5 ms·
As someone who has been very closely involved with Infosec and who has followed all the vulnerability market rumors, I have never heard of "pays the companies t
by tdullien 12y ago
As someone who has been very closely involved with Infosec and who has followed all the vulnerability market rumors, I have never heard of "pays the companies to not fix them" before, and I strongly doubt the veracity of that statement.
- cpleppert 12y agoI agree, I think the author is confusing mandatory monetary compensation for FISA/warrants etc with just straight up paying for a company to comply. Companies don't want to be paid especially because the monetary gains aren't worth it and the reputation risks are enormous.
- deleted 12y ago[deleted]
- meowface 12y agoI agree. It is, however, true that there are many cases where intelligence agencies research, develop, and weaponize vulnerabilities in products without informing the pertinent companies. Stuxnet is one of many examples.
- lern_too_spel 12y agoThe author seems to be confusing documented surveillance access points used by various governments for their lawful wiretaps with hidden backdoors inserted solely for the US government, which stretches credulity.