, 2006-03-07
There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?
Expand all |
Post comment
Which way will reasearchers go if the bad guys offer more money? Some cases of vendors threating and suing security reasearchers make me think it won't be that difficult to convince researchers into going to the dark side.
Anyway, it is not an issue now of whether people should pay for vulnerabilities/exploits or not. It is already happening, but we should make sure it does not backfire to us (if that is possible at all).
Money should be the means, not the goal. As with other things in life, if money becomes the goal for researchers, we should expect much of this information going to the wrong people.
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/391/33282#33282