Hacker News Reader

Comment by consumer451 | Hacker News Reader

I am far from the halls of corporate decision making, but I really don't understand why bug bounties at trillion dollar companies are so low.

View on HN

Because it's nice to get $10k legally + public credit than it is to get $100k while risking arrest + prison time, getting scammed, or selling your exploit to someone that uses it to ransom a children's hospital?

Is it in fact illegal to sell a zero day exploit of an open source application or library to whoever I want?

Depends. Within the US, there are data export laws that could make the "whoever" part illegal. There are also conspiracy to commit a crime laws that could imply liability. There are also laws that could make performing/demonstrating certain exploits illegal, even if divulging it isn't. That could result in some legal gray area. IANAL but have worked in this domain. Obviously different jurisdictions may handle such issues differently from one another.

Thanks, great answer. I was just thinking from a simple market value POV.

What about $500K selling it to governments?

Issue 1: Governments which your own gov't likes, or ones which it doesn't? The latter has downsides similar to a black market sale.

Issue 2: Selling to governments generally means selling to a Creepy-Spooky Agency. Sadly, creeps & spooks can "get ideas" about their $500k also buying them rights to your future work.

Reply on news.ycombinator.com