News for hackers. Stuff that matters.

A comment on Multiple Vulnerabilities in Pocket. Parent comment

Re:Multiple Vulnerabilities in Pocket by coldpie on Tuesday August 18, 2015 @10:21AM (#10079309)
Maybe they should have a bounty program, but they don't, and they made that clear. They didn't ask anyone to perform "free labor," and I don't think they have any obligation to pay for labor they didn't ask to be performed. I don't see anything unethical in their behavior. Your beef seems more to be with the researcher who decided to perform free labor for this company.

Selling exploits to the black market does strike me as unethical, though.

[ Parent | on HN ]
Re:Multiple Vulnerabilities in Pocket by tptacek on Tuesday August 18, 2015 @09:33PM (#10083252)
The black market does not want serverside Pocket vulnerabilities. These bugs only have value to Pocket.
[ Parent | on HN ]
Re:Multiple Vulnerabilities in Pocket by Ntrails on Tuesday August 18, 2015 @11:54AM (#10079857)
>Selling exploits to the black market does strike me as unethical, though.

If I gave them away and they get exploited is it unethical? If I gave them away publicly vs privately does it make a difference? If I responsibly reported to the manufacturer a month previously?

I guess intent matters, and I'm ok with that being the line. In the end though I feel the rewards for fast production far outweigh the consequences of security bugs. My firefox updated last night and added pocket and I was reminded that I couldn't even remove the useless bloody thing.

[ Parent | on HN ]
Re:Multiple Vulnerabilities in Pocket by coldpie on Tuesday August 18, 2015 @12:07PM (#10079952)
> If I responsibly reported to the manufacturer a month previously?

I'm not an expert on responsible disclosure, and I think reasonable people can disagree on the best course of action. I think selling exploits on the black market is always unethical.

> I couldn't even remove the useless bloody thing.

Right click, "Remove from toolbar".

[ Parent | on HN ]