Hacker News Reader

Comment by tptacek | Hacker News Reader

The work is the work, no matter how much the project itself took to build. If it was easy for exploit developers to pull a Pidgin exploit out of their butt, they'd be cheap. The fact that it's a niche target can actually make bugs scarcer; sometimes, exploit devs can draft off the work other people have done beforehand.

View on HN

Sure, my surprise is more that the demand exists at $100k, not that the supply isn't cheaper.

I get why that's surprising but I think it's important to beat that surprise out of your brain, because $100k is a rounding error for any state-level actor --- not just the US, but, like, Seychelles as well. If you have a problem that can be solved with a Pidgin exploit, it's a problem you'd fall over rushing to write a simple $100k check for.

What's so perplexing to me is why the pay grades for people in the military are so low. Take Michael Flynn, for example, the O-9 pay for a three star general is lower than what a senior software developer makes. Surely if we're spending $100k a pop for these random exploits it makes sense to spend more at the top of the military to make sure we're buying the right ones.

Also, I don't really see any possible way out of this cyberarms market. There are too many degrees of freedom to really secure anything completely and I'm continually surprised that our governments allow the sale of these munitions to non-allied foreign governments. If someone puts up a $2m dollar bounty for Tesla do we just accept this even if it means physical harm?

You're missing the value of military pensions and healthcare when you speak about O9 compensation.

I think we don’t want those at the top of the military to be motivated by money.

Reply on news.ycombinator.com