Hacker News Reader

Quite simply, fixing security vulnerabilities costs a lot more money than being such a raging dick to researchers that no one ever reports.

No reports means no vulnerabilities and thus no expenditure.

View on HN

If a short-term-thinking decision-maker has a KPI for low vulnerabilities, they'd rather take the chance of a massive compromise of the company, than to have vulnerabilities reported and definitely hurt their bonus/promotion?

Classic management think right there.

Yeah because only ethical hackers ever look for vulnerabilities

Reply on news.ycombinator.com