On: The Insecurity Industry

[sat0ri]

So many CVEs are due to their bug bounty program, hackers are incentivized to sell vulnerabilities to Google rather than exploiting them. CVEs are publicly disclosed after they are fixed, of course.

[cartoonworld → sat0ri]

The CVEs are due to the bug reporting, the bugs are not.

The point is that memory safety bugs are the gift that keeps on giving.

You can throw as much money into the problem as you want, and the inherent complexity of memory management means you are still gonna ship bugs of all severity.

[staticassertion → sat0ri]

You could have made that argument a few years ago, before we started to see in-the-wild exploitation of these vulnerabilities.