Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Market share has a factor, but its not always the commanding factor.

Take a look at https://zerodium.com/program.html

Apache and Nginx have a very similar market share. Nginx has higher share in top 10k websites, Apache has slightly higher share overall.

Yet Apache has over double the price as nginx exploits:

* Apache RCE 500k

* Nginx RCE 200k




If they both have similar market share, then that variable has been isolated and the conclusion that the cheaper exploit is the less secure is sound. When that variable has not been isolated, it's not possible to conclude that the difference in price is due to security and not due to the exploit affecting more people.

"The amounts paid by ZERODIUM to researchers to acquire their original zero-day exploits depend on the popularity and security level of the affected software/system, as well as the quality of the submitted exploit (full or partial chain, supported versions/systems/architectures, reliability, bypassed exploit mitigations, default vs. non-default components, process continuation, etc)."

So, if chrome, with ~65% of the market share had the same payout as firefox at ~4% of the market share, it would be fair to conclude it's less secure. However, we see 5x the payout and 16x the market share. Doesn't seem conclusive.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: