alt Hacker NewsThat’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found. Before professional security researchers existed, far fewer vulns were found.
The vulnerabilities exist and many have for decades. Find them or leave them for someone more dangerous, just don’t shoot the messengers.
Personally I’d rather we went through a short and sharp improvement and embedded a faster response cycle, than wish it away. It’s the reality of the situation; so adapt.
Replies
> That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found.
Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before a potential bubble pop.
If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.
You’re missing the point. The white hat researchers in your example would need to also be the black hat hackers selling the tools to do the exploit in the first place. There is a conflict of interest when you create the problem and then solve it. I don’t think anyone would tolerate a white hat security team releasing the exploit publicly so they could sell more services rather than taking it to the affected company to patch.