Re:What Happens When You Send a Zero-Day to a Bank?
by 3pt14159 on Saturday April 22, 2017 @01:17PM
(#14173527)
He didn't "bring the vulnerability to the attention of AT&T" he fucking told Gawker first. Furthermore, he's part of a number of black hat hacker groups, including an anti-semitic one despite the fact that he's Jewish.
There are examples of honest people getting fucked over, but this isn't one of them.
Re:What Happens When You Send a Zero-Day to a Bank?
by evilDagmar on Monday April 24, 2017 @10:01AM
(#14184353)
Honestly, that guy went to jail for being an asshole more than anything else. If at any point he had attempted to curry favor or at least neutrality, the outcome likely would have been far different.
As it stands, literally everyone who would have been in a position to be reasonable was someone he'd actively worked at pissing off. Not in the sense of someone he'd pissed off in the past, but as someone he was actively pissing off in conjunction with this issue. The moral of his story is that there's room for aggressive incident reporting, but not if one is going to be an insufferable jerk about it.
Re:What Happens When You Send a Zero-Day to a Bank?
by spectrum1234 on Saturday April 22, 2017 @01:42AM
(#14171257)
This is brilliant. And if companies are going to be so resistant this is the obvious solution.
Re:What Happens When You Send a Zero-Day to a Bank?
by netsharc on Saturday April 22, 2017 @05:46AM
(#14171780)
Ha, true. And the hedge fund should make its trades public. "Sir, the vulnerabilties hedge fund just bought options on our stock.". "Fuck, which of our software is it?"
He went on CNBC to argue that independent security researchers should start a hedge fund that short sells the stocks of companies affected by vulnerabilities. https://youtu.be/jxUWRRDdhVI
He seems to be of the opinion that this would be a less risky strategy than bringing those issues to the attention of many companies. He also believes that profit incentives for researchers will serve the public interest, because it creates economic disincentives against big companies having insecure software.