alt Hacker NewsThat’s an unnecessarily rude response I think.
I detailed my logic above.
Additionally, part of my businesses remediation services include helping companies set up bug bounty programs. Giving researchers an incentive to report bugs for payouts instead of selling or exploiting them for profits is always the intended goal.
This is probably my highest-rated comment on HN:
https://news.ycombinator.com/item?id=43025038
It's the product of direct interviews with bounty people, FAANG/MAG7 blue teamers, and black market participants. If you want more, there's also an interview online that we did with Mark Dowd, who is one of the best known CNE vendors to the NATO IC. You can just Google [SCW Mark Dowd].
I'm happy to go into more detail, but, like I said, you didn't really respond to my comment in any way that I could expand on. Feel free to disagree with me in some kind of specific way.
This really is simple: if you work in this space, you already know that there's essentially no black market at all for serverside web bugs. But there's a $90k bounty for this one, and 5-figure bounties for others. Reconcile those two facts.