3 ms·
This is similar to patent trolls, no? Both don't produce anything worthwhile, buy from others and use it to intimidate others (except patent trolls do it themse
by vijayr 12y ago
This is similar to patent trolls, no? Both don't produce anything worthwhile, buy from others and use it to intimidate others (except patent trolls do it themselves in the open, whereas he sells it to people who'll probably use it secretly)
- x1798DE 12y agoIt's also similar to patent trolls in that the people doing it breath oxygen and have skin. In the case of patent trolls, they're leveraging asymmetries in the legal system and flaws in intellectual property laws to profit from non-meritorious lawsuits. To the extent that a market in zero-day vulnerabilities is something you want to have (I'm not sure where I stand on this, exactly), a firm with a reputation to maintain does have a role to play. They sell the exploit to Mitnick, who has an idea of which ones he'll be able to sell, and the companies buying them are able to avoid the transaction costs and risks associated with buying and then testing potential zero-day vulnerabilities submitted by arbitrary hackers and counterparties. He's playing a valuable role by mitigating risk for both the companies he approaches and the random hackers. Consider also that it's hit-or-miss when you try to contact a company about zero-day vulnerabilities whether or not they are going to pay you, ignore you or, worse, sue you. Knowing Mitnick doesn't sue people who submit bugs to him, and presumably he has lawyers vetting this operation carefully, is a significant benefit for bug-finders.