Hacker News Reader

Comment by lawnchair_larry | Hacker News Reader

Why not? This is highly specialized research that not even well-paid Google employees were able to do.

This is actually quite common in recent years for bug hunters and exploit developers. I can think of a dozen or so companies that do the same thing. Immunity is another example.

Trying to use a moral argument to get out of compensating someone when you have the resources to do so is shameful. Sorry, but this stuff is worth far more than the (up to) $3133 they are offering.

No More Free Bugs, as they say.

They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally. Fair is fair. There is no reason this isn't worth compensating but something like pagerank optimizations is.

View on HN

Publicly announcing a security vulnerability, claiming that you're sharing it with other clients with the intent of using it for "weaponized ... offensive missions", and then demanding a fee to gain the information to protect against said weaponization, sounds an awful lot like extortion. In the offline world, I don't think you can legally run a business with a strategy of: discover a problem in the security at one of Exxon's plants, publicly announce that you've discovered a vulnerability and will be selling the information to third parties, and then demand $N from Exxon for the details.

I don't see why not. As long as you don't actually break into Exxon and commit I crime.

The real reason your scenario is unlikely is just that Exxon practically owns the government, so they would change the laws or something to fuck you over.

But I mean what if you discovered a security vulnerability at McDonalds or something, a way to pick their locks. Why are you morally obligated to disclose it without compensation?

On which moral principle are you condemning them?

It is possible to be an accessory to a crime. If you plan a bank robbery and give the details to somebody else to perform, you're still guilty. Hell, you're still guilty even if you never perform the crime (conspiracy to commit ...)!

If you send a letter to a bank saying "I have found a breach in the kind of vault you use at your banks, I'm giving the details to some expert robbers but you can't have it unless you pay me $10m", with evidence you've done it, I'm pretty sure you will find yourself waking up at gunpoint at 6am, courtesy of the FBI.

Since unauthorised access of a computer is a crime in many places, I'm sure you can see the relevance, even if the consequences aren't as drastic. One hopes that we have misinterpreted this and that they have performed 'responsible disclosure' by telling Google all the details.

FYI, the industry has rejected the doublespeak term "responsible disclosure". Even Microsoft has issued statements denouncing the term. Most prefer to call that "coordinated disclosure". This accurately communicates the idea, without sneaking in someone's moral judgement.

This is probably why they keep repeating that their customer is the government. You could probably sell Exxon's security vulnerabilities to the government and demand $N dollars from them to show them how to fix the problem. It's advertising the vulnerability with posts like this that seems most questionable (similar to extortion) to me.

Yeah, that's the part that seemed odd to me as well, though someone knowledgeable in this area of law (at least in the better-settled offline case) could give some better info.

I believe it'd be okay, and probably actually happens, for a private security consultant to do threat assessments for a (non-criminal) client, e.g. prepare a report for DHS on the security of U.S. oil installations. But it seems like they'd be crossing a line if they posted a press release trumpeting a major vulnerability they discovered, mentioning by name which company and approximately where the vulnerability was located, but then refused to disclose it to the company in question.

I'm not sure how much it survives, but I believe there was traditionally even a common-law "duty to warn" if you were aware of significant risks to someone's person or property.

Google could easily sue them into oblivion for libel. They would be forced to reveal the exploit during proceedings to prove their innocence.

one is not obliged to prove innocence in a sensible court of law

At least in the US, civil court cases do not have the presumption of innocence, only criminal cases do.

I'd imagine that depends on which government you're talking about. Seems like selling the info to a foreign government could be treading into "espionage" territory.

Which government(s)?

"Why not? This is highly specialized research that not even well-paid Google employees were able to do."

Correction: not even well-paid Google employees did. They may yet be able, and an existence proof may be all the help they need to find and fix it. Don't give up hope yet.

I can fix it right now. Delete the flash player - problem solved. Chrome still works.

There's absolutely no evidence that this has anything to do with Flash. In fact, even if it was via Flash, there would still have to be another vulnerability to escape the Chrome sandbox, which could very likely be exploited via other means.

I don't see how Flash can be the culprit or solution considering it is sandboxed. Chrome must contain a massive exploit.

I thought the point was that they broke the sandboxing.

Sadly, one aspect of security is psychological acceptability. If nobody will do the secure thing, it's not secure.

"They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally."

What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.

Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about.

That doesn't mean they're going to find everything, though.

At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.

I doubt Google will hire them. They seem to be a very unprofessional company, even with their skilled people. They may pay to know about this security breach, though.

Reply on news.ycombinator.com