Venta de exploits

Hace unas horas recibí un correo de alguien que quiere comprar unos exploits para versiones nuevas WordPress y aunque no comparta la idea de lucrar con este tipo de cosas, sólo por curiosidad le respondí preguntándole cuánto pagaría por el exploit para la vulnerabilidad que estuve comentando estos días.

La venta de exploits es un tema bastante polémico, por un lado gente que quiere que su tiempo invertido en encontrar una vulnerabilidad sea recompensado de algún modo (ya sea por la empresa afectada o por alguien más) y por otro lado, aquellos que consideran que hacer esto es éticamente incorrecto.

To chime in on the debate some more. Vulnerability researchers such as myself spend a lot of time finding these holes and then reporting them via full disclosure. Out of experience I know not to contact the site affected directly as it will always be more hassle then it is worth.

And herein lies the problem. I don't have the financial resources to search full time for vulnerabilities and therefore need to work. But... if i was to say get some type of monetary compensation for my time then i could possible quit my job and spend those hours searching for vulnerabilities and as a result, help to make a great number of popular websites more safer.

Criminals on the other hand, do have the time and money to search for the vulnerabilities because when the find them, they expoilt them in order to obtain profit. So as you can see, until people start getting paid for reporting vulnerabilities, the number of actual holes found and reported will continue to be outweighed by the number of vulnerabilities found, exploited and not reported.

Hence, until we are rewarded for reporting vulnerabilities, users of sites such as myspace, google, ebay, paypal, yahoo, msn, facebook and pretty much any other highly frequented site should consider themselves and any data they choose to place on this sites free game and in the public arena.

Como mencioné al principio y a pesar de que en realidad necesito dinero para continuar con mis estudios, lucrar con la venta de exploits a terceros no me parece correcto, porque al fin y al cabo los que usan estas aplicaciones, no tienen la culpa de los errores que generalmente cometemos como desarrolladores.