Hacker News Reader

Comment by pcl | Hacker News Reader

This is a scary precedent.

From the bits I've seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group.

Just skipping it altogether because "we paid a contractor" completely subverts the process. What's stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?

View on HN

It's bad enough that the VEP was bypassed, but the high-profile, 7-figure payout for the security researchers who had their hands on the bug is a problem too. Plenty of bug bounty programs have remote code execution at $10k, but the FBI paid _100 times_ that. That's an amount of money that some bug hunters might find very challenging to turn down. And this is "above board", with no shady bitcoin payments from dingy IRC channels.

Even with it 100 times more, its still cheaper than the legal fees they were facing.

I think you miss the point.

Those are my tax dollars at work.

The payout wasn't particularly big, bug bounty rewards are just a bit of a joke.

You assume they were "security researchers" and not, say, a black-hat syndicate based out of Anonymouskaya Oblast.

Well, what I read this as is "the FBI supports organised crime".

I mean, they've paid black hats for an exploit, and are now protecting their identities.

What if the FBI colluded with a mobster - oh, Bulger. Yeah, nothing new here, just the same old crooks being the same old crooks.

Why do you think SAIC has so many government contracts?

Part of it is that the government can have SAIC or their subcontractors do the shady things that the government might actually get taken to task for.

Makes you wonder who is really "Public Enemy No. 1" now.

Public: enemy no. 1

How are they supposed to submit a vulnerability they don't know about? I'm willing to bet they chose to remain willfully ignorant of the details. Are you saying they should not be allowed to outsource the work but instead must obtain the full exploit or nothing?

The real scary precedent is that they paid that much without obtaining the vulnerability exclusively and the technical aspect behind it. Or maybe it's not a scary precedent (except in tax monies) that they outsourced the vulnerability without obtaining the know-how to reuse it on a whim.

Either way you look at it, it is opaque, regardless of whether it goes through the VEP (and the ERB within) or they use a secret company. Were one way more transparent than the other then we should definitely favor that approach.

Reply on news.ycombinator.com