OSNews

When you talk about a market for bugs and exploits, the detail is that the ONLY market for these is the criminal market. Period.

If there were no criminal element to exploit these defects, for criminal purposes, then if you went to the developer to sell the bug and tried to sell the work back to them, there would be no urgency to solve the problem.

Because the fact is, these bugs do not effect the overall user experience of the software. Rather they affect the security of the software and underlying system. Because there is a criminal element out there willing to leverage these exploits, the exposure of the exploits pose a real threat to the community and userbase at large.

So, that brings us to the value of these exploits. As a purveyor of the exploit information, there is only one legitimate market for it, one, perhaps, semi-legitimate, and an illegitimate market.

The only legitimate market is the vendor, so they can repair the defect, which arguably is the only "good" use of the information.

The "semi-legitimate" market may be State agencies, such as Intelligence or Law Enforcement agencies that might enjoy leveraging such flaws in order to further their covert operations. Obviously this market can be viewed through tinted glasses as to whether these are a "good" or "bad" use of this information.

Finally, the illegitimate market, which is the criminal one. This shouldn't even be a consideration, but obviously it is.

However, only by holding the existence and potential release of the information to the criminal market does the information offer any "real" value. The "IE bug is worth 10 times the Safari bug" is indicative of this, because the ramifications of bug "getting in to the wrong hands" is so much more dire.

If releasing it to the criminal market is NOT an option, then it's back to "security through obscurity". Save, now the criminal market may be aware that SOME flaw exists, while not knowing what it is, or perhaps not even having the expertise to exploit it.

However, it can be argued that the more skilled the investigator needs to be, and the more difficult it is to discover and leverage the exploit, the more "obscurity" there is to the bug. And it's arguable that these "really hard" bugs found by "really talented" people are less likely to be exploited due to their difficulty. That can actually LOWER the "value" of the knowledge, since the value is how likely the exploit will be used "in the wild".

It's all about risk and mitigation. While there is the search for perfection, and completely bug free and safe software, there's also the basic economics of risk/reward and return on value.

The more obscure, and the more difficult an exploit is, the less value there is to the vendor because of the lower risk of actual exploit -- assuming the knowledge remains secret with no threat of it being exposed to the criminal market.

But if you are using the potential of the criminal market getting the information to inflate the "price", that's effectively blackmail. Because the criminal market is what truly values these exploits, as they profit the most from them.

So, it really comes down to the person with the information and their character as to how they value the exploit.