Hacker News Reader

"They can either pay a nominal fee for doing their security work for them, or they can hire some equally talented people and fund this type of research on their own internally."

What makes you think they don't already? You make it sound like Google doesn't give a shit about security. That clearly isn't the case.

View on HN

Google employs several of the best well-known security researchers in the world, and no doubt many more that we haven't heard much about.

That doesn't mean they're going to find everything, though.

At the end of the day, private companies are perfectly within their rights to do offensive research against Google products, to be selective about how they disclose their results, and to tell the public whatever they want about those results. As long as they aren't lying, there's nothing unethical about it.

Reply on news.ycombinator.com