News for hackers. Stuff that matters.
Re:$36k Google App Engine RCE by diminoten on Monday May 21, 2018 @08:53PM (#17123037)
Just to trigger the proverbial trap because I'm curious, what's wrong with, "darknet Craigslist, paid in some crypto coin"?
Re:$36k Google App Engine RCE by ufmace on Tuesday May 22, 2018 @12:12AM (#17123673)
I think there's a trust problem with that. How do you arrange the transaction? If I offer to sell you a zero-day for X BTC or something, how do you know that my zero-day is real and exploitable, and that I will actually give it to you and nobody else? How do I know you will actually send me the BTC? How do I demo it in a way that at least proves that it works without giving away enough info to recreate it?

I guess Zerodium has enough reputation that you can be reasonably sure they'll fork over the cash after you show them your bug. Building that kind of reputation on the darknet with cryptocurrency isn't going to be easy. If there was anyone like that out there, we'd already know about them.

Re:$36k Google App Engine RCE by tptacek on Monday May 21, 2018 @09:02PM (#17123069)
Nothing, but to make a complete argument you have to provide a hypothetical buyer, their price, and why they'd pay it.
Re:$36k Google App Engine RCE by wolco on Monday May 21, 2018 @11:39PM (#17123556)
Here is an angle that could work.

Known security person buys this in order to turn it in themselves for a higher bounty and increased rep.

Re:$36k Google App Engine RCE by tptacek on Tuesday May 22, 2018 @12:14AM (#17123675)
The premise is you somehow making more than Google will pay.