3 ms·

>An open market increases the price of vulnerabilities That's impossible to tell. You could just as easily say that the price will crash when you take away all

>An open market increases the price of vulnerabilities That's impossible to tell. You could just as easily say that the price will crash when you take away all the costs and risk of running a black market and give buyers a place to compare multiple "products." The demand side could just as easily be inelastic (or at least saturated) as the supply. > the good actors should always win the bid This works if you're talking about Microsoft, but not if you're talking about smaller companies or open source products. Maybe a Google or a Facebook would step up and pay off the market for things that they use, but "the rich people will take care of us" is not a setup that I'm comfortable with.

x0x0 12y ago
But you aren't choosing between a perfect world, where bugs get reported only to the vendors and the vendors promptly fix them, and an open market. Right now, governments and shady corporations are already buying. If it costs some company $250k or $1M to buy their vulnerability, maybe they'll work harder in the future. Or hire their own pen testers. And they'll have the money, because almost by definition attractive vulnerabilities are those in widely used software. In the complaints about auctioning off vulnerabilities it's hard to avoid hearing companies bitching that they may have to pay security researchers, and it will be harder to intimidate them with law enforcement.