4 ms·
An exploit as the fruit of someone's labor is non-trivial, often holding significant monetary value. They (exploit authors) have no obligation to release it to
by wcummings 11y ago
An exploit as the fruit of someone's labor is non-trivial, often holding significant monetary value. They (exploit authors) have no obligation to release it to the vendor at all, let alone for free and "responsibly". Is the unpaid labor scheme you're describing "ethical"?
If vendors want "responsible disclosure", they can simply buy exploits at market value.
- CHY872 11y agoSounds great, but doesn't really work with open source software (unless I have some wires crossed). Who is supposed to pay for an exploit in (say) MariaDb? The value to a sufficiently motivated black-hat organisation is surely far higher than the value to any one user of MariaDb, no matter how big they are.