[Motorola Droid Maxx] samwathegreat:
Guys, the issue is going to be finding a DEV skilled enough to take the small amount of information we have about this vulnerability and actually make a tool that is able to exploit it.

Dan is extremely skilled at these reversing techniques, and has a new-found appreciation for the ethics surrounding vulnerability disclosure. As such, he has only given an overview of the vulnerability, without enough details to actually exploit it. (Per jcase, adequate details WERE indeed released to execute the exploit.) Someone in his skill level could make this happen, sure, but very few qualified individuals actually exist.

The problem is compounded by the fact that we have so many individuals in our community with such a low moral standard (and intellect) that Dan has been left with extreme distaste.

Consider that the last time Dan offered an extremely generous Bounty for a bootloader unlock (about $200 total is what he was asking for), once he released the exploit, only a very few of the pledgers actually kept their word. The rest had such an adolescent sense of "self entitlement" that they decided more-or-less "why should I pay him when I can just use his work, reap the benefits, and keep the money I had promised him for myself".

Not only does this create an overwhelming sense of 'disgust' for the community, but also outlines the lack-of-appreciation so many members have for the countless hours of research and hard work that goes into finding these vulnerabilities.

So take the actual amount that all of the bounty pledgers have promised, divide that by 4 or maybe 5, and that's what Dan might actually expect to receive for all the work he has put into this.

I can say from -personal experience- that this is the case. It is only compounded by the immature attitude of so many of these self-entitled individuals that make remarks like "This just looks like another case of 'look what I can do' without sharing it with anybody". This kind of attitude is not conducive to any developer actually wanting to release their work (yes, THEIR work - it does belong to them) to people with this type of attitude.

I do hope that Dan decides to either release additional details about the vulnerability, or an actual tool that is capable of exploiting it....but everyone keep in mind that it was members from OUR community that contributed to this problem.

Additionally, even when Dan released his last exploit, clearly explaining that it had been patched by recent updates and that if you have taken the recent updates, the tool will not work for you, his inbox was still flooded with messages from ungrateful people hounding him, demanding that he create a new exploit that will work with the new updates. His Github account was flooded with similar messages, as was his twitter account. Want to guess how many of those individuals were willing to actually donate to him for his efforts? Exactly ZERO (or very very close).

This is only going to become worse as security is further tightened, making the pool of individuals that are actually capable of finding these vulnerabilities smaller and smaller.

Just something to think about the next time you make a pledge to a bounty thread, and after the work is completed, decide that you don't need to follow-through. This is "biting the hand that feeds you", and you can expect it to come back and haunt you in the future (similar to what we are experiencing right now).

Dan isn't the only developer who has been treated this way, either. Our community has a reputation for lack-of-appreciation, plagiarism in the rooting scene, making un-realistic demands to generous, skilled Devs, etc. It really is sad.

So again, while I do hope that we are able to exploit this vulnerability and unlock our bootloaders, if Dan does decide to withhold the intricate details of this vulnerability (not release a tool), no one can blame him. At least no one who has any adult sense of ethics. We did this to ourselves...

Dan is *the man* - he is an extremely skilled individual and deserves the highest respect an individual can be given. In the past, however, he wasn't treated as such...

Just food for thought.