If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched.
Further: a vulnerability is probably not worth that much either, even if it's a hypercapable vulnerability, because the grey market buys full enablement kits, not vulnerability information. People making 6 figures on vulnerabilities are selling fully enabled full chain exploit systems, not just intelligence about a sandbox escape.
I was under the impression that the three letter agencies and contractors bought vulnerabilities?
[flagged]
Mate, it’s a style thing that depends on which style guide you’re following
AP recommends spaces around them, whereas Chicago doesn’t
besides if we’re critiquing incorrect following of English orthography
—Sentences should be capitalized
—The word “don’t” requires an apostrophe
—End sentences with a period
—That’s incorrect usage of an em-dash at the end there — but what does it matter anyways ;)
Books I've read would disagree. Are you the emdash police?
Books you have read have told you to use spaces after emdash? Mostly in writing we do not use spaces even though there is no fixed rule as such. https://www.merriam-webster.com/grammar/em-dash-en-dash-how-...
And yes you cannot care about grammar that is fine but calling someone a personal insult because they pointed out something impersonal in your comment is not ideal also and is unusually catty.
> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.
they put spaces there so their AI generated text looks a bit more human, when in reality humans rarely use em dashes for casual comments or text. The only use for it prior to AI cuntwriting was in high brow literature, philosophy and wannabe high brow internet writing. But ai thinks that just how we talk
Before the LLMs made the emdash the tool of the electronic oppressor I used it often enough and other people did too.
I hate that it's basically become the little hitler moustache of punctuation. There was at least one guy who was really enjoying his tiny little moustache until he couldn't anymore. That is the emdash for me.
> the emdash has become the little hitler moustache of punctuation
Legendary.
Miss that shit too.
Ez way to shit on Windows users who had to double up endashes like they were impoverished.
I guess in your analogy the double endash is Stalin’s mustache and the Soviet Union in general - Gaudy, excessive, starving for more
How much money is lost by consumers/businesses for every hour the vulnerability is exploited in the wild with no patch?
The value of the report is dependent on the scarcity of the knowledge. If anybody can report it, the bid goes down.
The value of future reports should also be a component though. By paying a low amount you discourage ethical bug bounty hackers from bothering to look for more exploits. If I think I'm only getting $1000 for a Chrome issue versus $100,000 for an Acme Co issue, I'll be spending my time looking for Acme Co issues.
Bug bounties are as much a way of attracting talent to even try to exploit your system as they are about the exploits themselves. If you lowball the bounties the talent goes elsewhere.
There is a theta decay component. The zero day is highly valuable until known; once known, its value rapidly declines to zero.
That’s not how things are valued. That’s moreso how the absence of something is valued.
Go without air for a few minutes and you’ll die, and yet they give the stuff away for free.
That's really informative but maybe a little overly capitalist-brained.
We shouldn't look to the black market as cost discovery for these vulnerabilities, most non-criminal researchers are not putting up an ask order and letting the black market compete with Google.
> We shouldn't look to the black market as cost discovery for these vulnerabilities
We absolutely should. One of the points of bug bounties is to discourage people from selling to the black market.
That's one of the points, yes, but the black market doesn't dictate the value of the exploit to Google.
A hardline bargaining position with Google would be more like "pay me what I want, or else I'll give it to all takers on the black market for maximum damage". That would be unethical and probably illegal to boot but it's a better definition of value than "1$ greater than max bid".
The value to Google - sure. But the market value of the exploit itself - the black market I think is a factor in that regardless of what Google offers.
The value of something is dictated by what _the market_ offers, and just because Google throws a lowball price because _they_ don't value it doesn't necessarily mean that the value of the exploit itself is as low as they dictate.
There will always be someone who would screw Google just for the love of the game, and if they got a better price from elsewhere, I don't see why _morality_ would really play that big of a role. It all comes down to incentives, and if Google doesn't incentivize doing the good thing enough, then someone _will_ incentivize them to do the bad thing just a bit more.