Hacker News new | past | comments | ask | show | jobs | submit | secres's comments login

Since the rules change (i.e. become easier) each day, the day number gives you some indication of the relative difficulty in performing the exploit, even though the exploits themselves are prepared in advance:

http://cansecwest.com/post/2009-03-18-01:00:00.PWN2OWN_Final...


Charlie has actually written about this issue before in a more academic context:

weis2007.econinfosec.org/papers/29.pdf

Based on the limited data in the paper, it seems that it's the government rather than the vendors that is actually setting the price in the legitimate market, at least for high quality exploits.

I think the X*(billing rate) calculation ignores the risk that the researcher took. It's a little like saying that a startup should be worth exactly the amount of money that has been invested in it.


I will go and read the paper. Thanks for the pointer.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: