I was assuming web vulns found in Google´s Infrastructure, and not vulnerabilities in general as I imagine Google wouldn´t condone selling vulns on their systems to the highest bidder.
As far as crimes commited during the process of discovering the vuln itself, Google expressly authorizes security testing in the program: http://www.google.com/about/corporate/company/rewardprogram.html But for vulns in general, I totally agree with you. 2011/12/8 <[email protected]> > On Thu, 08 Dec 2011 14:24:21 -0300, Pablo Ximenes said: > > 2011/12/8 Michal Zalewski <[email protected]> > > > If you don't like it, let us know how to improve it. You also always > > > have the option of not researching vulnerabilities in these platforms; > > > going with the full-disclosure approach; or selling the flaws to a > > > willing third party. > > > Well, selling flaws to third parties might be considered a crime in some > > places, so I would be cautious with that approach. > > I suspect a large portion of the people who are selling flaws to third > parties > are not at all concerned about whether selling the flaw is a crime, as > often the > bigger question is how many crimes were committed in the discovery > process... >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
