with "firearms" while retaining the same argument structure does not mean that both arguments are logically identical (a false equivalency). The implications of a free market for information security and a free market for firearms are totally different.
  - readymade 12y ago
    Analogies rarely, if ever, imply a total equivalence between the things being compared. That's what makes them analogies, not formal deductive proofs.
vtlynch 12y ago
On your second point.... Governments should be assumed to be bad actors and they certainly have some of the deepest pockets. If an open market increases the price, it would seem to make it a better market for bad actors. Especially if we think of small software companies or open-source projects (like OpenSSL) who cant afford to pay hundreds of thousands of dollars to secure their own exploit. On your overall point... I think this issue of selling 0days is more a debate of ethics, and I don't think economics can solve a problem of ethics.
GeneralMayhem 12y ago
>An open market increases the price of vulnerabilities That's impossible to tell. You could just as easily say that the price will crash when you take away all the costs and risk of running a black market and give buyers a place to compare multiple "products." The demand side could just as easily be inelastic (or at least saturated) as the supply. > the good actors should always win the bid This works if you're talking about Microsoft, but not if you're talking about smaller companies or open source products. Maybe a Google or a Facebook would step up and pay off the market for things that they use, but "the rich people will take care of us" is not a setup that I'm comfortable with.
- x0x0 12y ago
  But you aren't choosing between a perfect world, where bugs get reported only to the vendors and the vendors promptly fix them, and an open market. Right now, governments and shady corporations are already buying. If it costs some company $250k or $1M to buy their vulnerability, maybe they'll work harder in the future. Or hire their own pen testers. And they'll have the money, because almost by definition attractive vulnerabilities are those in widely used software. In the complaints about auctioning off vulnerabilities it's hard to avoid hearing companies bitching that they may have to pay security researchers, and it will be harder to intimidate them with law enforcement.
kyberias 12y ago
I don't agree with you (on all points) but none the less applaud your ideas and the way you formulate your arguments.
tzs 12y ago
> This is fairly axiomatic. An open market increases the price of vulnerabilities which in turn increases the number of vulnerabilities found (unless you want to argue the ability to find vulnerabilities is inelastic for some reason) Wait a second...won't increasing the number of vulnerabilities found push prices down? If I'm looking to penetrate a system I only need to buy one vulnerability, so in effect different vulnerabilities are somewhat fungible and so should compete on price. Hence, if more vulnerabilities are being found and coming to market, prices should be going down. On the other hand, with a free and open market for vulnerabilities there would likely be people who would NOT have bought vulnerabilities on the black market buying vulnerabilities on the safer, easier to use free and open market, so demand could go up, raising prices.
stormbrew 12y ago
I'm not sure you can, in practice, have a completely free and open market for vulnerabilities, since any information about the vulnerability released broadly is likely to shorten the path to others discovering the same vulnerability [1], devaluing it implicitly through partial disclosure. So there's an interest in the market being small and secret. For the seller to keep the price high and for the buyer to maintain exclusivity on the exploit. [1] As a case in point, I showed the headline of the email for the bash vulnerability to a coworker today on the commute and he instantly described in accurate detail how it probably works. Not that this was a particularly difficult case, but I think the principle holds.
bensherman 12y ago
The market concept is nice for the reasons you listed, but doesn't it add an incentive to introduce obfuscated exploits into code then sell an exploit to them later?
sliverstorm 12y ago
An open market increases the price of vulnerabilities What's your logic behind this? I believe this to be false. To my knowledge the black market commands artificially high prices on illicit goods as a rule, except when the good is available on the open market. See: 1) The goods are stolen and need to be unloaded quickly. 2) Open market prices are artificially high thanks to things like taxes (example: alcohol, cigarettes)

by kauffj 12y ago

melville_X 12y ago

I mostly disagree with arguments to rationalize the sale of exploits, they create a massive power balance towards bad actors, but we have to be honest with ourselves, and like drugs, 0days are not going away. Our only proper response is secure software development practices, employment of security reseachers, and adoption of security-centric practices in critical systems... such as the Linux kernel. Which is embarassingly not the case at the moment. For ex: http://unix.stackexchange.com/questions/59020/why-are-the-grsecurity-patches-not-included-in-the-vanilla-kernel http://unix.stackexchange.com/questions/59020/why-are-the-gr...

hawkice 12y ago

I upvoted, not because I agree, but because I believe the people downvoting you are downvoting because they disagree and not because your comment shouldn't be heard. Imagine he had said: I believe a free and open market for weapons would be a good thing, because it would reduce the number of defenseless people, would result in a power imbalance that puts generally-okay actors at an advantage (say what you will, but the mob doesn't have 1% of the resources the US government does), and would therefore reduce crime. I do not personally find that argument compelling (and it is of identical structure to the above), but me disagreeing with it does not mean it isn't of sufficient quality for Hacker News.

kauffj 12y ago
Thanks. I was disappointed to see downvotes rather than engagement in the argument. You prompt a fascinating hypothetical: suppose all the world's atomic weapons were put up in a free, transparent auction? (i.e. bidders and bids are disclosed) I'd argue that most would end up in the hands of good actors (e.g. the world bands behind the Dalai Lama to buy and destroy them all), but who knows? Good debate topic for happy hour, though.
- justizin 12y ago
  Unfortunately, the size of the world's nuclear arsenal being what it is, it doesn't much matter if "most" of the nuclear weapons end up in the hands of good actors.
  - mentat 12y ago
    I think this is also the case for vulnerabilities as well unfortunately.
    - justizin 12y ago
      That was my point.
drewblaisdell 12y ago
> I do not personally find that argument compelling (and it is of identical structure to the above) Replacing "vulnerabilities" with "firearms" while retaining the same argument structure does not mean that both arguments are logically identical (a false equivalency). The implications of a free market for information security and a free market for firearms are totally different.
- readymade 12y ago
  Analogies rarely, if ever, imply a total equivalence between the things being compared. That's what makes them analogies, not formal deductive proofs.

vtlynch 12y ago

On your second point.... Governments should be assumed to be bad actors and they certainly have some of the deepest pockets. If an open market increases the price, it would seem to make it a better market for bad actors. Especially if we think of small software companies or open-source projects (like OpenSSL) who cant afford to pay hundreds of thousands of dollars to secure their own exploit. On your overall point... I think this issue of selling 0days is more a debate of ethics, and I don't think economics can solve a problem of ethics.

GeneralMayhem 12y ago

>An open market increases the price of vulnerabilities That's impossible to tell. You could just as easily say that the price will crash when you take away all the costs and risk of running a black market and give buyers a place to compare multiple "products." The demand side could just as easily be inelastic (or at least saturated) as the supply. > the good actors should always win the bid This works if you're talking about Microsoft, but not if you're talking about smaller companies or open source products. Maybe a Google or a Facebook would step up and pay off the market for things that they use, but "the rich people will take care of us" is not a setup that I'm comfortable with.

x0x0 12y ago
But you aren't choosing between a perfect world, where bugs get reported only to the vendors and the vendors promptly fix them, and an open market. Right now, governments and shady corporations are already buying. If it costs some company $250k or $1M to buy their vulnerability, maybe they'll work harder in the future. Or hire their own pen testers. And they'll have the money, because almost by definition attractive vulnerabilities are those in widely used software. In the complaints about auctioning off vulnerabilities it's hard to avoid hearing companies bitching that they may have to pay security researchers, and it will be harder to intimidate them with law enforcement.

kyberias 12y ago

I don't agree with you (on all points) but none the less applaud your ideas and the way you formulate your arguments.

tzs 12y ago

> This is fairly axiomatic. An open market increases the price of vulnerabilities which in turn increases the number of vulnerabilities found (unless you want to argue the ability to find vulnerabilities is inelastic for some reason) Wait a second...won't increasing the number of vulnerabilities found push prices down? If I'm looking to penetrate a system I only need to buy one vulnerability, so in effect different vulnerabilities are somewhat fungible and so should compete on price. Hence, if more vulnerabilities are being found and coming to market, prices should be going down. On the other hand, with a free and open market for vulnerabilities there would likely be people who would NOT have bought vulnerabilities on the black market buying vulnerabilities on the safer, easier to use free and open market, so demand could go up, raising prices.

stormbrew 12y ago

I'm not sure you can, in practice, have a completely free and open market for vulnerabilities, since any information about the vulnerability released broadly is likely to shorten the path to others discovering the same vulnerability [1], devaluing it implicitly through partial disclosure. So there's an interest in the market being small and secret. For the seller to keep the price high and for the buyer to maintain exclusivity on the exploit. [1] As a case in point, I showed the headline of the email for the bash vulnerability to a coworker today on the commute and he instantly described in accurate detail how it probably works. Not that this was a particularly difficult case, but I think the principle holds.

bensherman 12y ago

The market concept is nice for the reasons you listed, but doesn't it add an incentive to introduce obfuscated exploits into code then sell an exploit to them later?

sliverstorm 12y ago

An open market increases the price of vulnerabilities What's your logic behind this? I believe this to be false. To my knowledge the black market commands artificially high prices on illicit goods as a rule, except when the good is available on the open market. See: 1) The goods are stolen and need to be unloaded quickly. 2) Open market prices are artificially high thanks to things like taxes (example: alcohol, cigarettes)