Hacker News Reader

Comment by jasonladuke0311 | Hacker News Reader

Just curious - do you have an ethical stance against selling to ZDI/Zerodium?

ZDI, like Apple, doesn't tell you the average price of the vulnerabilities you can sell to them when you email them (yes, Apple has example payout ranges, but they aren't clear on classification). At Pwn2Own, ZDI paid roughly half of what Apple should pay. When you consider Apple themselves are 1/4th the market price, thereby making ZDI 1/8th, it becomes impossible to work to them. I raised my concerns with ZDI, no reply.

I submitted some details (nothing technical, just the classification and affected platforms) of my vulnerability to Zerodium. Two days later someone tried to hack into all of my personal accounts and failed due to 2FA, and not many people have the email I used when I communicated with them. I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).

This isn't a judgment, by the way. I'm naive about this area and genuinely curious.

I've found other buyers outside the US, but I had ethical concerns and decided against them (at a 300K min loss).

What type of buyers exist who are unable to fix the vulnerability (in this case, who are not Apple or the affected vendor or do not collaborate with Apple, etc.) but might be considered ethical to sell to?

Come on, we both know the score here.. There is no ethical purchaser.

That was my assumption, but my netsec knowledge could be written on a stamp, so who knows! ;-)

I imagine some people think being rewarded for finding vulnerabilities is unethical entirely, but there seems to be a huge dose of pragmatism around the space.

Answered here: https://news.ycombinator.com/item?id=27875883

Thanks - that was helpful.

In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor.

Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.

OP edited their post to answer your question

Reply on news.ycombinator.com