5 ms·

No good deed goes unpunished. Kid should have just sold his hack to the highest bidder and skipped the country. Denounce me as unethical as all you want but hi

by IIAOPSW 10y ago

No good deed goes unpunished. Kid should have just sold his hack to the highest bidder and skipped the country. Denounce me as unethical as all you want but his situation would be objectively better if he hadn't cooperated with the authorities.

eximius 10y ago
I can't downvote but this is a terrible attitude.
- brhsiao 10y ago
  To be fair, I can sympathize with OP's sentiment; why offer help to someone who not only doesn't want but will actively prosecute you for it? I don't agree, but I could imagine feeling this way in another universe.
  - eximius 10y ago
    Not offering help is one thing. Selling a hack against someone is actively hurting them.
- artmageddon 10y ago
  It's also a reprehensible response from the authorities, too. IMO they're in the wrong much more so than the one who discovered the vulnerability.
  - eximius 10y ago
    Both sides can be wrong. I was simply pointing out that harming them by selling the hack because they would react poorly if you told them about it is a terrible plan.
- bsder 10y ago
  > I can't downvote but this is a terrible attitude. While I'm not down with selling the hack, not interacting with police is always good advice. It's shown over and over again that official contact with the police rarely has good results, at best has neutral results, and sometimes has VERY bad results.
  - eximius 10y ago
    I was referring to the 'the kid who did a good thing should have made himself explicitly a criminal' part.
- fractallyte 10y ago
  Why is this being criticized (by downvoting)? This absolutely is a wrong attitude. The path of least resistance is mutely accepting that it's a bad idea to talk to police, or otherwise engage with authorities. Those who hold so much power over our lives must be held to much higher standards: of responsibility, ethics, and behavior. If you want change, take the path of maximum resistance.
zzzcpan 10y ago
It's not unethical. One has to be very naive to cooperate with the authorities.
- yompers888 10y ago
  I'm hoping you're saying that parent's statement was not unethical (which of course it's not), rather than saying that the course of action he mentioned is ethical. Your second statement roughly mirrors the parent comment in saying that the guy would have been served better by selling the vulnerability, but surely you don't believe that that's the only criterion for determining if something is ethical, right? Do you have in mind a buyer who would make such a sale ethical? I would imagine intelligence agencies of major European powers, as well as the US and Russia, as the nation-state buyers, plus organized crime as another possible buyer. Among that field of upstanding people, who do you imagine this exploit could be sold to without clearly and knowingly contributing to massively unethical operations? Perhaps the NSA wouldn't be too terrible a result, because they would just use it to watch everyone rather than cause instability and threaten officials, but for that extra potential it seems like organized crime would be the bigger buyers. Or do you excuse everyone so long as they're not the final link in the chain, the one firing the gun? I hope that I've just written all of this out of a misunderstanding of your comment, because in no world is selling this vulnerability ethical. If Slovenia were a huge liability, likely to start World War III at any time, maybe, but that's just not the case.
  - vbezhenar 10y ago
    Selling vulnerability is not ethical. Opening yourself to police is just stupid. It would be ethical to report about vulnerability but without disclosing your name. And if it won't fixed, disclose it at public.
  - zzzcpan 10y ago
    > Among that field of upstanding people, who do you imagine this exploit could be sold to without clearly and knowingly contributing to massively unethical operations? I imagine state actors as the most likely buyers and way worse offenders, than organized crime. In the world, you believe in, it might be unethical to sell to them. In the world, where the state actors are the enemies of the people and the enemies of each other, it might not, but passively not doing anything might be.
qb45 10y ago
> Kid should have just sold his hack to the highest bidder Really? If the thing is used for anything important, just sell the intercepted data on darknet :) And it seems this was passive reception of radio traffic - it'd take them a while to find him. The whole story just illustrates the danger of doing security research in the open. If he tipped them anonymously, he could simply pass the news to the media after a month and they'd have to shut up and fix their shit. I once refrained from reporting a web vuln for similar reason - I didn't trust the owner to handle this professionally and, unfortunately, I didn't use tor because I attempted the hack just for fun wanting to see how they are protected from that - turns out, they weren't at all.

by IIAOPSW 10y ago

eximius 10y ago

I can't downvote but this is a terrible attitude.

brhsiao 10y ago
To be fair, I can sympathize with OP's sentiment; why offer help to someone who not only doesn't want but will actively prosecute you for it? I don't agree, but I could imagine feeling this way in another universe.
- eximius 10y ago
  Not offering help is one thing. Selling a hack against someone is actively hurting them.
artmageddon 10y ago
It's also a reprehensible response from the authorities, too. IMO they're in the wrong much more so than the one who discovered the vulnerability.
- eximius 10y ago
  Both sides can be wrong. I was simply pointing out that harming them by selling the hack because they would react poorly if you told them about it is a terrible plan.
bsder 10y ago
> I can't downvote but this is a terrible attitude. While I'm not down with selling the hack, not interacting with police is always good advice. It's shown over and over again that official contact with the police rarely has good results, at best has neutral results, and sometimes has VERY bad results.
- eximius 10y ago
  I was referring to the 'the kid who did a good thing should have made himself explicitly a criminal' part.
fractallyte 10y ago
Why is this being criticized (by downvoting)? This absolutely is a wrong attitude. The path of least resistance is mutely accepting that it's a bad idea to talk to police, or otherwise engage with authorities. Those who hold so much power over our lives must be held to much higher standards: of responsibility, ethics, and behavior. If you want change, take the path of maximum resistance.

zzzcpan 10y ago

It's not unethical. One has to be very naive to cooperate with the authorities.

yompers888 10y ago
I'm hoping you're saying that parent's statement was not unethical (which of course it's not), rather than saying that the course of action he mentioned is ethical. Your second statement roughly mirrors the parent comment in saying that the guy would have been served better by selling the vulnerability, but surely you don't believe that that's the only criterion for determining if something is ethical, right? Do you have in mind a buyer who would make such a sale ethical? I would imagine intelligence agencies of major European powers, as well as the US and Russia, as the nation-state buyers, plus organized crime as another possible buyer. Among that field of upstanding people, who do you imagine this exploit could be sold to without clearly and knowingly contributing to massively unethical operations? Perhaps the NSA wouldn't be too terrible a result, because they would just use it to watch everyone rather than cause instability and threaten officials, but for that extra potential it seems like organized crime would be the bigger buyers. Or do you excuse everyone so long as they're not the final link in the chain, the one firing the gun? I hope that I've just written all of this out of a misunderstanding of your comment, because in no world is selling this vulnerability ethical. If Slovenia were a huge liability, likely to start World War III at any time, maybe, but that's just not the case.
- vbezhenar 10y ago
  Selling vulnerability is not ethical. Opening yourself to police is just stupid. It would be ethical to report about vulnerability but without disclosing your name. And if it won't fixed, disclose it at public.
- zzzcpan 10y ago
  > Among that field of upstanding people, who do you imagine this exploit could be sold to without clearly and knowingly contributing to massively unethical operations? I imagine state actors as the most likely buyers and way worse offenders, than organized crime. In the world, you believe in, it might be unethical to sell to them. In the world, where the state actors are the enemies of the people and the enemies of each other, it might not, but passively not doing anything might be.

qb45 10y ago

> Kid should have just sold his hack to the highest bidder Really? If the thing is used for anything important, just sell the intercepted data on darknet :) And it seems this was passive reception of radio traffic - it'd take them a while to find him. The whole story just illustrates the danger of doing security research in the open. If he tipped them anonymously, he could simply pass the news to the media after a month and they'd have to shut up and fix their shit. I once refrained from reporting a web vuln for similar reason - I didn't trust the owner to handle this professionally and, unfortunately, I didn't use tor because I attempted the hack just for fun wanting to see how they are protected from that - turns out, they weren't at all.