The DMZ

forest

12:00 PM

hopefully

Anonymous

I don't feel like spending £300 of my own money for it. These exams are so expensive man.

Anonymous

I don't understand why companies get so like tied up over exam fees.

Anonymous

Don't advertise a training budget but then limit it to certain trainings lmao.

Anonymous

All companies have a training budget so they should use it if people ask.

Anonymous

Like, with our training budget I could've gone to BlackHat EU for the week, all the trainings briefings, etc but they won't pay for it because we don't offer any kind of infosec service.

Anonymous

12:02 PM

But that just made me think, well if you invest in someone to do it, why can't you sell it? lmao.

Anonymous

Like, they could pay for my whole OSCP, let me do the course then start selling pen test services once I pass.

Anonymous

I'm actually fairly sure I could do a okay job at pen testing now.

Stu W

most pentest exam boards are a bit of a sham anyway. No one actually audits or accredits them

Anonymous

What do you mean?

Anonymous

You mean companies like OffSec? :thinking:

Stu W

12:05 PM

literally anyone could set their own cert scheme up and it would be no less valid than any of the ones that exist

Anonymous

I disagree.

Anonymous

I don't think anyone providing education like that should need to be verified.

forest

@StuW Well some are more reliable than others.

I mean, OSCP vs CEH? Easy choice.

Stu W

perhaps

Anonymous

I hate the idea of a govt or the like auditing where I can get my education from.

forest

12:06 PM

Certs aren't gov't run.

Anonymous

That is ridiculous.

Stu W

i dont necessarily mean accredited by a government

Anonymous

He's saying they're not audited.

Anonymous

Well who else would do it?

Anonymous

Yeah I know, that's my point.

Anonymous

12:07 PM

I don't like the idea of another company doing it either.

forest

Well who would audit them? A cert is only as good as its reputation.

Stu W

i mean meeting an iso standard or being transparent about their processes

Anonymous

Yeah that's my point.

Anonymous

I hate the idea that someone would need to audit them.

forest

@StuW They are their own standards. You can choose the better ones.

Anonymous

12:08 PM

I should be able to use and take whatever certifications I can find without them needing to be "accepted"

Anonymous

Like, I bet not many people have heard of the SLAE exam, but it's great!

forest

It's not like they're all equal (in which case they would need to be audited, like a CA).

Tom K.

@forest I really wanted to ask this as I often read about curves being backdoored and certain curves being 'better' than others which I never really understood. Do you have a suggestion on how to rephrase the question so that it is still broad and answerable?

Anonymous

I hate the idea of someone else having power over a cert/education.

Anonymous

That's so... I don't know, I feel like it would propagate corruption.

forest

12:09 PM

@TomK. I think there's already a good answer to that, let me find it...

Stu W

true - though there is one particular UK one that is used as a barrier to entry for the market as an example

Tom K.

ah cool, thanks

Anonymous

@StuW You mean CREST?

forest

133

Q: Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- including at least one NIST standard. The NIST FIPS 186-3 standard provides recommended parameters for ...

Stu W

i am not permitted to say anything

forest

12:10 PM

That's one, which is specific for NIST curves.

Anonymous

Why so?

Anonymous

There is nothing in any of the NDAs that states you cannot give your opinion on their exam/courses.

forest

Er, wrong one. There, edited.

Anonymous

But, fair enough.

Stu W

though lots of the bigger companies may help their staff pass it using internal courses matching the exams content - which are banned on the nda

Anonymous

12:11 PM

I still don't think that one organisation/body should "audit" what certifications are available.

Stu W

though the board for this one turns a blind eye

i wasnt suggesting that

Anonymous

In general I feel it would cause corruption and favouritism and be bad for open source education material.

forest

There's also crypto.stackexchange.com/q/12898/54184 which is slightly more technical.

Anonymous

But for example in the pen-test community, people are pretty certain that OffSec are good.

Stu W

true

Anonymous

12:12 PM

So why should someone else tell me they're not and then kinda' make the cert worthless because one group does not agree?

forest

@TomK. Primarily, the non-existence of a backdoor can be proven by making sure the curve uses NUMS (Nothing Up My Sleeve) parameters.

Anonymous

I think leaving it to the community is a good method.

forest

Like Koblitz NIST curves can be proven that way since they are very simple.

@TomK. And I think the best resources are Safe Curves and Bada55.

Anonymous

As I said Stu, not many people have heard of the SLAE course.

Anonymous

I fear certs like this would become valueless simply because one org/body did not approve it.

Anonymous

12:14 PM

But it is fantastic for learning low-level stuff.

Stu W

there is no way of proving that a cert is worth anything

Anonymous

I get your point.

Stu W

by all means use it as a goal while learning something

Anonymous

But I don't think auditing/approving them is any better.

forest

@StuW It's like a PhD. It's just a way to say you have knowledge.

Anonymous

12:14 PM

Just let the wider-community decide and leave it at that.

Anonymous

At the end of the day, you could say that about any accreditation.

Stu W

though it is concerning that most of these boards could just hand out certs to their friends

Anonymous

Who's to say the education depart of a govt is anymore equppied to "approve" them than the community is?

Anonymous

What because they went to a uni so they must be better equipped? Please.

Stu W

wasn't saying that it was

Anonymous

12:15 PM

I know.

Anonymous

Just making a point.

Stu W

more that perhaps there is a need for a few open source evaluation projects/ standards

forest

@StuW If they handed out certs to friends, their reputation would plummet.

Anonymous

Standards I can get behind, but who would make the standards?

forest

They don't want a script kiddie to boast about being certified.

Tom K.

12:16 PM

@forest alright, I'll have a look. I have to say though, that these questions/answers are too mathematical for my taste. So something along the lines of "if you see X then a curve is backdoored because adversary can do Y" would be great

but I see that this might be hard to do

Anonymous

As Forest said, the thing stopping that is their reputation.

Anonymous

As I said, most of the pen-test community backs OffSec.

Tom K.

I won't object though, if the question gets closed/marked as a dupe ;)

Stu W

they just need to be big enough that one or two wouldn't be noticable

Anonymous

I don't see a situation where OffSec just start handing out certs for their friends simply because they can.

forest

12:17 PM

@TomK. ECC is a very complex subject, and it's hard to wrap your head around possibilities of backdoors without a deeper understanding of ECC. Generally if it has NUMS (and has been heavily analyzed), it's good. If it doesn't, things get complex.

Stu W

offsec already had problems with people paying others to sit their certs

Anonymous

Yes but every vendor has that problem.

forest

@StuW That's a problem with cheaters, not with OffSec.

Anonymous

Even formal education has that problem.

Anonymous

Don't be so ignorant.

forest

12:18 PM

They could be audited to hell and back and would still have that problem.

Anonymous

It's not OffSecs fault.

Anonymous

What stops me paying someone to write my thesis? lmao.

Anonymous

It's not the uni's fault if I do that and you wouldn't blame them in that case, so why blame the vendor here?

Stu W

I just wish that some of these certs had syllabuses that matched what was on the exam and deterministic maeking

forest

@TomK. For implementation, if you're doing regular key exchange, go with x25519. If you're doing digital signatures, go with Ed25519. If you're a bit more paranoid, use the Curve448 versions of those instead of Curve25519 (e.g. Ed448).

Stu W

12:19 PM

*marking

Anonymous

As I said, I could get behind standards but then it's a question of "who makes the standards?"

Anonymous

Which again is just giving power to one body.

forest

Pretty much any popular curve DJB made is going to be fine for most purposes. :P

Anonymous

Honestly, I think by now the community knows what to take and what to avoid.

Stu W

maybe we need something or a couple of organisations like owasp

Anonymous

12:20 PM

So I don't think they need to be audited at all.

Anonymous

And I think HR & recruiters are getting to that stage now.

forest

@StuW What specific problems have you identified with infosec certs?

Anonymous

Most people know to avoid EC-Council like the plague, recruiters & HR still don't know this but they will soon.

Anonymous

Also Stu, you said standards right?

Stu W

transparancy in marking and appeals being potentially career limiting

Anonymous

12:21 PM

What stops EC-Council paying for the audit?

Anonymous

You mentioned people paying for others to sit the exam, or them handing out certs if they're big enough, what stops them just paying to pass an audit?

Anonymous

What stops any corruption? At the end of the day as long as we have money & power corruption will exist.

forest

"The quality of the auditors" -> "Then who audits the auditors?"

Anonymous

So I don't see how this solves a problem.

Anonymous

Who will audit the auditor?

Anonymous

12:22 PM

Forest, you read my mind.

Anonymous

Besides, even if you find someone to audit the auditor, who audits that person? What if someone they're related to works below them and then they pass power that way...

Anonymous

It's an impossible problem and I think it's better left to community opinion than borderline political opinion.

forest

Auditors have auditors upon their backs to bite em. Auditors have auditors, and so ad infinitum.

Anonymous

To be honest, I am yet to experience the problems you mention Stu.

Anonymous

Before I decide to sit an exam I take a nice look around the Internet about the vendor and it's how I managed to avoid hell holes such as the CEH.

Stu W

12:25 PM

hopefully you never will :)

Anonymous

Of course, reading someone else's opinion on a vendor needs to be taken with a pinch of salt. But if I read 20 posts that say CEH is bad and only 1 that says it's good, I know to disregard that exam.

forest

Some industries are heavily entangled with certs, others only use them to get your foot in the door. For what @J.J will likely be doing, it's the latter.

It's only when you deal with govt that the process becomes really complicated.

And with some of the more heavily-regulated industries.

Anonymous

@forest Yeah that's my main problem @StuW I need certs else I will never get into the door.

Anonymous

Because i have no formal education at a high level, etc without the certs I have no chance.

Anonymous

And I do have quite a long list of certs I want to do but mostly they're for my own accomplishment not for a companies benefit.

Stu W

12:28 PM

oscp probably good for that

Anonymous

Although the OSCP I will be doing for mostly a job benefit and not my own.

Anonymous

But something like the SLAE I wil be doing for my own benefit and nobody elses.

Anonymous

And it means I get some extra letters after my name which is always niec.

Anonymous

But again, soon I am doing my CPSA - I am not doing that exam for my benefit.

Anonymous

I can read all the books and not do the exam, I am only sitting the exam so I can move into InfoSec from networking.

Rory Alsop

12:30 PM

@J.J I listen to a bit of everything. My kids introduce me to newest stuff. But my heart is still with the classics. I have a guy who is going to do a full redesign etc of the website - that was one I threw together one afternoon from my mobile

Stu W

hopefully you will never sit two identical exams with an exam board that is widely recognized, give the same answers (as you believe them to be correct) and get two entirely different marks with no feedback /transparency then get prevented from doing lucrative work

Anonymous

@RoryAlsop Ah, honestly - I don't think I could live without Issues or Amity Affliction in my life, especially the latter, their songs touch me. If you ever get a minute, listen to Amity Affliction Don't Lean on Me.

Anonymous

That song is incredible, at least I really love it :p

Stu W

then not want to appeal because you could upset one or both of the examiners and there is nothing stopping them from instantly failing you in the future

Anonymous

@StuW I have a feeling you're talking about CREST.

forest

12:32 PM

@StuW If you're actually prevented from doing good work because of that, you're in the wrong industry. And/or your hat's the wrong color.

Rory Alsop

@J.J I don't think so. They didn't really want him doing anything. If they hadn't needed him for his code breaking, he would have probably been vanished

Anonymous

And all I will say to that (if it is CREST) is what do you expect?

Stu W

and then watching others pass it using secret insider briefing material and prewritten answers

Anonymous

CREST are govt. backed/funded IIRC.

Stu W

I cant say who it is for legal reasons

Anonymous

12:32 PM

So your idea of regulation would be nullified on them.

Anonymous

:p

forest

An NDA, or gag order?

Now you've got me interested lol

Anonymous

Well, he said it's a UK vendor Forest.

Stu W

not regulation - just some form of independent community evaluation - or several

forest

Oh boring

Anonymous

12:33 PM

Hence why I am certain it is CREST because he is pen-tester as per his profile.

Anonymous

So with those two things added together I can deduce it's CREST but I could be completely wrong.

forest

Well corruption abounds.

Stu W

could be one of any exam boards

Anonymous

As I said, I could be completely wrong :)

forest

But even then, it's no worse than, say, PhD programs.

And there's a lot more cheating there.

Stu W

12:34 PM

true

Anonymous

I mean what Forest says is quite right, it's just a bit of paper really.

Anonymous

Who is anyone to say it means anything but yourself?

Stu W

tempted to start my own called 'certified competent pentester' and charge 10k each

Rory Alsop

@J.J in my school I originally taught the teachers about IT. Then when we got the first computer I set it up and was in charge :-)

Anonymous

It's about your experience.

Stu W

12:35 PM

i agree it is just a bit of paper

Anonymous

So in that sense Stu, I think it all means very little.

Stu W

could say that anyone without this cert isnt competent

forest

@StuW Make CUH, for Certified Unethical Hacker.

We really need that.

Anonymous

As I said, there are certain certs I am doing for myself and others i am doing just so I can simply pivot into a role.

Anonymous

Because I am so young, without certs I have no hope.

Stu W

12:35 PM

just how the industry treats the certs is a bit wierd imho

Anonymous

And employers have been pretty ageist in my experience.

forest

@J.J For pentesting maybe, but there's plenty of infosec that doesn't care about certs, especially in the defensive sector.

Anonymous

And all this "Millennials are lazy" bullshit does not help my case.

Rory Alsop

@J.J nobody has power over them, but if someone sets one up I definitely want an independent assessment of the value of the cert

Tom K.

@forest at last years (or the year before that?) Chaos Communication Congress a relatively famous German hacking blogger predicted that there soon will be a certificate and auditing process for ransomware and exploit authors

forest

12:37 PM

hahaha

Anonymous

I don't like the idea of auditing and assessing everything @RoryAlsop

forest

I wish criminal industries were that coordinated. :D

Anonymous

As I said, I think it's all based on individual opinion/experience.

forest

There really is a lot of shitty quality ransomware out there.

Anonymous

Assessing it won't change peoples negative or positive experiences

forest

12:37 PM

Needs someone to audit it for proper application of maliciousness.

Anonymous

So why bother?

Anonymous

I feel like you're just adding process to something for the sake of it.

Rory Alsop

@J.J not heard of them before so will add to my spotify

Tom K.

his argument went something like this: professionalism has gone so far in the ransomware industry - with the introduction of customer support hotlines and stuff like that - that certification and audit of ransomware is only the next logical step. so that if you get infected with audited and certified ransomware, you know that if you pay the ransom you get your files back

Anonymous

I don't think anybody should be able to tell me how useful/unuseful my education is.

Anonymous

12:39 PM

I don't think you'd like it much if I told you your education is a joke.

Tom K.

@J.J wait til you are in charge of hiring people. :P

Anonymous

I mean sure, don't ban telling me it.

Anonymous

But don't audit my exams because you think they're bad.

Stu W

much of mine was a joke

Anonymous

I don't like that.

Rory Alsop

12:40 PM

@J.J I can't imagine it is CREST - I have seen the audit process, and the effectiveness of prevention of cheating. So it's one of the ones I rate highest. It is also not govt funded, and in fact the only backing is in terms of equivalency to Check

forest

@TomK. That's actually kind of clever.

Anonymous

@RoryAlsop If you like a lot of cleans in between screaming, you will love AA.

Anonymous

If you're not big on cleans you won't like them I guess.

Anonymous

But for me cleans are the most important part of nu-metal.

Anonymous

@RoryAlsop Oh right, my apologies.

Rory Alsop

12:41 PM

@J.J gawd - I do. The industry doesn't have enough, which is why we have a lot of snake oil peddlars

forest

cough GRC cough

Anonymous

@RoryAlsop I guess I would like to do something about the snake oil.

forest

s/GRC/GRC and every AV vendor ever/

Anonymous

But, why should someone tell me my exam is worthless?

forest

@J.J If you learned from it, it's not worthless.

Anonymous

12:41 PM

Why should someone else tell me something I've done is worthless because of their assessment of it? It's all opinion based.

Stu W

an exam is only what you make of it

imho

Anonymous

I mean we can joke about CEH till the cows come home but as Forest just said, if I learned something from it it's not useless.

Rory Alsop

@J.J if it doesn't have value to the industry, that is good to know. It helps prevent people wasting their time and money

forest

Sure, but OffSec certs do have value.

Anonymous

^

forest

12:43 PM

As does CISSP, CCNA (as crappy as it may be), etc.

Anonymous

TO be honest Rory, there is so many reviews on all InfoSec certs.

forest

Industry-wise, even CEH has value. Doesn't mean it's not trash.

Anonymous

If you still get scammed by them, it's your own fault.

Anonymous

There are hundreds and hundreds of blog posts on literally every single InfoSec cert.

Rory Alsop

For example I would not use CEH as an indication that someone would be a good hire. I would expect it to mean someone had an interest in sec and might be okay for a starting position

Anonymous

12:43 PM

I don't see why an organisation should tell me what is good and what is not when I can just go read 30 blog posts.

Anonymous

THen why not leave it down to the recruiter Rory?

Anonymous

Why audit it at all in that case?

Rory Alsop

Why would you trust blog posts over an assessment?

forest

@J.J Indeed. It's not like we're sheep who need to be warned that coffee is hot. We can do our own research and find out how quality a cert is.

Anonymous

Because I trust individuals more than I trust organizations and bodies, Rory.

Anonymous

12:44 PM

Why not just keep the current process?

Rory Alsop

Why would the recruiter be better than an organisation that assessed a cert or an exam

Stu W

Paid blog post marketing is quite big :)

Anonymous

As I said, I trust individuals more.

forest

@StuW Sure, but 99% of it is spintex-generated.

Not something that's easy to fall for.

Stu W

though I guess there are some legit people in the industry with decent blogs

Anonymous

12:45 PM

Generally I expect an individual to have less ulterior motives to an organisation or a body.

forest

Not to mention, you can go by the reputation of the blog/blogger.

Anonymous

But that's just me.

Rory Alsop

@J.J what do you mean? The current process is that courses and certs get certified to prove their value (eg to an industry)

@J.J I cannot afford to have that view, as individuals are too easily biased or influenced

Anonymous

@RoryAlsop What I mean is, I don't see a need for a body/organization to create standards for such a thing.

Anonymous

I've sat four technical certifications and I have not felt scammed by any of them, and I based all these certs of reviews on the Internet.

Rory Alsop

12:46 PM

I need a verifiable, repeatable, independent assessment of things like degree courses.

Anonymous

Whereas if an organisation said "actually that cert is useless" I wouldn't sit it.

Anonymous

Whereas if an individual says "its useless" I can go well "they say this but lets still try"

Anonymous

Organisations hold authority

Anonymous

Influence, individuals don't hold nearly as much.

Anonymous

And then I might miss out on a great course.

Anonymous

12:48 PM

I mean, I guess you could argue why not just use the same rule you use for individuals opinions against the body/organisation would be a fair argument.

Rory Alsop

It sounds very much like you are saying what I am saying

Stu W

I guess just dont put too much faith in organisations as anyone can set one up

forest

@StuW But you wouldn't have the reputation as a new organization.

Anonymous

As I said, I could get behind standards Rory.

Rory Alsop

Verification and standards help with reputation

Stu W

12:49 PM

look at predatory journals in the academic world

Anonymous

If I were to accept standards it would need to be formed by multiple organisations and have some community influence.

Anonymous

But I could not get behind one group/body controlling those standards.

Rory Alsop

@J.J standards require audit and verification and review

Anonymous

I would not accept it if community influence was not involved.

forest

@StuW Despite predatory journals, Cell (for example) is still a good journal.

It means the peer review process is still very strong.

Even if there are lots of predatory journals out there.

The same is true with certs. There are scams, and there are good certs.

Stu W

12:50 PM

true - and there are things like beale's list

forest

And there are things in between.

Rory Alsop

@J.J for example the iisp certifies loads of training courses to indicate how good they are

Anonymous

@RoryAlsop But Rory, why go to all this effort to save someone buying a bad cert? When that same person can already avoid that just by browsing the Internet?

Rory Alsop

They put their reputation to say those courses are good.

Stu W

something like this for certs wouldnt be all that bad beallslist.weebly.com

Anonymous

12:51 PM

Maybe I just have a problem with authority lol :D

Rory Alsop

@J.J because it not effective enough. Too easy to buy reviews

forest

@StuW But is it as overt of a problem with certs?

With journals, there are journals that are downright scams.

Rory Alsop

Hence independence and reputation. Transparency is also needed

forest

With certs, isn't it more just a matter of subjective quality?

Anonymous

But Rory, who do you propose control these standards?

forest

12:52 PM

Even if some of it verges on being more objective than not.

Anonymous

Because realistically whoever does it will be biased already in some way, so that already impacts the validity of their auditing/standards

forest

@StuW In other words, I think the worst journal is far worse than the worst cert.

Anonymous

Then we look at who works for the controlee and again we have issues with bias and corruption.

forest

The average "bad cert" is also far better than the average predatory journal.

Anonymous

So who do you actually propose would control this?

forest

12:53 PM

(At least in my limited understanding as someone who doesn't deal with certs)

Rory Alsop

@J.J having worked with many, I like the iisp approach. I may be biased, but I have remained a member and now a fellow because of the approach

Anonymous

This is why I am happy with the community approach.

Anonymous

Because we expect bias and corruption.

Rory Alsop

@J.J iisp is community without bias or corruption

Anonymous

But with an organisation I would not expect that bias/corruption.

forest

12:54 PM

@J.J The Pope, of course.

Anonymous

Yet it will still exist.

Rory Alsop

There are controls that effectively prevent corruption or make it visible

Anonymous

I'm not sure how IISP works Rory.

Anonymous

Are they as archaic as the BCS?

Anonymous

Because the British Computer Society is one big snake oil operation designed to scam old-age IT managers out of their not-so-hard-earned cash.

Anonymous

12:56 PM

@StuW May I ask who you work for? :thinking:

Stu W

Will DM if you want

Anonymous

Is there such a thing as DM on this platform? :O

forest

Note that messages are not private on SE, I believe.

Anyone can see them and join them, and read the history (even if it is one-on-one).

Anonymous

That is what I thought.

Anonymous

Yeah, you're correct Forest.

Stu W

1:00 PM

thought it would be better in a side chat

Anonymous

^ Possibly :D

Tom K.

probably "Narwhal Penetration Testing"

Rory Alsop

@J.J not like the BCS, but very structured so they can work with corps, gov, academia and community

forest

inb4 Hacking Team

Tom K.

lul

Rory Alsop

1:02 PM

@StuW side chat here is not confidential either. Can be obscure, but not hidden

Tom K.

speaking of Hacking Team

Anonymous

@RoryAlsop I see. BCS is a complete joke.

Rory Alsop

@J.J well, I'm not a member, but I would disagree, as I see an awful lot of value they give to the community

Anonymous

@RoryAlsop All I see is a bunch of people paying a lot of money into an organisation run by people out of touch with IT.

Anonymous

@RoryAlsop THen again, you've probably never sat a BCS exam, I have.

Rory Alsop

1:05 PM

@J.J ah, so there is probably 95% you don't see then. BCS exams are not a thing I would look for. But their events, networking and other things are rated highly by many folks I have worked with

forest

@TomK. Just added an answer (gonna expand on it soon).

Hopefully I can get the point across before I resort to swearing.

Tom K.

hum.. was just writing something myself

Anonymous

@RoryAlsop Perhaps, yeah their exams are a joke.

Rory Alsop

@J.J so iisp has membership interviews but not exams. They independently assess industry exams and university courses (without bias) and even their membership interviews are not based on certs but on experience, capability etc

forest

0

A: What is the business model behind Zerodium?

Zerodium is not "well-known for their big bounties", but they are well-known for aggressive marketing. They are actually fairly small players in the whole exploit broker market, and they pay up far less than they advertise. In general, companies like these will buy weaponized exploits and resell ...

I hope this is good enough.

Anonymous

1:09 PM

Zerodium...

Anonymous

Don't they sell most of the 0days to govts?

forest

Yes

They basically do exactly what VUPEN (their precursor) did.

Anonymous

Yeah Holly-Grace was speaking about Zerodium when I went to a talk she did.

Tom K.

mah :( question closed

forest

@TomK. Client-side restriction. :D

You get something like 50 minutes to submit an answer.

Only after that will the server reject it.

Tom K.

1:21 PM

wouldn't that be a server-side restriction? :s

forest

The server-side restriction kicks in almost an hour after it is closed.

The client-side restriction is immediate.

I think the purpose is to let people who are editing offline with SE apps post.

Tom K.

oh.. I thought you were making a joke

forest

It might have changed, but that's what I remember from a post on MSE.

Tom K.

I see

the button was greyed out

but I probably could've circumvented that (if it is the case like you say)

forest

At least used to be (think it still is).

Remember Zerodium's "$10 million for a Tails 0day" bullshit from last year?

And at the end of the offer period, people started suspecting that no one sold them even a single vulnerability (forget how people figured that out).

Tom K.

1:26 PM

no, not really

forest

And after that they started waaaay overhyping a Tor browser bug which was literally nothing more than a NoScript bypass, but they acted all like they were dropping a crazy effective RCE. They're such a pathetic company.

Tom K.

but when doing reasearch I found an article that claims that they paid out a least one 0day for an ios10 jailbrak

forest

I think the only reason I hate them so much is that my hatred for the scarier ones like Vencore and Raytheon SI is high enough that my brain gets an int overflow.

@TomK. You sure you aren't thinking of Zimporium?

Those are the iOS-crazy guys who actually pay out.

Tom K.

ah sorry, ios 9.1/9.2

forest

ah

Tom K.

1:29 PM

but they offered 1.5M$ for an iOS 10 jailbrak

Anonymous

I think that is one of the most expensive things you can find Tom.

forest