Hacker News Reader

Comment by rasz | Hacker News Reader

3) is how you get the real money. Dropping zero days like its hot works and will lead to a good paying job. Example:

https://nakedsecurity.sophos.com/2019/06/13/microsofts-battl...

wah wah bad person publishing zero days wah wah Irresponsible disclosure hurts everyone. wah wah

reality: https://krebsonsecurity.com/2020/04/microsoft-patch-tuesday-... got hired @Microsoft, started fixing other bugs they didnt know they had

View on HN

It works sometimes.

I'm not sure everyone would have the nerve to aggressively drop zero days, you don't know who you are going to cross, my paranoia would not let me.

I'm also not a security person, but I am sure there are people who have the necessary skills, but have the same nerves as I have.

And then sometimes you get sued.

Source: got sued by Sony for disclosing that they screwed up their ECDSA implementation so badly that you could compute their private keys (and then putting Linux back on the PS3 using that flaw).

Microsoft not doing that with Xbox (orig/360) hackers is why the Xbox One has really good security. They hired them instead.

How did that turn out with Sony in the end?

They settled which Geohot (who had nothing to do with the rest of us, but kind of triggered the whole thing by just implementing our exploit and posting the keys on his site), and dropped it against everyone else. I never got served personally, so for me it was mostly a big scare and having the EFF help us with lawyers to be prepared for whatever happens. One of my friends wasn't so lucky, they got ahold of lawyers at his job and caused him a bunch of trouble.

PS3 runs FreeBSD

OtherOS was Linux

Reply on news.ycombinator.com