Hacker News Reader

"This vulnerability is probably a good example of something with a sub-$1000 value on any non-bounty market."

Crazy statement. This would easily be worth more to malicious actors

The only actors who will pay you real money for a serverside RCE bug aren't buying an exploit; they're contracting with you to plan a heist. So the same analysis applies: you yourself could come up with some scheme whereby you yourself use this vulnerability to steal stuff from Google. But that's not what we're talking about when we talk about vulnerability valuations.

There is essentially no market for these kinds of serverside vulnerabilities.

How do you know? You could explain the impact of the vulnerability and let buyers on the black market decide and bid whether they could do something useful with it.

That's not how the "black market" works. There isn't like some bazaar where people describe vulnerabilities and people bid on them. Only a very specific subset of vulnerabilities, those that slot into existing business practices and CNE stacks, have buyers.

How do you know? There were offers on HackForums which did not relate to software components such as smartphones operating systems or webservers but to web sites. Why wouldn't that be possible for Google's developers docs site?

Reply on news.ycombinator.com