Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is not a below-market rate.


I noticed that throughout this thread you have been making this assertion. Could you share any data or citations to support this?

Would you feel any differently about the value of this bug if it affected, e.g. Google or Facebook?


No, I would not feel differently about it. The same dynamic would apply.

People on HN seem generally to believe that for any malicious activity you could do with a bug, there's a bidding group of willing buyers somewhere on some darknet site. That's not the case. Random bugs like this may get passed around, but the bugs that command a price all fit a couple specific molds: they're things you can drop into someone's existing operational process.

A Firefox drive-by RCE has some value: many organizations are set up to actively exploit Firefox browsers. So does an iOS jailbreak: lots of people stockpile iOS jailbreaks, for malware implants and for other purposes.

An important common thread among the bugs with liquid markets is that they have a meaningful half-life: once they're burned, it still takes time to eradicate the vulnerable installations. Serverside bugs are fixed worldwide instantaneously. You can see this dynamic in how grey-market payments are tranched.


This ignores the black market. This exploit would have been extremely valuable to insider trading rings.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: