upvote

points

by tptacek5 hours ago |
comments
upvoteby rileymat238 minutes ago|
next
[-]
I was under the impression that the three letter agencies and contractors bought vulnerabilities?
reply
upvoteby nixon_why693 hours ago|
prev|
next
[-]
That's really informative but maybe a little overly capitalist-brained.

We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.

reply
upvoteby JoshTriplett2 hours ago|
parent|
[-]
> We shouldn't look to the black market as cost discovery for these vulnerabilities

We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.

reply
upvoteby nixon_why691 hours ago|
parent|
[-]
That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google.

A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".

reply
upvoteby xprnio15 minutes ago|
parent|
[-]
The value to Google - sure. But the market value of the exploit itself - the black market I think is a factor in that regardless of what Google offers.

The value of something is dictated by what _the market_ offers, and just because Google throws a lowball price because _they_ don't value it doesn't necessarily mean that the value of the exploit itself is as low as they dictate.

There will always be someone who would screw Google just for the love of the game, and if they got a better price from elsewhere, I don't see why _morality_ would really play that big of a role. It all comes down to incentives, and if Google doesn't incentivize doing the good thing enough, then someone _will_ incentivize them to do the bad thing just a bit more.

reply
upvoteby 0xbadcafebee3 hours ago|
prev|
next
[-]
How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
reply
upvoteby tantalor3 hours ago|
parent|
next
[-]
The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
reply
upvoteby toomuchtodo1 hours ago|
parent|
[-]
There is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.
reply
upvoteby randyrand3 hours ago|
parent|
prev|
[-]
That’s not how things are valued. That’s moreso how the absence of something is valued.
reply
upvoteby wat100001 hours ago|
parent|
[-]
Go without air for a few minutes and you’ll die, and yet they give the stuff away for free.
reply
upvoteby fr20292 hours ago|
prev|
[-]
[flagged]
reply
upvoteby doubletwoyou1 hours ago|
parent|
next
[-]
Mate, it’s a style thing that depends on which style guide you’re following

AP recommends spaces around them, whereas Chicago doesn’t

besides if we’re critiquing incorrect following of English orthography

—Sentences should be capitalized

—The word “don’t” requires an apostrophe

—End sentences with a period

—That’s incorrect usage of an em-dash at the end there — but what does it matter anyways ;)

reply
upvoteby itsTyrion2 hours ago|
parent|
prev|
next
[-]
Books I've read would disagree. Are you the emdash police?
reply
upvoteby altmanaltman2 hours ago|
parent|
[-]
Books you have read have told you to use spaces after emdash? Mostly in writing we do not use spaces even though there is no fixed rule as such. https://www.merriam-webster.com/grammar/em-dash-en-dash-how-...

And yes you cannot care about grammar that is fine but calling someone a personal insult because they pointed out something impersonal in your comment is not ideal also and is unusually catty.

reply
upvoteby ukuina1 hours ago|
parent|
[-]
> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.
reply
upvoteby altmanaltman2 hours ago|
parent|
prev|
[-]
they put spaces there so their AI generated text looks a bit more human, when in reality humans rarely use em dashes for casual comments or text. The only use for it prior to AI cuntwriting was in high brow literature, philosophy and wannabe high brow internet writing. But ai thinks that just how we talk
reply
upvoteby idiotsecant1 hours ago|
parent|
[-]
Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too.

I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.

reply
upvoteby Heythatsfunny1 hours ago|
parent|
[-]
> the emdash has become the little hitler moustache of punctuation

Legendary.

Miss that shit too.

Ez way to shit on Windows users who had to double up endashes like they were impoverished.

I guess in your analogy the double endash is Stalin’s mustache and the Soviet Union in general - Gaudy, excessive, starving for more

reply