Having given up on the original argument ("Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.") you've now transitioned to a new one: that vulnerabilities can be used by the hackers who find them to plan heists. And that is true. It doesn't set any kind of market-clearing price, and selects for actors who are comfortable ending up in prison, but it is indeed a statement that aligns with reality.
replyMy original comment explicitly said “selling or exploiting them for profits.” You are just ignoring the second half for some reason.
replyI think you need to breathe a bit and then re-read my comment. I’m not coming at you, I’m saying that what an exploit sells for and what it could cost a company if exploited are entirely different things. That’s where you’re hung up.
Companies have an obvious financial incentive to encourage discovery and disclosure before exploitation.
I just don't care at this point. We're talking past each other. I quoted the argument that I was responding to, in the comment you just replied to.
replyYou think that most security researchers that can find an exploit are all willing to commit a heist with that exploit?
replyI’m not in the security industry but that strains credulity.
Where did I say that? Being capable of exploiting something and willing to are two different things.
replyThe point is that bounties create an incentive to find and disclose vulns. That doesn’t require a black market for the exploits.
“Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.”
replyI’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it.
What you’re responding to and what you’re saying it says are two different things.
replySounds good. Thanks.
reply