Schneier on Security

Clive Robinson • March 22, 2024 11:38 AM

@ Wannabe techguy,

Re : Google are getting a lot for nothing.

‘So,is this all “Security Theater”?’

It rather depends on your point of view.

We know that “black market” rates have been well north of $1,000,000 USD effectively tax free etc.

It sounds a lot till you remember Google has by repute paid developers more than that as basic annual pay.

Most of those who discover and build out these vulnerabilities to acceptable POC get maybe one every five years.

So what Google is offering is a pitence at best.

What would you rather have those who find these do, take the black market money because the Ransomware and worse way worse get their vulnerabilities from some where.

Remember before making a snap decision that black market vulnerabilities are known to be used to murder journalists, political activists and aid workers.

So the question you have to ask is,

“Who has the blood on their hands?”

Me I’d say Google for writing cruddy code and then not picking up the tab for their mistakes.

In the long past back before draconian legislation was demanded by certain people I used to make vulnerabilities I found “public” with zero notice. Because back then if you did not strike first you had lawyers and worse try to tear your eyes out. I even had the then UK Prime Minister “mad maggie” Thatcher demand I be found guilty of a crime for her own selfish reasons (selling off of British Telecom).

As it was the advice of someone a little older and more worldly wise and my own bloody minded stubbornness stopped my walking into a trap. Shortly there after two people I was on first name terms with who had become aware of another VT Vulnerability decided I was wrong about entrapment. They were arrested, and found guilty and could have lost everything. Fortunately one worked for a magazine publisher who payed to take the appeals to the then highest court in the land, who through it in Mad Maggie’s face.

Since then I’ve gone other ways to release security vulnerabilities. And kept below the radar.

There are still way too many not honouring bug bounties or diddling down to less than pocket change and reaching for lawyers.

So my point of view for such people is,

“Scr3w Y0u, M4x P41n to head your way”

Is the best way to deal with them as it’s the only behaviour they understand.

The EU kind of proved my point some years back with fines at 4% or more of global income… How Google and other big Silicon Valley Corps responded tells you what the likes of Google management actually respect.