Researcher argues public 0-day disclosure beats selling or using them
Original title: "Malicious" public disclosure is a lot better than other ways of misusing 0-days (Was: [oss-security] Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven))
Aaron Rainbolt's oss-security reply prefers publication over sale or weaponization, but the post is cut off.
In an oss-security reply posted November 9, Aaron Rainbolt argues that someone who knows a zero-day and intends to act maliciously would do less harm by publishing it than by selling or weaponizing it. The message is a comment on disclosure ethics, not a vulnerability write-up. The available text is cut off and does not describe the referenced Home Assistant issue.
Unconfirmed: The snippet is incomplete and does not establish any facts about the referenced Home Assistant issue.
- The post says public disclosure is preferable to selling a zero-day.
- It also says publication is preferable to the finder weaponizing the flaw.
- The reply does not include technical details of the referenced issue.
From the original article
Posted by Aaron Rainbolt on Nov 09 I mean, if someone with knowledge of a 0-day decides to act maliciously, I'd much rather them do so by making said 0-day public than by selling it to someone or weaponizing it themselves. If I could encourage everyone in the world with knowledge of a 0-day and desire to act maliciously to post it publicly instead of doing anything worse, I would in a heartbeat.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.