If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from researching security vulnerabilities?
@ScottPack Well, I guess he answered my most specific question re: editing tag wikis. I'm not happy with the new/current limits, but that's a different matter I guess. Anyway, marked as accepted - thx.
@Iszi I think this is a great question, with a great answer already - wow, John is quite an asset here. While answers will change over time, that's true for lots of questions, and folks can always add answers or update them. It is all the more valuable since the vulnerability market area is shrouded in secrecy, and improving the situation could make a huge difference in real-world security.
@nealmcb Y'know... I think I may have mis-read the question. I was reading it as "What companies require software vendors to pay for vulnerability disclosure." sort of in the sense that VUPEN won't give Google the vulnerability data for their Chrome exploit without them being a client.
@Iszi I just read your tweet about RPG going live soon. According to the Area51 stats, this site is pretty much right on target with them. Their views are statistically insignificant from ours, and our Q/day is a good bit higher.
I wonder if that means we can look forward to the tipping point soon.
it's been over one hour and twitter still can't fix the timeline thing.
@nealmcb thx for that comment up there. Your question comes at a nice timing, 5 days ago the Hack In The Box conference took place in Amsterdam, and on the 2nd day, the keynote discussion was title "The economics of vulnerabilities". People should start blogging about it soon I suppose, I don't have time right now to check.
@nealmcb reading the paper you mentioned, things have changed since then :-) The reward sums are usually in the 5-digit area, not 4 as the paper says. The derivatives seems to me that isn't very practical for lots of reasons, haven't seen anything like it.
@ScottPack I don't know if that term can be defined.. awk is pretty hard to master :> but shoot
Given a file of comma delimited values, I want to sum the 47th field from the last two lines.
I had been printing out 47th field of the last line, but last night I realized that sometimes I need the last two lines.
This is for accessing snort performance data over snmp. So, really, it needs to be a one liner. Otherwise I need to write a shell script, at which point I can just use tail.
If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from researching security vulnerabilities?
