He makes a point, though: bug bounties exist to incentivize people to find and report bugs to a company. We talk about white, gray, and black hats, roughly based on their level of ethics. For black hats – and some gray hats – money is one of the big reasons they look for vulnerabilities.
replyyou understand the concept of zero days ?
replycompanies should be better and if not, criminally liable for their bad code.
Ok? I agree with everything. What does that have to do with reporting exploits that don't have bounties?
replyI don't think you thought this through.
replydoes this also apply to individual developers?
should Linux Torvalds or the ffmpeg developers go to jail if they merge a RCE zero-day into the Linux kernel or into ffmpeg?
gross negligence / honest mistake
replyif you cannot differentiate the 2, :insert rude thing here:
ok, so you agree that if Linus merges code due to gross negligence, for example he was warned in an email that it contains a RCE and he laughs it off, and still merges it, he should go to jail
replyglad you are consistent in your beliefs
In other words, bootlicking the corpo-authoritarians?
replyYou're actually helping the people that use the software from getting pwned, companies are secondary beneficiaries.
reply