Vendors who pay bounties often restrict public disclosure, and the professional value obtained from being able to talk about the research you do may be worth significantly more than the payout

> Vendors who pay bounties often restrict public disclosure, and the professional value obtained from being able to talk about the research you do may be worth significantly more than the payout

Professional value that doesn't translate into money, do you mean? How do you categorise that?

I take the "professional value" to mean essentially putting it on your resume, gaining publicity by blogging about it, getting conference organizers to let you give a talk about it, etc., all of which may ultimately increase the money you can earn doing computer security.

Ethics aside, there are many thing that move people, and it's not always money. For instance, selling the vulnerability means the author wouldn't have been able to tell their story.

Because even if I remove ethics, I can't find a reason for doing something like that.

For me, doing the right thing is beyond all these things, and I don't care about money beyond buying the necessities I need.

> I can't find a reason for doing something like that.

Money often starts out as necessity or one of it's close cousins. If I were 1) 8k miles away from my target, 2) in a region with more internet access than employment prospects and 3) needed to eat, I can see a path to profitable disclosure.

> For me, doing the right thing is beyond all these things,

This can be a luxury. After a year or 3 of kids in and out of hunger, what's right can get reframed.

> and I don't care about money beyond buying the necessities I need.

Getting beyond that is the thing.

> For me, doing the right thing is beyond all these things

That...is ethics, no?

Ethics and character, yes, and an attitude towards life that doesn't regard money as the deeper meaning of everything.

Ethics aside, what is characterful about saying no to money? Should I say no to my salary for character reasons?

There's a difference between doing your job and earning money as a result vs. finding keys to someone's house and selling said keys to the highest bidder.

Yes: ethics.

Some of us can get there without the organized principles simply with empathy. It's even deeply selfish in it's own way.

Ethics is our answer for those that can't.

I haven't encountered people whose empathy is so perfectly aligned with ethics that they don't need to be taught anything, but I suppose these perfectly selfless people might exist.

However of course in reality, empathy only gets you so far. Should you feel empathy for a CSA consumer because their feelings are important too? Do you empathise with their feelings?

It's true, empathy is a thing worked on, so is ethics by the way.

> but I suppose these perfectly selfless people might exist

I don't suppose you read what I typed. Empathy is not the setting of self aside, but the experience of feeling what someone else would in a given scenario. It is deeply selfish.

I would also say it is a prerequisite for an organized system of ethics.