News for hackers. Stuff that matters.

A comment on The Insecurity Industry. Parent comment

Re:The Insecurity Industry by sat0ri on Tuesday July 27, 2021 @05:59AM (#27970599)
So many CVEs are due to their bug bounty program, hackers are incentivized to sell vulnerabilities to Google rather than exploiting them. CVEs are publicly disclosed after they are fixed, of course.
[ Parent | on HN ]
Re:The Insecurity Industry by cartoonworld on Tuesday July 27, 2021 @07:01AM (#27970975)
The CVEs are due to the bug reporting, the bugs are not.

The point is that memory safety bugs are the gift that keeps on giving.

You can throw as much money into the problem as you want, and the inherent complexity of memory management means you are still gonna ship bugs of all severity.

[ Parent | on HN ]
Re:The Insecurity Industry by staticassertion on Tuesday July 27, 2021 @11:24AM (#27973554)
You could have made that argument a few years ago, before we started to see in-the-wild exploitation of these vulnerabilities.
[ Parent | on HN ]