WabiSabiLabi
My own personal information agent, Seth Lopez, found a site and emailed the URI to me. He really likes it when I say URI instead of URL, but whatever. The site is called WabiSabiLabi and it looks to be a Swiss site that purports to be a marketplace for Security Research, aka 0-day exploitz. The marketplace is run by WSLabi, which claims it’s a lot of things, including a Security Research Lab.
It looks like the blog popped into existence in April, and everything else appeared last week.
WSLabi state, on their homepage, “If the world must become a safer place, the first part of the recipe is simple: to provide a better rewarding for the security researchers, organising an efficient and transparent marketplace, here to maximise the results of their efforts.” Sounds like they like efficiency and transparency, which is a good start. Also on their ethics page, it says, “We require non-anonymity from buyers and sellers alike. The stakes are just too high at this point in history.” Sounds great!
Moving on to the signup page it says, “ATTENTION! In order to be able to access the full marketplace services you will be asked to fax us your id card and your telephone number.”
Groovy. So let’s see who I am going to be sending my id card to and giving my telephone number. Their WHOIS reads like this:
Registration Private
(480) 624-2599 Phone
(480) 624-2599 Fax
DomainsByProxy.com
15111 N. Hayden Rd., Ste 160, PMB 353
Scottsdale, Arizona 85260
United States
wabisabilabi.com@domainsbyproxy.com
Not exactly transparent. Domains By Proxy (a division of GoDaddy) is the private registrar. The IP address of the website is a GoDaddy owned IP address, so the site is hosted by GoDaddy as well.
Domains By Proxy has a tagline, “Your identity is nobody’s business but ours.” I don’t see how this fits in exactly with WabiSabiLabi’s requirement that you positively identify yourself to them in order to participate in their online marketplace. Maybe the stakes are too high? I should send them a copy of my ID? I don’t even know who these people are. There is NO information about who is running the site or the marketplace, just a phone number and mailing address in Switzerland. This aerial view of their address is all I have to go on.
Not impressed. We’ll see how it pans out over time.