The doc (http://incolumitas.com/data/thesis.pdf http://incolumitas.com/data/thesis.pdf) does have a short section on ethics, but IMHO it completely misses the p

The doc (http://incolumitas.com/data/thesis.pdf http://incolumitas.com/data/thesis.pdf) does have a short section on ethics, but IMHO it completely misses the point of the ethical concerns in running unauthorized, non-sandboxed code on devices you don't own. Instead it justifies the research by saying the threat cannot be shown unless the vulnerability is exploited, which is true, but that fact does not justify the research. The acknowledgements mention 2 of the university advisers and a PyPi admin consented to the "notification program". Still, people with good intentions have been prosecuted and convicted for less. I would be very concerned for this student.