Hacker News Reader

Comment by cedws | Hacker News Reader

Can I ask why you decided to disclose this exploit rather than sell it to a company like Zerodium? Is it a matter of ethics, or is the money not worth it for you?

View on HN

For me it is about the ethics among other things. I do not know to which goverments Zerodium is selling, much like any other zeroday broker. Additionally, I wouldn't be surprised if selling to Zerodium is illegal to begin with.

By taking the KernelCTF approach I get my bounty, I don't get into legal trouble, and I get to contribute to the Linux kernel VR community which means a lot to me

Thank you for having morals and giving this away to the community. Governments already have enough power that they don’t need more. I respect this very much, it’s hard to find people on hacker news who aren’t dyed in the wool capitalists.

There is a diverse mix here and always has been - it's one of the best things about this place.

Rolling up a statement to apply to a whole group of people is defined as stereotyping and not the highest version of critical thought. To state all Capitalists on HN would sell a CVE to the highest bidder is just as ridiculous as saying a Communist/Libertarian/Socialist would.

Thank you, appreciated.

> Zerodium customers are government institutions (mainly from Europe and North America) in need of advanced zero-day exploits and cybersecurity capabilities.

How does this even openly exist in post Stuxnet world? If this is not clear evidence of government working with criminals i don't know what is.

>clear evidence

evidence is not what someone writes on their landing page

Governments only say they don't work with criminals.

Government officials are often criminals themselves.

Or the company is lying. It's not like anyone can check.

You are being downvoted, but as an outside observer I have also always been interested in ethics of security research.

Reply on news.ycombinator.com