Hacker News Reader

Comment by tuxxy | Hacker News Reader

How would this work for a private individual? Would this help create a precedent for private security researchers where they might be held liable for not disclosing 0days?

I agree that this would definitely curb potential damage, but I'm not sure if this is exactly the right way to go about it. NSA is first and foremost an intelligence agency. What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"?

View on HN

>>What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"?

I think the best policy is for them to not maintain an "effective arsenal" at all, the second they find a vulnerability they should report it.

There isn't one. Report the vulnerabilities to the vendor and move on. The trade off is too dangerous. Do you stockpile munitions that can damage global infrastructure so you can target a small number of individuals? No that's just stupid and irresponsible.

Is there any legitimate reason to hold 0 days without disclosing them to the vendor? There probably are reasons I haven't thought of, but do they apply to as active a company as Microsoft?

Edit: I think I misread this and you're asking in the context of the NSA holding them. I still doubt there's a way to do it responsibly, so they probably shouldn't be doing it.

Sure there is a legitimate reason to withhold them, though many would say it's not a very ethical one: money. Private researchers hold them for sale to the NSA and other agencies all the time. Here are a few exchanges (there are also high end "agents" - akin to Hollywood agents - that broker these deals):

[1] https://zerodium.com/

[2] https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...

And some info on this market: https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

Every possible job doesn't need to exist. We shouldn't put the whole online world at risk so a handful of people can make a buck.

I would say there is a difference between having a bare-bones proof of concept and a fully developed malware.

Reply on news.ycombinator.com