Hacker News Reader

Comment by contravariant | Hacker News Reader

I don't think it's entirely fair to say there is no competition in this market. In the end companies are still competing for a limited supply of ethical hackers. Except that it is a bit of an unusual market, since both sides are operating with very limited information.

Perhaps it will become more stable when people realise you can sell negative results as well (either implicitly by cooperating, or through an actual market). Anything that can bridge the gap between hackers wanting to get paid for their efforts and companies wanting to pay for results would help.

More volume would also help, in the end it's hard to sustain a whole industry on just tens or hundreds of millions per year.

View on HN

> I don't think it's entirely fair to say there is no competition in this market

Good thing I never said that. The market is inefficient. I like that idea of monetizing negative results. More transaction volume generally helps, I think external market signals and their actual value are whats really missing.

Like, how much would someone pay for an exploit should dictate how much a company should pay for letting a crowd try to fix it where only one person/group gets the payment. If there was a way for additional participants to get paid for bothering to look at all that would be helpful too, and different people can focus on how people try to game that instead of worrying about the idea of people gaming it.

Aren't negative results already monetized, through standard pen-testing servcies? The usefulness of a negative result is dependent on the thoroughness and skill of attacker, while a positive result is useful no matter who submits it.

An unknown person finding a vulnerability has clear value, but a negative result from an unknown person doesn't mean much.

A negative result has value as long as it's clear what vulnerabilities have been tested. Of course it's pointless if you don't trust the person testing it, but that's always going to be a problem. I guess you might need to have reproducibility to make it truly useful.

That seems to me to be mostly limited to automated tools, or checklist level evaluation?

The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.

Then comes risk management and I would tell you "good bugs that require creativity and deep system knowledge to find" are not dangerous.

It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".

It's not. Running scanners and report scan results won't get you paid so it's a complete waste of time.

Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.

Reply on news.ycombinator.com