Speaker: Rebecca Slayton, Associate Professor of Science and Technology Studies, Cornell Bowers
Title: “No More Free Bugs”: The Co-Construction of Norms and Markets for Software Vulnerabilities
Time: 3-4 p.m.
Date: Oct. 21, 2026
Location: Computing and Information Science Building, Room 250
Click here to attend via Zoom
Abstract: In 2009, three cybersecurity workers launched the “no free bugs” campaign, arguing that companies should pay for information about vulnerabilities in their products. They framed the campaign as more than a self-interested search for money, arguing that if software producers offered payment, they would be “getting more vulnerabilities in their shipped products fixed and thereby better protecting users.” This paper examines how governments, corporations, and workers around the world sought to shape vulnerability disclosure norms and markets from the late 1990s to the mid-2010s. I pay special attention to the rise of public competitions such as Pwn2Own, where hackers were encouraged to stage spectacular demonstrations of previously-unknown vulnerabilities in exchange for cash prizes. I build on recent work on the history of ethical hacking (Goerzen and Coleman 2022; Bozzini 2025) and vulnerability markets (Ellis and Stevens 2022) in two ways.
First, I situate the rise of the public vulnerabilities markets in the context of a much older shadow market for vulnerabilities, one driven by primarily government intelligence agencies seeking to exploit rather than repair vulnerabilities. And second, I show how the rise of the public vulnerabilities market became a site of geopolitical competition and dispute. Vulnerability disclosure norms and markets entangled competition between and among workers, corporations, and nations. I argue that the resulting norms and markets produced security and insecurity unevenly, privileging the interests of corporations and governments over those of the general public.
Bio: Slayton’s research and teaching examine the relationships between and among risk, governance, and expertise, with a focus on international security and cooperation since World War II. Her first book, Arguments that Count: Physics, Computing, and Missile Defense, 1949-2012 (MIT Press, 2013), shows how the rise of a new field of expertise in computing reshaped public policies and perceptions about the risks of missile defense in the United States. Her second book project examines the historical emergence of cybersecurity expertise. This project was supported by a five-year National Science Foundation CAREER award, “Enacting Cybersecurity Expertise.” In 2019, Slayton was a recipient of the United States Presidential Early Career Award for Scientists and Engineers, for her NSF CAREER project.
