Comments on: Can I make a suggestion?

By: Pete

Pete — Thu, 15 Dec 2005 05:57:07 +0000

@Chris – I guess the word “extremely” is debateable, but nobody in their right mind would suggest that the level of risk on the Internet doesn’t increase with new vulnerabilities found (there is clear evidence here), so I think it is reasonable to call that “detrimental.”

By: Chris Walsh

Chris Walsh — Thu, 15 Dec 2005 03:52:25 +0000

Of course, that “it is extremely detrimental to Internet users overall” is not at all a settled question.

By: Pete

Pete — Sun, 11 Dec 2005 17:08:07 +0000

@Dominic -

Good point – I should clarify. My point was that bughunters shouldn’t hunt bugs because it may not be worth it (at least according to the point made in the excerpted article).

But I also don’t want them doing it even if it is worth it, because there is a huge externality there – it may be worth it to the researchers even though it is extremely detrimental to Internet users overall.

By: Dominic White

Dominic White — Sun, 11 Dec 2005 07:11:55 +0000

That’s a bit dangerous. If we are going to push the ‘only do it if it is worth it financially’ line then it is going to be hard to argue against unethical disclosure glory hounding in an effort to promote your new shiny vulnerability research lab.