'Responsible disclosure' is probably one of the worst things to happen to the cyber-security industry, and the $100K carrot-on-a-stick is only going to make it worse.
Selling exploits to customers who don't intend on fixing the exploit (buying a hacker's silence) is exactly the nightmare that came to light regarding MS releasing exploit information to NSA prior to releasing publicly-available bugfixes, and these kinds of monetary incentives to the security community will only make things worse.
Selling exploits to customers who don't intend on fixing the exploit (buying a hacker's silence) is exactly the nightmare that came to light regarding MS releasing exploit information to NSA prior to releasing publicly-available bugfixes, and these kinds of monetary incentives to the security community will only make things worse.
Read more: https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales...
These exploits are effectively high-tech weaponry and they should be treated similarly.