News for hackers. Stuff that matters.

A comment on Chrome exploit and sandbox escape demonstrated at CanSecWest, $60k awarded. Parent comment

Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by kibwen on Wednesday March 07, 2012 @04:45PM (#3677412) 

  When it comes to vulnerabilities affecting modern day 
  browsers, there are two main categories: code execution 
  and post-exploitation bypasses (sandbox escapes).
  [...]
  Without one of these, the second type of vulnerability is 
  neutered.
The idea is to encourage researchers to divulge only their more common (and thereby relatively less valuable) code execution exploits, as fixing these exploits alone will (according to ZDI's theory) defuse any threat the sandbox escape exploits pose.
[ Parent | on HN ]
Re:Chrome exploit and sandbox escape demonstrated at CanSecW... by daeken on Wednesday March 07, 2012 @05:04PM (#3677493)
ZDI, though, is insanely biased in this regard. They make their money by selling protection to companies -- fewer bugs, less money for them. Google has a vested interest in making their software more secure, ZDI has a vested interest in keeping their customers coming back for more patches.
[ Parent | on HN ]