5 ms·

Selecting your customers is always tricky. On one hand your right to run your business as you see fit and respecting your principles. On the other hand you ha

by 21 9y ago

Selecting your customers is always tricky. On one hand your right to run your business as you see fit and respecting your principles. On the other hand you have discrimination of all kinds. Think about the recent cases of a small baker with strong religious views refusing to create cakes for gay couples. Think about CloudFlare protecting ISIS sites.

derefr 9y ago
To me, it seems to come down to: 1. there are evil people, but 2. those people frequently have more social power than nice people, and 3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.") If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers" built into your system will mostly be used by those with power against those without it, regardless of which side is "correct." So: If you let people speak freely, the powerful will shout down the powerless. But if you let people silence others, then the powerful will silence the powerless. Morally, it really comes down to a choice of which kind of hammer hurts wronged innocent powerless people the least. (Which can often mean offering no hammer that can truly be used to "deal with" obviously-evil people.)
- traverseda 9y ago
  Discussion in response to this comment elsewhere. https://www.reddit.com/r/rational/comments/69f7nw/d_friday_offtopic_thread/dh6k79r/ https://www.reddit.com/r/rational/comments/69f7nw/d_friday_o...
- tptacek 9y ago
  I understand what you're writing, and what HackerOne wrote, but to me it pretty much seems like "we won't run a security service for spyware companies". At Matasano, we wouldn't do work for the USG or arms manufacturers. We didn't have a coherent framework to fit that decision into. We just wouldn't do it. I worry that we may be overthinking things here.
  - derefr 9y ago
    I wasn't so much suggesting a decision-making framework, as a model that can be used to understand decisions people make intuitively. "Overthinking" is the whole point. :)
  - StavrosK 9y ago
    > We just wouldn't do it. I worry that we may be overthinking things here. I agree that going with your gut feeling is very likely good enough, but I don't agree with the term "overthinking". I think codifying the decision a bit is beneficial, as any of us is likely to run into a case that falls into a gray area, and having more fleshed-out decision lines will be helpful in that case. I think it's the same in ethics vs morals. The ethics you inherited from society will be good enough for the vast majority of decisions, but sometimes it's good to logically deduce morality for yourself. You might realize you used to believe things that didn't stand to reason.
  - drvdevd 9y ago
    The only question I have, in this particular case is: what about the victims of the original app? Are they possibly the subject of re-victimization if the app on their device is compromised further by 3rd parties? Though I completely agree with HackerOne's moral stance here, does this particular scenario complicate things? EDIT: I do see they took this into consideration in their writeup... still curious.
    - nojvek 9y ago
      If other people are using your brand as a means to sell then you definitely need to take a stance on what you stand for.
  - Tomte 9y ago
    I see an parallel to the harassment/CoC discussion: Because that's mostly my stance on the question "should a project have a code of conduct?": It's overspecifying things because we believe we can control them better the more we're spelling it out. I'd prefer a blanket "we're against harassment of any kind and will act if harassment comes to our attention", over many paragraphs trying to spell out what exactly we consider actionable, leaving loopholes for language lawyers (and we nerds have this tendency!) all over the place. I know that you're strongly in favor of CoCs. Do you see a qualitative difference between those things? I'll grant that harassment is a much more explosive issue today, but "who is allowed to participate in a bug bounty community" also seems to have potential for bitter quarrels.
- mtempm 9y ago
  Really neatly said. Sometimes it's worth noting the value in anlytical thinking that the user base at HN is able to produce. This (in my humble opinion) produces more valuable insights than what I'd find on cable news, or even sometimes in respectable publications.
tlrobinson 9y ago
"Think about CloudFlare protecting ISIS sites." I'm pretty sure the Feds are happy to have traffic to ISIS sites be routed (unencrypted) through an American company's service...

by 21 9y ago

derefr 9y ago

To me, it seems to come down to: 1. there are evil people, but 2. those people frequently have more social power than nice people, and 3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.") If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers" built into your system will mostly be used by those with power against those without it, regardless of which side is "correct." So: If you let people speak freely, the powerful will shout down the powerless. But if you let people silence others, then the powerful will silence the powerless. Morally, it really comes down to a choice of which kind of hammer hurts wronged innocent powerless people the least. (Which can often mean offering no hammer that can truly be used to "deal with" obviously-evil people.)

traverseda 9y ago
Discussion in response to this comment elsewhere. https://www.reddit.com/r/rational/comments/69f7nw/d_friday_offtopic_thread/dh6k79r/ https://www.reddit.com/r/rational/comments/69f7nw/d_friday_o...
tptacek 9y ago
I understand what you're writing, and what HackerOne wrote, but to me it pretty much seems like "we won't run a security service for spyware companies". At Matasano, we wouldn't do work for the USG or arms manufacturers. We didn't have a coherent framework to fit that decision into. We just wouldn't do it. I worry that we may be overthinking things here.
- derefr 9y ago
  I wasn't so much suggesting a decision-making framework, as a model that can be used to understand decisions people make intuitively. "Overthinking" is the whole point. :)
- StavrosK 9y ago
  > We just wouldn't do it. I worry that we may be overthinking things here. I agree that going with your gut feeling is very likely good enough, but I don't agree with the term "overthinking". I think codifying the decision a bit is beneficial, as any of us is likely to run into a case that falls into a gray area, and having more fleshed-out decision lines will be helpful in that case. I think it's the same in ethics vs morals. The ethics you inherited from society will be good enough for the vast majority of decisions, but sometimes it's good to logically deduce morality for yourself. You might realize you used to believe things that didn't stand to reason.
- drvdevd 9y ago
  The only question I have, in this particular case is: what about the victims of the original app? Are they possibly the subject of re-victimization if the app on their device is compromised further by 3rd parties? Though I completely agree with HackerOne's moral stance here, does this particular scenario complicate things? EDIT: I do see they took this into consideration in their writeup... still curious.
  - nojvek 9y ago
    If other people are using your brand as a means to sell then you definitely need to take a stance on what you stand for.
- Tomte 9y ago
  I see an parallel to the harassment/CoC discussion: Because that's mostly my stance on the question "should a project have a code of conduct?": It's overspecifying things because we believe we can control them better the more we're spelling it out. I'd prefer a blanket "we're against harassment of any kind and will act if harassment comes to our attention", over many paragraphs trying to spell out what exactly we consider actionable, leaving loopholes for language lawyers (and we nerds have this tendency!) all over the place. I know that you're strongly in favor of CoCs. Do you see a qualitative difference between those things? I'll grant that harassment is a much more explosive issue today, but "who is allowed to participate in a bug bounty community" also seems to have potential for bitter quarrels.
mtempm 9y ago
Really neatly said. Sometimes it's worth noting the value in anlytical thinking that the user base at HN is able to produce. This (in my humble opinion) produces more valuable insights than what I'd find on cable news, or even sometimes in respectable publications.

tlrobinson 9y ago

"Think about CloudFlare protecting ISIS sites." I'm pretty sure the Feds are happy to have traffic to ISIS sites be routed (unencrypted) through an American company's service...