9 ms·

Ethical considerations of access to the HackerOne community

200 points by waffle_ss 9y ago

Animats 9y ago
Coming soon, a public market in bugs? How soon can I buy futures in Windows vulnerabilities?
- nickpsecurity 9y ago
  Nah, the bugs are already traded underground. The nature of the situation means the bets might be done underground, too.
  - tptacek 9y ago
    To settle those bets, you have to have a reliable spot price. The only way to know how much a Windows RCE is worth is to actually sell it.
    - nickpsecurity 9y ago
      Good point.
      - genericpseudo 9y ago
        Sounds like a job for Markit Group (https://en.wikipedia.org/wiki/Markit https://en.wikipedia.org/wiki/Markit)...
- tptacek 9y ago
  The bugs you're talking about are already worth 5-6 figures. Their prices are so volatile and their outlook is complicated enough that no sane person would enter into a forward contract on one.
  - SimbaOnSteroids 9y ago
    Who said OP was a sane person?
    - sctb 9y ago
      Personal jibes like this are not welcome on HN.
- saganus 9y ago
  This sounds like a very interesting theme for a novel (or novels). Could even make it kinda like a subgenre of cyberpunk or like a modern version of it at least. I mean, I can imagine some interesting plots regarding people trading bugs in an underground market, where the product is something that can be more dangerous than a gun, but it fits in a USB drive. Maybe they can even be based on real stories, just changed a bit to protect identities and such. However I do think you would need to be fairly involved in this world to be able to write something interesting and based on something real. Hopefully someone involved in the security world gets bitten by the writer's bug and writes something some day. I know Brian Krebs has written interesting articles but a book would be very cool.
munchbunny 9y ago
Good to see that they are taking a clearly communicated, carefully considered stance on a messy ethical issue. I don't really have a strong opinion on this case, but I think it's refreshing that HackerOne is dealing with a case with no clear best answer in a principled way.
- 21 9y ago
  Selecting your customers is always tricky. On one hand your right to run your business as you see fit and respecting your principles. On the other hand you have discrimination of all kinds. Think about the recent cases of a small baker with strong religious views refusing to create cakes for gay couples. Think about CloudFlare protecting ISIS sites.
  - derefr 9y ago
    To me, it seems to come down to: 1. there are evil people, but 2. those people frequently have more social power than nice people, and 3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.") If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers" built into your system will mostly be used by those with power against those without it, regardless of which side is "correct." So: If you let people speak freely, the powerful will shout down the powerless. But if you let people silence others, then the powerful will silence the powerless. Morally, it really comes down to a choice of which kind of hammer hurts wronged innocent powerless people the least. (Which can often mean offering no hammer that can truly be used to "deal with" obviously-evil people.)
    - traverseda 9y ago
      Discussion in response to this comment elsewhere. https://www.reddit.com/r/rational/comments/69f7nw/d_friday_offtopic_thread/dh6k79r/ https://www.reddit.com/r/rational/comments/69f7nw/d_friday_o...
    - tptacek 9y ago
geppeto 9y ago
I looked through the task manager of a corporate issued laptop and saw tasks belonging to very similar companies, as part of the disk image IT makes. The corporation likely has a license for the software, as well as conditions for all their employees to expect monitoring. A formalized bug bounty program would enable the software producer to have secure software. Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is. Is all monitoring software now banned from HackerOne under the guise of a moral high ground HackerOne just created?
- arice 9y ago
  That's helpful feedback on missing context from our post. Thanks. This series by VICE articulates the sometimes subtle distinctions between legitimate monitoring software built for enterprises and parents vs this particular software (which they deem "stalkerware"). https://motherboard.vice.com/en_us/article/inside-stalkerware-surveillance-market-flexispy-retina-x https://motherboard.vice.com/en_us/article/inside-stalkerwar...
  - geppeto 9y ago
    There are a lot of dubious companies on HackerOne. Why did taking a stance on this one have a perceived more positive outcome than taking any stance at all? Pretty much zero of the companies on HackerOne are part of any social responsibility index, shariah compliant index, or trendy b-corporation index. And even in the non-zero rebuttal, the vast majority can have entire dissertations written about weighing the ethical considerations for doing any business with them. So why even make a stance at all? The time it takes for the arbitrary nature of your ethical decisions to become apparent is simply longer than it will take for your runway to deplete.
    - Chris2048 9y ago
      shariah compliant index? Did you include that just to question the objective nature of morality?
tetrep 9y ago
> Companies should defer judgement to the courts rather than make arbitrary moral judgements. Uh, no. Please no. I do not want the courts to arbitrate morality. That's a far far far more dystopian world than one where corporations do (supposing I accept their false dilemma). Companies can, in theory, be created by any person, with any moral alignment. That is not the case with governments (minus authoritarian ones, which function in the context of moral-defining as more or less the same as a company). Additionally, deferring to the courts also leads to the ever terrible "this is moral because it is legal" and "this is immoral because it is illegal." There is not a correct authority on morality to which you can defer. You cannot offload such decisions and wash your hands. Any moral decision you make, including deferring to some other moral-decider, is entirely your responsibility. Note: I'm doing the naughty thing of morals=ethics. I know this is pedantically not the case, but I'm 99% sure that is what the article means. And, in general, this is also what everyone means outside of targeted discussions. > ...if someone is infected with spyware they're probably better off infected with secure spyware. I think this is a great ethical issue within the security community. There's many arguments against working for a company you have ethical disagreements with, but that becomes much more grey when it comes to security. Sure I might not agree with the mass surveillance of the government, but wouldn't I rather help the NSA not leave piles of malware sitting around on C&C servers than let it be exposed to even more malicious actors? Security could use a hippocratic oath. > FlexiSPY has not published a vulnerability disclosure policy or committed to no legal action against hackers. Both protective steps would be required should their program be hosted on HackerOne. I'm surprised HackerOne doesn't have a policy surrounding this already. Are hackers who submit issues to HackerOne not protected? > We will not take action against them based exclusively on moral judgements. Hooray, kinda. I think this is a maxim that HackerOne could extend to not making moral judgements relevant at all, and to instead institute policies that reflect HackerOne's current morals. This increases transparency and allows HackerOne to say "We reject you because your company's goals/actions/whatever explicitly contradict our policy that everyone wear unicorn hats on Tuesdays". > Their business conduct is not in line with our ambition to build a safe and sound internet where the sovereignty and safety of each participant is respected. I think now would be a good time for HackerOne to write this stuff down. A very brief look at their site and the only thing I can see relating to this is the tagline "Make the internet safer together." From which sovereignty implications can be drawn, but having such policies explicitly stated and publicly available not only allows for transparency in decisions, but also works as an advertisement, "Oh hey, this company wants to protect my digital sovereignty, neat!"
thraway2016 9y ago
While I applaud this move, I suspect H1 will continue servicing government and law enforcement clients of all kinds. A consistently applied policy would see ties with ALL surveillance entities severed.
- sqeaky 9y ago
  This is going to earn me huge downvotes, but not all surveillance is equally illegal or equally unethical. To me it seems that groups that run spy satellites and look out for nuclear missile launches are in a different ethical category than people who make software for perpetuating domestic abuse. Clearly, I picked two extremes. That was just to show that not all surveillance is equally bad and that some can be better than others. I will leave other kinds of surveillance are just and unjust for other discussion.
  - nvahalik 9y ago
    > people who make software for perpetuating domestic abuse That's a bit like saying the authors of Wordpress perpetuate fake news. I've used similar products to monitor usages on teenager's devices and I can attest to their usefulness far beyond "perpetuating domestic abuse".
    - sqeaky 9y ago
      The makers of wordpress don't say "great for fake news", but the makers of this software say "great for watching your partner". They advertise reading your wife's SMS messages as a feature! That and Wordpress would only be so-so for making a fake news page, I mean it could work but you would be a competitive disadvantage.
    - Houshalter 9y ago
      They literally make tools to spy on people without their knowledge. How is there any situation where that is ok outside of law enforcement? Parents monitoring their kids don't need to be secret about it. (And to be honest even that sounds super creepy. I thank god my parents didn't know my complete internet history and track my every movement 24/7. I can only imagine the helicopter parenting horrors that modern technology is enabling.) Hell this software goes well beyond that. It records every text, every phone call, every keypress, hijacks the webcam and microphone to secretly record them, etc. It's extremely common for domestic abusers to use this. I'm having trouble finding it, but I recall in article on HN that domestic abuse shelters are requiring victims to turn off their phones because it's become a problem.
phamilton 9y ago
> On balance, if someone is infected with spyware they're probably better off infected with secure spyware. That's a pretty amazing sentence. It illustrates just how messy this whole situation is.
revmoo 9y ago
good.
bolololo12 9y ago
HackerOne should change it's font color because I can barely read how the "change" the world.
ukyrgf 9y ago
That font-weight/color is nearly unreadable on my Windows 10 machine.
sasas 9y ago
Patrick Grey interviewed the CTO of hacker one in the latest riskybiz security podcast [1] on this topic. Patrick is a friend of Alex, but that doesn't stop a hearty debate. Highly recommended podcast for those interested in infosec in general. [1] https://risky.biz/ https://risky.biz/

200 points by waffle_ss 9y ago

Animats 9y ago

Coming soon, a public market in bugs? How soon can I buy futures in Windows vulnerabilities?

nickpsecurity 9y ago
Nah, the bugs are already traded underground. The nature of the situation means the bets might be done underground, too.
- tptacek 9y ago
  To settle those bets, you have to have a reliable spot price. The only way to know how much a Windows RCE is worth is to actually sell it.
  - nickpsecurity 9y ago
    Good point.
    - genericpseudo 9y ago
      Sounds like a job for Markit Group (https://en.wikipedia.org/wiki/Markit https://en.wikipedia.org/wiki/Markit)...
tptacek 9y ago
The bugs you're talking about are already worth 5-6 figures. Their prices are so volatile and their outlook is complicated enough that no sane person would enter into a forward contract on one.
- SimbaOnSteroids 9y ago
  Who said OP was a sane person?
  - sctb 9y ago
    Personal jibes like this are not welcome on HN.
saganus 9y ago
This sounds like a very interesting theme for a novel (or novels). Could even make it kinda like a subgenre of cyberpunk or like a modern version of it at least. I mean, I can imagine some interesting plots regarding people trading bugs in an underground market, where the product is something that can be more dangerous than a gun, but it fits in a USB drive. Maybe they can even be based on real stories, just changed a bit to protect identities and such. However I do think you would need to be fairly involved in this world to be able to write something interesting and based on something real. Hopefully someone involved in the security world gets bitten by the writer's bug and writes something some day. I know Brian Krebs has written interesting articles but a book would be very cool.

munchbunny 9y ago

Good to see that they are taking a clearly communicated, carefully considered stance on a messy ethical issue. I don't really have a strong opinion on this case, but I think it's refreshing that HackerOne is dealing with a case with no clear best answer in a principled way.

21 9y ago
Selecting your customers is always tricky. On one hand your right to run your business as you see fit and respecting your principles. On the other hand you have discrimination of all kinds. Think about the recent cases of a small baker with strong religious views refusing to create cakes for gay couples. Think about CloudFlare protecting ISIS sites.
- derefr 9y ago
  To me, it seems to come down to: 1. there are evil people, but 2. those people frequently have more social power than nice people, and 3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.") If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers" built into your system will mostly be used by those with power against those without it, regardless of which side is "correct." So: If you let people speak freely, the powerful will shout down the powerless. But if you let people silence others, then the powerful will silence the powerless. Morally, it really comes down to a choice of which kind of hammer hurts wronged innocent powerless people the least. (Which can often mean offering no hammer that can truly be used to "deal with" obviously-evil people.)
  - traverseda 9y ago
    Discussion in response to this comment elsewhere. https://www.reddit.com/r/rational/comments/69f7nw/d_friday_offtopic_thread/dh6k79r/ https://www.reddit.com/r/rational/comments/69f7nw/d_friday_o...
  - tptacek 9y ago

geppeto 9y ago

I looked through the task manager of a corporate issued laptop and saw tasks belonging to very similar companies, as part of the disk image IT makes. The corporation likely has a license for the software, as well as conditions for all their employees to expect monitoring. A formalized bug bounty program would enable the software producer to have secure software. Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is. Is all monitoring software now banned from HackerOne under the guise of a moral high ground HackerOne just created?

arice 9y ago
That's helpful feedback on missing context from our post. Thanks. This series by VICE articulates the sometimes subtle distinctions between legitimate monitoring software built for enterprises and parents vs this particular software (which they deem "stalkerware"). https://motherboard.vice.com/en_us/article/inside-stalkerware-surveillance-market-flexispy-retina-x https://motherboard.vice.com/en_us/article/inside-stalkerwar...
- geppeto 9y ago
  There are a lot of dubious companies on HackerOne. Why did taking a stance on this one have a perceived more positive outcome than taking any stance at all? Pretty much zero of the companies on HackerOne are part of any social responsibility index, shariah compliant index, or trendy b-corporation index. And even in the non-zero rebuttal, the vast majority can have entire dissertations written about weighing the ethical considerations for doing any business with them. So why even make a stance at all? The time it takes for the arbitrary nature of your ethical decisions to become apparent is simply longer than it will take for your runway to deplete.
  - Chris2048 9y ago
    shariah compliant index? Did you include that just to question the objective nature of morality?

tetrep 9y ago

> Companies should defer judgement to the courts rather than make arbitrary moral judgements. Uh, no. Please no. I do not want the courts to arbitrate morality. That's a far far far more dystopian world than one where corporations do (supposing I accept their false dilemma). Companies can, in theory, be created by any person, with any moral alignment. That is not the case with governments (minus authoritarian ones, which function in the context of moral-defining as more or less the same as a company). Additionally, deferring to the courts also leads to the ever terrible "this is moral because it is legal" and "this is immoral because it is illegal." There is not a correct authority on morality to which you can defer. You cannot offload such decisions and wash your hands. Any moral decision you make, including deferring to some other moral-decider, is entirely your responsibility. Note: I'm doing the naughty thing of morals=ethics. I know this is pedantically not the case, but I'm 99% sure that is what the article means. And, in general, this is also what everyone means outside of targeted discussions. > ...if someone is infected with spyware they're probably better off infected with secure spyware. I think this is a great ethical issue within the security community. There's many arguments against working for a company you have ethical disagreements with, but that becomes much more grey when it comes to security. Sure I might not agree with the mass surveillance of the government, but wouldn't I rather help the NSA not leave piles of malware sitting around on C&C servers than let it be exposed to even more malicious actors? Security could use a hippocratic oath. > FlexiSPY has not published a vulnerability disclosure policy or committed to no legal action against hackers. Both protective steps would be required should their program be hosted on HackerOne. I'm surprised HackerOne doesn't have a policy surrounding this already. Are hackers who submit issues to HackerOne not protected? > We will not take action against them based exclusively on moral judgements. Hooray, kinda. I think this is a maxim that HackerOne could extend to not making moral judgements relevant at all, and to instead institute policies that reflect HackerOne's current morals. This increases transparency and allows HackerOne to say "We reject you because your company's goals/actions/whatever explicitly contradict our policy that everyone wear unicorn hats on Tuesdays". > Their business conduct is not in line with our ambition to build a safe and sound internet where the sovereignty and safety of each participant is respected. I think now would be a good time for HackerOne to write this stuff down. A very brief look at their site and the only thing I can see relating to this is the tagline "Make the internet safer together." From which sovereignty implications can be drawn, but having such policies explicitly stated and publicly available not only allows for transparency in decisions, but also works as an advertisement, "Oh hey, this company wants to protect my digital sovereignty, neat!"

thraway2016 9y ago

While I applaud this move, I suspect H1 will continue servicing government and law enforcement clients of all kinds. A consistently applied policy would see ties with ALL surveillance entities severed.

sqeaky 9y ago
This is going to earn me huge downvotes, but not all surveillance is equally illegal or equally unethical. To me it seems that groups that run spy satellites and look out for nuclear missile launches are in a different ethical category than people who make software for perpetuating domestic abuse. Clearly, I picked two extremes. That was just to show that not all surveillance is equally bad and that some can be better than others. I will leave other kinds of surveillance are just and unjust for other discussion.
- nvahalik 9y ago
  > people who make software for perpetuating domestic abuse That's a bit like saying the authors of Wordpress perpetuate fake news. I've used similar products to monitor usages on teenager's devices and I can attest to their usefulness far beyond "perpetuating domestic abuse".
  - sqeaky 9y ago
    The makers of wordpress don't say "great for fake news", but the makers of this software say "great for watching your partner". They advertise reading your wife's SMS messages as a feature! That and Wordpress would only be so-so for making a fake news page, I mean it could work but you would be a competitive disadvantage.
  - Houshalter 9y ago
    They literally make tools to spy on people without their knowledge. How is there any situation where that is ok outside of law enforcement? Parents monitoring their kids don't need to be secret about it. (And to be honest even that sounds super creepy. I thank god my parents didn't know my complete internet history and track my every movement 24/7. I can only imagine the helicopter parenting horrors that modern technology is enabling.) Hell this software goes well beyond that. It records every text, every phone call, every keypress, hijacks the webcam and microphone to secretly record them, etc. It's extremely common for domestic abusers to use this. I'm having trouble finding it, but I recall in article on HN that domestic abuse shelters are requiring victims to turn off their phones because it's become a problem.

phamilton 9y ago

> On balance, if someone is infected with spyware they're probably better off infected with secure spyware. That's a pretty amazing sentence. It illustrates just how messy this whole situation is.

revmoo 9y ago

good.

bolololo12 9y ago

HackerOne should change it's font color because I can barely read how the "change" the world.

ukyrgf 9y ago

That font-weight/color is nearly unreadable on my Windows 10 machine.

sasas 9y ago

Patrick Grey interviewed the CTO of hacker one in the latest riskybiz security podcast [1] on this topic. Patrick is a friend of Alex, but that doesn't stop a hearty debate. Highly recommended podcast for those interested in infosec in general. [1] https://risky.biz/ https://risky.biz/