With regard to this, maybe there’s an opportunity for a market maker to step in.
An “Uber for vulnerabilities”.
Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.
An “Uber for vulnerabilities”.
Having said that, I do tend to think “slap a market on it” can often lead to perverse outcome.
The main trouble is that for it to fully work, you need to have the big corps bidding against black hats in this market. I can't see that happening. It'd have big corps dirtying their hands too openly.
The other trouble is that a lot of the damages (or value) of software bugs aren't readily fungible to dollars. For example, to actually profit from the Ashley Madison hack you'd need to blackmail a whole lot of people, which is incredibly time consuming. So software firms would be able to underpay for most exploits: The amount they'd be have to pay is at most what a black hat can profit from the bug, which is necessarily less than the real damages because the black hat has to cost for fungibility.
Is this really a thing? Who are these firms and what is their take?
So basically, their value.
It's not a slice of cake that is exchanging hands. The attacker might only be interested in the cherry on the top but he could also destroy the rest of the cake in the process.
Like somehow being able to have a third party negotiate payout rates for bug bounties.
I have no idea what the might look like.
Sequence looks something like: Security researcher submits exploit to the union. Union verifies it and decides it's worth $x. They inform software firm of the exploit and a deadline for payment. If payment is received before deadline, they get full, private disclosure. If not, then exploit is made public. Union takes a cut.
Security researchers don't really need a market maker. (It's not a real market: Actually converting exploits into money is typically antisocial and illegal.) They need someone to negotiate for them.
"I have remote code execution in your product, pay me XXX or I'll tell everyone".
I don't actually know if it is blackmail, but if it is, hiding behind a union isn't enough to make it not-blackmail.
Yeah. Just look at where we are today. But calling it "perverse outcome" is sugar coating it.
If it wasn't for profit being the king of all (and being the current common sense). Then we would've put more time into making software more secure.
The problem is not profit, it's that these security issues don't really lower it enough. I've seen the profit motive working very well in a couple of companies when the threat of lowering them (in the form of large fines) appeared thanks to the GDPR.