Is The Market For Security Vulnerabilities A Good Thing?
It used to be that security researchers would often reveal security vulnerabilities as a way to build their name and get some attention. However, with so many cases of that backfiring and having the messenger blamed, it appears that the growing trend is for those who find vulnerabilities to simply sell them for thousands of dollars — with the U.S. government being a prominent purchaser. Researchers can also sell the vulnerabilities to security companies or (of course) questionable black market contacts — though, most ethical security researchers want to make sure whoever they sell the vulnerability to is going to inform the company that makes the software. Of course, the whole concept of “selling vulnerabilities” seems vaguely extortionist, as the implicit threat is that if the government doesn’t buy it, the researcher always could sell it to those with less than noble intentions. At the same time, though, it is odd to hear security researchers complain that it’s tough to sell to the
