Re:Ask HN: What is the best way to get paid for discovering ...
by dsacco on Friday July 24, 2015 @01:08AM
(#9940199)
I think this requires more context - where are they selling the vulnerabilities? If they are selling them to a third party like the ZDI, then no, of course it doesn't affect their standing in the legitimate securiry industry.
However, if you sell a vulnerability to a group that will explicitly use it for malicious purposes and this becomes very well known, you'll obviously become a polarizing figure and many doors will close on you. Not all, of course. Just a lot of high value ones.
This is not to make a moral judgment - it's just a reality that a lot of organizations won't want to be associated with you if you're labeled as a blackhat. Of course, if you do that you'll find plenty of other high value doors suddenly open up.
However, if you sell a vulnerability to a group that will explicitly use it for malicious purposes and this becomes very well known, you'll obviously become a polarizing figure and many doors will close on you. Not all, of course. Just a lot of high value ones.
This is not to make a moral judgment - it's just a reality that a lot of organizations won't want to be associated with you if you're labeled as a blackhat. Of course, if you do that you'll find plenty of other high value doors suddenly open up.