Security Research and Blackmail

harryjohnston alerts us to a story picked up by a few bloggers in the security space. A Russian security research company, Gleg, has discovered a zero-day in the latest version of RealPlayer 11. But they won't reveal details to Real, or to CERT, despite repeated requests. Details are available only to their clients who pay a lot of money for early access to such knowledge. To describe Gleg's business model Daniweb rather cautiously puts forward the word "blackmail." The story was first exposed in Ryan Nariane's Securitywach blog.

Comments

Re:Intellectual Property

[jacquesm]

even fairer, they *did* release information, precisely one bit worth: is there an unpatched exploit in real ? the answer is 'yes'. So now all real has to do is get off it's ass and do its job *or* open source their code and we'll help them ;)