Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

kerenskiy · 1789703213 · focus · HN ↗
$6 500 bounty for this is a joke. The black market price would be smth like $6 500 000 or more
1. tptacek · 1789703827 · focus · HN ↗
  There is probably no black market for this at all.
  <a href="https://news.ycombinator.com/item?id=43025038">https://news.ycombinator.com/item?id=43025038
  1. parhamn · 1789704678 · focus · HN ↗
    > Valuations for server-side vulnerabilities are low, because vendors don't compete for them.
    Why don't they?
    devmor · 1789705902 · focus · HN ↗
    Because as soon as they are patched, they are worthless.
    People pay for vulnerabilities because they want to exploit them - if there’s a limited window, there’s limited demand.
    Even if there’s something worth a lot behind the exploit, a potential criminal would be better off obtaining whatever that is and selling it instead.

Unofficial Hacker News client; not affiliated with Y Combinator.