Exploit Sales: The New Disclosure Debate

The security community is one that thrives on controversy, drama and debate. For years–decades, really–no topic satisfied this desire like vulnerability disclosure. Long after every possible argument had been forwarded and the horse was not just dead but buried and the grave covered by a strip mall, the debate has limped along, like Happy Days post-shark jump. Now comes the flood of bilious opinions regarding the commercial exploit market, a discussion that feels even more pointless than the disclosure debate because there’s absolutely nothing to debate.

In the beginning, the disclosure debate was just that, a debate. People with well-formed opinions based on their experiences with finding and publishing vulnerabilities, or, on the other end of the equation, dealing with those reports and fixing the bugs. Most researchers argued that they had the right to do what they wanted with the vulnerabilities they found. For a long time, researchers generally kept details private and dealt with the vendors in the background, only publishing the details when a fix was ready. There were exceptions, researchers who simply published what they found whenever they felt like it, either never notifying the vendor or doing so a day or two before they posted their advisories.