News for hackers. Stuff that matters.

A comment on Microsoft Announces Direct Cash Payments For Vulnerabilities. Parent comment

Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by tptacek on Wednesday June 19, 2013 @02:14PM (#5907203)
If you want to release your vulnerabilities publicly, Microsoft isn't stopping you.
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by dvmmh on Wednesday June 19, 2013 @02:57PM (#5907471)
By taking the cash, I am sure you are bound by secrecy enforced by jail time. I see these increased payments as hush money to keep researchers quiet while they feed them to the NSA for zero day exploits.
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by sliverstorm on Wednesday June 19, 2013 @03:48PM (#5907743)
Why would Microsoft sell the NSA exploits some black hat came up with against their own operating system? They can just install a backdoor.
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by davorak on Wednesday June 19, 2013 @04:33PM (#5908000)
They do not have to pay a programmer to put in a back door who may one day talk about it. Fewer people need to know about the program in general.

By default a naturally occurring exploit probably upon inspection looks less intentional then one put there on purpose.

[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by danielweber on Wednesday June 19, 2013 @04:34PM (#5908008)
Fewer people need to know about the program in general

. . . except for the outsider who mailed them about it and got paid a chunk of money as a result.

[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by sliverstorm on Wednesday June 19, 2013 @04:48PM (#5908108)
Not to mention, the outsider is a complete unknown. Are they an upstanding white hat? Or are they the darkest of greys? You have no idea.

At least an internal employee is on your payroll, and has been screened with a background check. You don't get to screen which people get to discover vulnerabilities.

[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by davorak on Thursday June 20, 2013 @12:47AM (#5910218)
This person would just be reporting a exploit and and getting paid for it.

They would not know about the program which takes that exploit and then gives it to the NSA.

[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by sliverstorm on Thursday June 20, 2013 @03:21AM (#5910688)
And why would a programmer know it was for the NSA? Just tell your underling, "We need a backdoor for <Plausible reason>"
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by lawnchair_larry on Wednesday June 19, 2013 @03:22PM (#5907619)
You're either a bad troll or you would make a bad co-conspirator. Just commit a security bug to your own product and save the 100k, duh.
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by tptacek on Wednesday June 19, 2013 @03:01PM (#5907501)
Microsoft can't jail anybody.
[ Parent | on HN ]
Re:Microsoft Announces Direct Cash Payments For Vulnerabilities by ConceptJunkie on Wednesday June 19, 2013 @05:52PM (#5908597)
Jail time? I don't think so, but I could see MS making you sign an NDA to get the money. There may be other criteria they use in order to pay out.

Nevertheless, I don't see how this is a bad thing.

[ Parent | on HN ]