Time = money

Finding exploits = time = money

For commercial applications there is no free lunch. I still have to see some commercial application developer come and give me a free unlimited copy of his product. So please give me a valid reason to pass free information to someone who will profit directly from my effort.

Here is what most "responsible" researchers do:
1 ) Find a vulnerability
2 ) Contact vendor
3 ) vendor patches
4 ) vendor profits
5 ) ??? profit for researcher ??? --> none

Here is how it should be (model 1):
1 ) Find bug
2 ) Contact vendor
3 ) vendor pays
4 ) vendor patches
5 ) everyone profits
6 ) vulnerability report gets disclosed or not, depending on the agreement reached with the vendor.

In case of step #3 of model #1 fails then the procedure should become this way:
1 ) Find vulnerability
2 ) Sell vulnerability information to the best bidder (if vendor did not care about his customers security why should you do?)
3 ) Profit for your time and effort.
4 ) You may contact vendor if you want. I personally would not waste my time doing that if method #1 has failed.

This model works perfectly. After all, if the vendor profits you should also get the money from your effort.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/391/33278#33278