I think different standards can apply.
You should want to know avenues of exploit so you can be defensive with security. You have little control over the offensive side of vulnerability exploitation.
Both lines of research are limited by some sense of waste: in time or money.
When should you stop? When some acceptable standard is reached and a certain amount of risk is accepted.
In the case of GoF, if it wasn't somehow profitable, then the research would likely cease to exist.
[–] estearum 19 hours ago
[–] poopingatwork 18 hours ago
You should want to know avenues of exploit so you can be defensive with security. You have little control over the offensive side of vulnerability exploitation.
[–] estearum 15 hours ago
[–] poopingatwork 14 hours ago
Both lines of research are limited by some sense of waste: in time or money.
When should you stop? When some acceptable standard is reached and a certain amount of risk is accepted.
In the case of GoF, if it wasn't somehow profitable, then the research would likely cease to exist.