The Good, Bad and Ugly of Vulnerability Markets

This article discusses the expanding market for software vulnerabilities—covering public bug-bounty programs, private brokers, and black/gray markets—arguing that while such markets can incentivize security research and improve security, they also create serious ethical dilemmas and risks for IoT and cyber-physical systems; the author uses Stuxnet to illustrate unintended consequences and advocates supporting responsible, legitimate hacking and disclosure.