Not that I'd ever find something like Spectre but I would not want to sell it to people who use it to kill people. On the other hand, I'd like to get something for my work.

Also, I think the temptation to go black hat is a lot lower than if the choices were "nothing" vs "millions"

Well you can look at similar programs from Apple etc. and see how many takers they had. So while it's nice to imagine what "I" would do in such a situation it looks like people who actually can do this on average take the high $ payout route. It has nothing to do with black hat btw. There are gov. agencies that will pay for this stuff.

And the same gov. agencies will then use it against people who report on the next Snowden leaks. It has everything to do with black hat.

Off-topic, but Snowden is seen as controlled opposition in a good amount of infosec circles -- the one's that aren't plugged into the infosec clique machine atleast. Not to defend the government, but Snowden was hyped up when in return his leaks brought us nowhere new, but giving the laymen new words to throw around.

Yeah, clean money has some extra value.

How do you define “clean money”? Do you call government agency money “unclean”? I could easily see someone making that statement with justification, but your post is a bit vague so wanted to ask.

Money that you don't have to hide the origin of, or worry about legal consequences.

A check for helping out Microsoft is gonna be pretty clean.

Money you bring in from selling exploits might be something you don't want tracked back to its origin...

How likely is the less clean money going to get you in trouble I don't know, but the check from Microsoft surely will not.

Thanks for the explanation!

> Yeah, clean money has some extra value.

So in the context of your original post, with your provided definition now of clean money, can you clarify how the alternatives (selling to law enforcement / government, which is the most common alternative) would be “unclean”?

I was thinking alliterative being selling to say ... less legal minded folks, random dude on the internet. I don't know how likely it is you'll get in trouble, but if you do it might be an issue.

As for selling to another gov or law enforcement, how clean that money is will be relative to what your government thinks of your role. If you sell to say an unfriendly neighbor government, they're going to look at those proceeds a bit differently than say if you sold to THEM.

Clean for me is your likely local legal issues with the money, and/or your actions.

In the end though provided Microsoft isn't considered a terrible enemy by your local government, that probabbly is the cleanest way to sell, and IMO probabbly the safest morally IMO (granted morally and clean money might not always go hand in hand).

Clean = Money you don't have to hide for the tax office.

I think Microsoft is trying to fill in a meaningful, yet tentative part of the pie. It wouldn't be right for them to put forward the full cost of every cloud company's potential losses.

At the same time it raises the stakes by begging the question for other cloud providers to fill in by asking "why isn't this higher?" So in that light, the number they've chosen may have served its purpose quite well, by encouraging others to think about what another massive 0-day CPU security flaw might cost them.

Apple already had a bounty in the same ball park pretty much 0 takers.

Is it legal to sell exploits?

In the general case, yes, but there are specific cases --- and they are probably more common than you'd be comfortable with --- in which the answer is probably "no". It's legally very dangerous to sell a vulnerability to someone who is going to use it to break the law.

Sure there are gov. agencies that will buy them

Where do I go to sell?