Hacker News Reader

Finding vulns in popular OSS and disclosing is probably good for your reputation as a security researcher, even if it's not immediately profitable.

How is that sustainable?

Are security researchers going to be doing free labor for you indefinitely for exposure?

They sell their products using the credentials they gained.

I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.

What happens after a couple of players have obtained marketshare and the market has consolidated?

I think there are diminishing returns to be had.

This is essentially Snyk's business model. Sure, they do upsells, but it seems fully sustainable to me.