Imagine he had said: I believe a free and open market for weapons would be a good thing, because it would reduce the number of defenseless people, would result in a power imbalance that puts generally-okay actors at an advantage (say what you will, but the mob doesn't have 1% of the resources the US government does), and would therefore reduce crime.

I do not personally find that argument compelling (and it is of identical structure to the above), but me disagreeing with it does not mean it isn't of sufficient quality for Hacker News.

Perhaps restricting the analogy to nuclear weapons would make sense. Only nation states (software companies) and terrorists (malicious hackers... and perhaps intelligence agencies) would be interested in purchasing such weapons.

My thought is: if one argument is good and another is bad, clearly the reason for the difference does not exist within the properties they share. It must exist where the arguments are different, or more likely in this case (as what the poster said and what I said are so similar), in the outside world of facts and understanding.

But if the shape of the argument allows for things that may successfully convince you, then clearly that information is not enough to dismiss it outright. It should be the start of a dialog with the parent comment.

Now, for something completely different:

If, for some reason, you want to actually engage _me_ on this particular policy issue, angle your thought at this: my understanding is that it's 2014, and if you want to regulate the information people share or sell over the internet you've accepted a challenge I do not envy.

I would be particularly skeptical you could do this without building a comprehensive computer spying system and perhaps outlawing crypto (it's been tried), as you're trying to read communications of highly security-conscious people.

As for if Mitnick is a good person (or similar things under discussion here), I have not met him.

Replacing "vulnerabilities" with "firearms" while retaining the same argument structure does not mean that both arguments are logically identical (a false equivalency). The implications of a free market for information security and a free market for firearms are totally different.

If you cared a lot about Internet Points, I'm betting keeping a sockpuppet acccount just to post "why was [master]'s post downvoted?" comments would be one of the highest-ROI things you could do to get more of them.

I should also note that I've seen a lot of early-greyed posts come back from the dead after 30 minutes or so even without the "omgwtfisgoingon" posts underneath them as well. Sometimes even becoming clear winners on their strata of the post's comments.

You prompt a fascinating hypothetical: suppose all the world's atomic weapons were put up in a free, transparent auction? (i.e. bidders and bids are disclosed)

I'd argue that most would end up in the hands of good actors (e.g. the world bands behind the Dalai Lama to buy and destroy them all), but who knows? Good debate topic for happy hour, though.

[1] As a case in point, I showed the headline of the email for the bash vulnerability to a coworker today on the commute and he instantly described in accurate detail how it probably works. Not that this was a particularly difficult case, but I think the principle holds.

Wait a second...won't increasing the number of vulnerabilities found push prices down? If I'm looking to penetrate a system I only need to buy one vulnerability, so in effect different vulnerabilities are somewhat fungible and so should compete on price. Hence, if more vulnerabilities are being found and coming to market, prices should be going down.

On the other hand, with a free and open market for vulnerabilities there would likely be people who would NOT have bought vulnerabilities on the black market buying vulnerabilities on the safer, easier to use free and open market, so demand could go up, raising prices.

That's impossible to tell. You could just as easily say that the price will crash when you take away all the costs and risk of running a black market and give buyers a place to compare multiple "products." The demand side could just as easily be inelastic (or at least saturated) as the supply.

> the good actors should always win the bid

This works if you're talking about Microsoft, but not if you're talking about smaller companies or open source products. Maybe a Google or a Facebook would step up and pay off the market for things that they use, but "the rich people will take care of us" is not a setup that I'm comfortable with.

In the complaints about auctioning off vulnerabilities it's hard to avoid hearing companies bitching that they may have to pay security researchers, and it will be harder to intimidate them with law enforcement.

Our only proper response is secure software development practices, employment of security reseachers, and adoption of security-centric practices in critical systems... such as the Linux kernel. Which is embarassingly not the case at the moment. For ex: http://unix.stackexchange.com/questions/59020/why-are-the-gr...

Especially if we think of small software companies or open-source projects (like OpenSSL) who cant afford to pay hundreds of thousands of dollars to secure their own exploit.

On your overall point... I think this issue of selling 0days is more a debate of ethics, and I don't think economics can solve a problem of ethics.

What's your logic behind this? I believe this to be false. To my knowledge the black market commands artificially high prices on illicit goods as a rule, except when the good is available on the open market. See:

1) The goods are stolen and need to be unloaded quickly.

2) Open market prices are artificially high thanks to things like taxes (example: alcohol, cigarettes)