3 ms·

Why don't you 100% blame the people at fault: Adobe / the original developers. First, they were incompetent enough to not correctly develop their software. Se

by x0x0 11y ago

Why don't you 100% blame the people at fault: Adobe / the original developers. First, they were incompetent enough to not correctly develop their software. Second, non-assholes would have a standing price-match policy for bugs. Adobe should give you 110% of the highest bid you get for any 0-day. They could have fixed these a long time ago if they'd paid the discoverer $45k (or $150k -- times three for exclusivity.) These companies are effectively outsourcing security testing and remediation of their software, then whinging that independent developers don't work for free.

JoshTriplett 11y ago
Bug bounties are sensible, but price-matching seems too easy to game. How can the company know a bid is serious, and not just fake to be matched? "Oh, sure, so-and-so offered $200k for this bug." (For that matter, while reputation is certainly a thing, what stops a security researcher from selling the same 0-day to several different buyers, and then selling it to the company to fix? Do the typical contracts to sell 0-days involve continued payment based on the amount of time the bug remains unfixed?)
- x0x0 11y ago
  I'd care a lot more if Adobe, et al, weren't repeatedly screwing up. A couple million dollar bounties and forcing them to pay to internalize their negative externalities will help create the proper internal focus on shipping secure software. Reputation doesn't show up as a line-item. And if a security dev resells, who cares? The company still got the 0-day and still gets it fixed asap. It's far better than our current situation where these can persist for years.
- BatFastard 11y ago
  How about an escrow contract using a third party and bitcoin? You could call it silk road 3 Its really not that hard to be taken for a ride if you have the resource adobe does.
  - ipsin 11y ago
    If you know a company is legally obligated to pay up to $x, and that they have $x, you can offer to pay $x/1.1 in collusion/partnership with the bug-seller, for a share of the proceeds. You can outlaw the collusion, but setting up this kind of mechanic seems like a bad idea.
- toyg 11y ago
  > what stops a security researcher from selling the same 0-day to several different buyers, and then selling it to the company to fix? People willing to pay 5 or 6-digit sums for a zero-day are likely... not nice. One wouldn't double-cross them willy-nilly. Multiple-sale to multiple third-parties scenarios are likely happening every day, but selling to developers could be considered an act of sabotage against all buyers, so there is no incentive really.
EthanHeilman 11y ago
> Why don't you 100% blame the people at fault: Adobe / the original developers. I agree Adobe is at fault for producing insecure software. Blame is not a limited resource, there is always extra blame to go around. If I am driving recklessly and my brakes fail due to a manufacturing error, both I and the car company are at fault for the accident. One can always, as HT has done, make a bad situation worse but behaving in a reckless and unethical matter. >Adobe should give you 110% of the highest bid you get for any 0-day. This! This so hard.

by x0x0 11y ago

JoshTriplett 11y ago

Bug bounties are sensible, but price-matching seems too easy to game. How can the company know a bid is serious, and not just fake to be matched? "Oh, sure, so-and-so offered $200k for this bug." (For that matter, while reputation is certainly a thing, what stops a security researcher from selling the same 0-day to several different buyers, and then selling it to the company to fix? Do the typical contracts to sell 0-days involve continued payment based on the amount of time the bug remains unfixed?)

x0x0 11y ago
I'd care a lot more if Adobe, et al, weren't repeatedly screwing up. A couple million dollar bounties and forcing them to pay to internalize their negative externalities will help create the proper internal focus on shipping secure software. Reputation doesn't show up as a line-item. And if a security dev resells, who cares? The company still got the 0-day and still gets it fixed asap. It's far better than our current situation where these can persist for years.
BatFastard 11y ago
How about an escrow contract using a third party and bitcoin? You could call it silk road 3 Its really not that hard to be taken for a ride if you have the resource adobe does.
- ipsin 11y ago
  If you know a company is legally obligated to pay up to $x, and that they have $x, you can offer to pay $x/1.1 in collusion/partnership with the bug-seller, for a share of the proceeds. You can outlaw the collusion, but setting up this kind of mechanic seems like a bad idea.
toyg 11y ago
> what stops a security researcher from selling the same 0-day to several different buyers, and then selling it to the company to fix? People willing to pay 5 or 6-digit sums for a zero-day are likely... not nice. One wouldn't double-cross them willy-nilly. Multiple-sale to multiple third-parties scenarios are likely happening every day, but selling to developers could be considered an act of sabotage against all buyers, so there is no incentive really.

EthanHeilman 11y ago

> Why don't you 100% blame the people at fault: Adobe / the original developers. I agree Adobe is at fault for producing insecure software. Blame is not a limited resource, there is always extra blame to go around. If I am driving recklessly and my brakes fail due to a manufacturing error, both I and the car company are at fault for the accident. One can always, as HT has done, make a bad situation worse but behaving in a reckless and unethical matter. >Adobe should give you 110% of the highest bid you get for any 0-day. This! This so hard.