Is The Market For Security Vulnerabilities A Good Thing?

from the government's-open-for-business dept

It used to be that security researchers would often reveal security vulnerabilities as a way to build their name and get some attention. However, with so many cases of that backfiring and having the messenger blamed, it appears that the growing trend is for those who find vulnerabilities to simply sell them for thousands of dollars — with the U.S. government being a prominent purchaser. Researchers can also sell the vulnerabilities to security companies or (of course) questionable black market contacts — though, most ethical security researchers want to make sure whoever they sell the vulnerability to is going to inform the company that makes the software. Of course, the whole concept of “selling vulnerabilities” seems vaguely extortionist, as the implicit threat is that if the government doesn’t buy it, the researcher always could sell it to those with less than noble intentions. At the same time, though, it is odd to hear security researchers complain that it’s tough to sell to the government because it’s not easy to find the right contacts — as if the government buyers should more readily advertise themselves.

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Is The Market For Security Vulnerabilities A Good Thing?”

Subscribe: RSS Leave a comment
Anonymous Coward says:

The real problem with this is only: what used to be a noble, academic pursuit is not sullied with the taint of money and lower motives. OK Fine, if thats how its going to be (as it inevitably must) then let us deal with it appropriately–clear and unambiguous bug bounties. Without that degree of certainty, those who feel as if theyre entitled to a bounty will get it, one way or another–thus the extortion.

That will hold us for a while until the value of these exploits gets bid way up. Heres to hoping the supply of bugs can continue to expand and keep prices low.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...