Hacker News new | past | comments | ask | show | jobs | submit login

Where's a professional vulnerability researcher I can read making the same case? My feed is full of researchers saying how great this is, and how big an accomplishment it was that Katie Moussouris and her team managed to pull it off after Microsoft publicly declared itself opposed to bug bounties.

The work required to build reliable exploits against hardened Windows can take months. Why shouldn't researchers be compensated for that work? If you don't want to accept payment for it, that's fine; don't. But why is it bad for other people to do so?




I'm not arguing about compensation, I'm arguing about public safety. People and organizations selling exploits are effectively complicit in the damage resulting from their sales.


These are people selling vulnerability research to the only company in the world that is capable of effectively fixing those vulnerabilities.


That's exactly my point, which is why it's dangerous. If the exploits were made public as soon as possible (full disclosure) then MS will have incentive to release bugfixes as soon as possible to the general public.


If you want to release your vulnerabilities publicly, Microsoft isn't stopping you.


By taking the cash, I am sure you are bound by secrecy enforced by jail time. I see these increased payments as hush money to keep researchers quiet while they feed them to the NSA for zero day exploits.


Why would Microsoft sell the NSA exploits some black hat came up with against their own operating system? They can just install a backdoor.


They do not have to pay a programmer to put in a back door who may one day talk about it. Fewer people need to know about the program in general.

By default a naturally occurring exploit probably upon inspection looks less intentional then one put there on purpose.


Fewer people need to know about the program in general

. . . except for the outsider who mailed them about it and got paid a chunk of money as a result.


Not to mention, the outsider is a complete unknown. Are they an upstanding white hat? Or are they the darkest of greys? You have no idea.

At least an internal employee is on your payroll, and has been screened with a background check. You don't get to screen which people get to discover vulnerabilities.


This person would just be reporting a exploit and and getting paid for it.

They would not know about the program which takes that exploit and then gives it to the NSA.


And why would a programmer know it was for the NSA? Just tell your underling, "We need a backdoor for <Plausible reason>"


You're either a bad troll or you would make a bad co-conspirator. Just commit a security bug to your own product and save the 100k, duh.


Microsoft can't jail anybody.


Jail time? I don't think so, but I could see MS making you sign an NDA to get the money. There may be other criteria they use in order to pay out.

Nevertheless, I don't see how this is a bad thing.


So put your money where your mouth is and build a consortium that will pay researchers to release them publicly.


While that might decrease the total number of days in a year when there are unpatched exploits that MS knows about, it would increase the total number of days in a year when there are exploits known to hackers. I don't think that would make us safer.


What is the damage to public safety if I find a way to exploit Windows and tell Microsoft about it?


Microsoft releases this exploit information to governments as a matter of policy, and the governments accordingly conduct clandestine operations and cyber-attacks using this exploit information.

MS is in the unique position of being the only ones able to fix the exploit so they are a single-point-of-failure, which diminishes the security of everybody using Windows operating systems.


No, Microsoft releases vulnerability information to the government along with private companies in the antivirus and intrusion prevention space. They do this because they have a coordinated patch schedule that creates windows of known vulnerability.

Microsoft does not have the in-house expertise to feed exploits to anyone.


> Microsoft does not have the in-house expertise to feed exploits to anyone.

I agree with you everywhere else in this thread, but you are clearly not up to speed on who works there if you believe that to be accurate. Some of the best exploit writers, who have pioneered new classes of techniques, work at Microsoft (because Microsoft went on a recruiting spree to target them).


I know who works there and believe my statement to be accurate; remember, we're talking about the total volume of all vulnerabilities discovered in Microsoft products.


If you are narrowing the scope of your claim to say that Microsoft doesn't have the expertise to write exploits for every version of every product affected by every vulnerability, ok, sure. That isn't what was suggested though, and isn't something any reasonable person would have implied.

Then again, the notion that Microsoft dedicates resources to serve as an outsourcing shop for NSA hackers to develop "cyber weapons" no longer has "reasonable person" anywhere on the horizon. That's not even worth entertaining, I just had to interject because I thought you were saying MS doesn't have good exploit writers ;)

I do think the MAPP equivalent for governments, probably as an unintended side effect, grants some advantage to parts of the .gov interested in attacking the products. How much, and whether or not they need it, is another story. But I agree that the NSA sure doesn't need their help - it's probably just a bit of free gravy if anything.

And in Microsoft's defense, it really wouldn't matter if they gave them to the NSA or not. The distribution list is very large, and the teams who ultimately receive that content are not vetted in any way.


I'm just questioning that they have enough exploit writers to keep up. I think (holy shit) that you and I mostly agree about this stuff.


If you manage 100,000+ installations of a product, you, too, can get advance warning of what flaws have been reported to the vendor.

(I made that number up.)


You just ruined my hopes of making an annual salary in an evening.

> The work required to build reliable exploits against hardened Windows can take months.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: