Man, that would be awesome. Companies aren't doing a very good job of policing themselves, if they policed each other customers would win big time.

I dunno, sounds like an ideal anti-competitive tool to kill off potential competitors before they get too big. It'd also encourage behavior similar to patent trolls, let them get big enough to royally screw for big monies.

If we proceed on the assumption that the blackhats will find holes the white hats don't find first, it'd still be a good thing. At the limit of this behavior, the only software producer left would be Daniel J. Bernstein, which would be sort of awkward, but if you want things built secure you want them built secure.

I think that while the transition would be rocky, there would be a lot more work done on languages, libraries, and frameworks that are secure by default, rather than insecure by default, and in the end people would end up a lot better trained.

We get insecure software for a variety of reasons, including lack of incentives to produce secure software (or equivalently lack of penalties for failing), ignorance, lack of sufficient talent or intelligence to deal with the issues of security, and so on. At least taking care of the first one would have some sort of effect. It would probably also drum some people out of software development, at least professionally, but one could fruitfully argue that anyone intellectual incapable of writing secure software would probably be better employed elsewhere anyhow.

I think you're just reacting to the name I chose. Obviously, plenty of companies large and small run labs staffed with people who do nothing but find flaws in other companies code. For, uh, all sorts of reasons.

You're insinuating there are groups inside major companies setup with the express purpose of discovering and releasing exploits against competitive products?

Since plenty of companies do this, I'm sure it would be easy for you to show evidence of a few examples.

It would in fact be easy to do that, but I'm not going to.

You are free to believe I am making things up about vulnerability research, which I've been doing professionally since 1995.

(Note that I didn't assert it; I insinuated it.)

Since the comment to which you're replying uses the word "insinuating" I deduce that originally it said "asserting" but after your comment it was edited by staunch without a note to say so. Yes?

He's just crazy! Nah, I did change it, and I should have noted it, my bad.