25 ms·

You assume that your own research machine can't be compromised, nor are the communication channels of the organization at fault. So, it won't be fixed. Hopefu

You assume that your own research machine can't be compromised, nor are the communication channels of the organization at fault. So, it won't be fixed. Hopefully only one or two people know about the same flaw you found... Oh, but you would know ahead of time if concrete physical harm could possibly come to the victim of an accident? Well good for you! You should probably be in charge of defending all infosec research, since apparently you can't be hacked.

tptacek 10y ago
Please do tell me about all the carnage you've averted by looking for, finding, and reporting vulnerabilities. Are there other slices of my time on this planet you also feel entitled to a share of? Would we all be better off if I went to work on a cat-sharing startup and spent all my spare time playing Dwarf Fortress? That way I wouldn't find anything, and you wouldn't have to worry about vulnerabilities anymore, right? I seriously don't understand the logic you're employing here.
- big_surprise 10y ago
  Then you misunderstood your own logical conclusion... You said (and I quote): Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? No. No, you can't. Unless you could convince me that my Dwarf Fortress skills have a similar magnitude of real-world affect as the vulnerabilities I've discovered on my own and decided to pocket for one reason or another.
  - tptacek 10y ago
    By your logic, I am better off not doing vulnerability research in my spare time --- as is virtually everybody else. How is that a good outcome?
    - big_surprise 10y ago
      No. By my logic, you are better off not doing vulnerability research in your spare time if you have to worry about the legal ramifications of your actions. The ethical conundrums are unavoidable, and those calculations are indeed difficult. The legal consequences are artifice, and by agreeing to those (while ignoring externalities and not going public), you are likely putting others at risk.
      - tptacek 10y ago
        Forget the legal consequences. Reporting vulnerabilities is work. By your logic, by doing some work in my spare time, I am morally obligated to do more work for others. I'm better off just picking something else to work on.
        big_surprise 10y ago
        Perhaps so... As long as you recognize that your work is inherently dual-use (it has effects beyond your initial intent), and you don't intentionally hide that fact from yourself or others, then I have no problem with what you do.
        tptacek 10y ago
        I feel like you have unusually strong feelings about this whose implications you might not have fully thought through.
        big_surprise 10y ago
        I feel the same about you.

tptacek 10y ago

Please do tell me about all the carnage you've averted by looking for, finding, and reporting vulnerabilities. Are there other slices of my time on this planet you also feel entitled to a share of? Would we all be better off if I went to work on a cat-sharing startup and spent all my spare time playing Dwarf Fortress? That way I wouldn't find anything, and you wouldn't have to worry about vulnerabilities anymore, right? I seriously don't understand the logic you're employing here.

big_surprise 10y ago
Then you misunderstood your own logical conclusion... You said (and I quote): Can't I just flip this around on you and say you have an ethical obligation to spend some of your time looking for vulnerabilities? No. No, you can't. Unless you could convince me that my Dwarf Fortress skills have a similar magnitude of real-world affect as the vulnerabilities I've discovered on my own and decided to pocket for one reason or another.
- tptacek 10y ago
  By your logic, I am better off not doing vulnerability research in my spare time --- as is virtually everybody else. How is that a good outcome?
  - big_surprise 10y ago
    No. By my logic, you are better off not doing vulnerability research in your spare time if you have to worry about the legal ramifications of your actions. The ethical conundrums are unavoidable, and those calculations are indeed difficult. The legal consequences are artifice, and by agreeing to those (while ignoring externalities and not going public), you are likely putting others at risk.
    - tptacek 10y ago
      Forget the legal consequences. Reporting vulnerabilities is work. By your logic, by doing some work in my spare time, I am morally obligated to do more work for others. I'm better off just picking something else to work on.
      - big_surprise 10y ago
        Perhaps so... As long as you recognize that your work is inherently dual-use (it has effects beyond your initial intent), and you don't intentionally hide that fact from yourself or others, then I have no problem with what you do.
        tptacek 10y ago
        I feel like you have unusually strong feelings about this whose implications you might not have fully thought through.
        big_surprise 10y ago
        I feel the same about you.