4 ms·

I looked through the task manager of a corporate issued laptop and saw tasks belonging to very similar companies, as part of the disk image IT makes. The corpo

I looked through the task manager of a corporate issued laptop and saw tasks belonging to very similar companies, as part of the disk image IT makes. The corporation likely has a license for the software, as well as conditions for all their employees to expect monitoring. A formalized bug bounty program would enable the software producer to have secure software. Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is. Is all monitoring software now banned from HackerOne under the guise of a moral high ground HackerOne just created?

arice 9y ago
That's helpful feedback on missing context from our post. Thanks. This series by VICE articulates the sometimes subtle distinctions between legitimate monitoring software built for enterprises and parents vs this particular software (which they deem "stalkerware"). https://motherboard.vice.com/en_us/article/inside-stalkerware-surveillance-market-flexispy-retina-x https://motherboard.vice.com/en_us/article/inside-stalkerwar...
- geppeto 9y ago
  There are a lot of dubious companies on HackerOne. Why did taking a stance on this one have a perceived more positive outcome than taking any stance at all? Pretty much zero of the companies on HackerOne are part of any social responsibility index, shariah compliant index, or trendy b-corporation index. And even in the non-zero rebuttal, the vast majority can have entire dissertations written about weighing the ethical considerations for doing any business with them. So why even make a stance at all? The time it takes for the arbitrary nature of your ethical decisions to become apparent is simply longer than it will take for your runway to deplete.
  - Chris2048 9y ago
    shariah compliant index? Did you include that just to question the objective nature of morality?
    - geppeto 9y ago
      B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience. Standard & Poors operates shariah compliant funds right over in Toronto and is also very popular in many markets. Maybe it doesn't mean what you think it means, maybe you'll learn
      - Chris2048 9y ago
        > B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience. Shariah compliant investing follows specifically and explicitly from a religious moral basis. SRI seems much more concerned with issues of Social Justice and human welfare, in ways not always inline with Sharia principles. If you say they are similar, the burden is on you to demonstrate.
        geppeto 9y ago
        Significant overlap in the concepts such as avoiding companies into firearms, profiting from conflict zones, tobacco sometimes and other vices. Thats the demonstration. Shouldn't bother you that much.
ealexhudson 9y ago
There are plenty of corporate applications; the majority of them are obvious and the user knows what's happening (in my country at least [UK] any employee would need to be specifically told and likely have to sign something before it could be used). Monitoring isn't the issue. The problem is spying. Enabling people to more reliably spy on others is a problem.
ekiru 9y ago
Making the decision seems a lot easier to me when the monitoring software explicitly markets itself to and supports domestic abusers.
sigmar 9y ago
>Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is. FlexiSpy specifically marketed itself as a tool for spying on your spouse. Their front page used to include "read your partner's sms" https://web.archive.org/web/20060402200643/http://flexispy.com/ https://web.archive.org/web/20060402200643/http://flexispy.c...
- MichaelGG 9y ago
  So the issue about how oblique they make their marketing message? If they rebrand and use lots of innuendo, then it's OK?
  - kbenson 9y ago
    In some respects, yes, it's about the messaging. You'll attract certain customers, and they might be willing to press for certain things that might not be legal, depending on the message. There's a difference between a gun company that markets their products as protection and sports, and one that markets them for revenge. In both cases, the usage of the gun is up to me, but in one case it looks like the company might be willing to assist me, or point me towards helpful information that assists me, in circumventing safeguards put in place on the purchase of weapons.
  - sigmar 9y ago
    You're being obtuse if you think this use-case wasn't a huge part of their thinking while designing the software and offering support to customers. >I asked a FlexiSpy salesperson a simple question: If I wanted to, could I use their spyware to snoop on my wife's cellphone without her knowing? The answer each time was yes. When asked if it was legal, they responded with a canned disclaimer explaining it was necessary to get the permission of the target. But what if I didn't want my wife to know? They could help me anyway. https://www.forbes.com/sites/thomasbrewster/2017/02/22/flexispy-malware-spy-on-spouse-illegal-wiretap-act-offences/ https://www.forbes.com/sites/thomasbrewster/2017/02/22/flexi...
    - 9y ago
thraway2016 9y ago
Why exactly is HackerOne drawing a distinction with this software producer? The truth is: because a H1 rep went on Risky Business and did not deliver a very good performance. Patrick, who is absolutely okay with H1 having FiveEye clients like the US DoD, has a very serious problem with them also servicing an obscure spyware application provider. Because, I suppose, being murder-droned by a panopticon hegemony is much better than getting yelled at by an angry spouse?
- deleted 9y ago
  [deleted]
- kbenson 9y ago
  The purpose of the DoD is not to spy on people, it is to protect people. That some actions by some programs and and departments may cross the line legally during certain periods is not that same as an entity whose sole, or majority of goods or services are for, or marketed as being for, an illegal action.
  - sksnjd 9y ago
    Hahahahahahaha Just some bad apples right? Hahahahahahaha
  - miopa 9y ago
    In the first case, you have an entity that has a proven record of breaking the law (on purpose) using technology. I can also argue that the purpose of DoD now is to protect the elites, from the people, but that's another story. In the second, the legal line is not crossed. It may be crossed at some point by an adult person that can bear responsibility for his actions. I would not work with both; I can understand how can one not be a hypocrite by choosing to work with the latter and not the former, but not the other way around. Is it the right moral choice to protect the privacy of a cheater? Maybe, I don't know, I'm struggling to answer that to myself, let alone judge others.
    - Chris2048 9y ago
matt4077 9y ago
What's so refreshing about their post is that they admit not to have an unassailable "moral high ground". They highlight the strongest arguments, including those arguing against their decision. They do this because they recognise that decisions often have competing trade-offs, nuances, ambiguity. There is, unfortunately, almost no recognition of this fact in public these days. You're expected to pick a side, defend it, and attack others, using whatever rhetorical tool is available. Among those tools of destructive debate: reducing any ambiguity in your favour, i. e. "They are banning Z, and I don't know Z, so I'll argue that Z is like A and banning A would be wrong". Or, equally bad, the slippery slope: "Z may be bad, but you can't give me an algorithm that unambiguously distinguishes Z and Y, nor Y and X, or, by transitivity, Z and A. Therefore, you can't ban Z without also eventually banning A, and that would be bad".

arice 9y ago

That's helpful feedback on missing context from our post. Thanks. This series by VICE articulates the sometimes subtle distinctions between legitimate monitoring software built for enterprises and parents vs this particular software (which they deem "stalkerware"). https://motherboard.vice.com/en_us/article/inside-stalkerware-surveillance-market-flexispy-retina-x https://motherboard.vice.com/en_us/article/inside-stalkerwar...

geppeto 9y ago
There are a lot of dubious companies on HackerOne. Why did taking a stance on this one have a perceived more positive outcome than taking any stance at all? Pretty much zero of the companies on HackerOne are part of any social responsibility index, shariah compliant index, or trendy b-corporation index. And even in the non-zero rebuttal, the vast majority can have entire dissertations written about weighing the ethical considerations for doing any business with them. So why even make a stance at all? The time it takes for the arbitrary nature of your ethical decisions to become apparent is simply longer than it will take for your runway to deplete.
- Chris2048 9y ago
  shariah compliant index? Did you include that just to question the objective nature of morality?
  - geppeto 9y ago
    B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience. Standard & Poors operates shariah compliant funds right over in Toronto and is also very popular in many markets. Maybe it doesn't mean what you think it means, maybe you'll learn
    - Chris2048 9y ago
      > B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience. Shariah compliant investing follows specifically and explicitly from a religious moral basis. SRI seems much more concerned with issues of Social Justice and human welfare, in ways not always inline with Sharia principles. If you say they are similar, the burden is on you to demonstrate.
      - geppeto 9y ago
        Significant overlap in the concepts such as avoiding companies into firearms, profiting from conflict zones, tobacco sometimes and other vices. Thats the demonstration. Shouldn't bother you that much.

ealexhudson 9y ago

There are plenty of corporate applications; the majority of them are obvious and the user knows what's happening (in my country at least [UK] any employee would need to be specifically told and likely have to sign something before it could be used). Monitoring isn't the issue. The problem is spying. Enabling people to more reliably spy on others is a problem.

ekiru 9y ago

Making the decision seems a lot easier to me when the monitoring software explicitly markets itself to and supports domestic abusers.

sigmar 9y ago

>Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is. FlexiSpy specifically marketed itself as a tool for spying on your spouse. Their front page used to include "read your partner's sms" https://web.archive.org/web/20060402200643/http://flexispy.com/ https://web.archive.org/web/20060402200643/http://flexispy.c...

MichaelGG 9y ago
So the issue about how oblique they make their marketing message? If they rebrand and use lots of innuendo, then it's OK?
- kbenson 9y ago
  In some respects, yes, it's about the messaging. You'll attract certain customers, and they might be willing to press for certain things that might not be legal, depending on the message. There's a difference between a gun company that markets their products as protection and sports, and one that markets them for revenge. In both cases, the usage of the gun is up to me, but in one case it looks like the company might be willing to assist me, or point me towards helpful information that assists me, in circumventing safeguards put in place on the purchase of weapons.
- sigmar 9y ago
  You're being obtuse if you think this use-case wasn't a huge part of their thinking while designing the software and offering support to customers. >I asked a FlexiSpy salesperson a simple question: If I wanted to, could I use their spyware to snoop on my wife's cellphone without her knowing? The answer each time was yes. When asked if it was legal, they responded with a canned disclaimer explaining it was necessary to get the permission of the target. But what if I didn't want my wife to know? They could help me anyway. https://www.forbes.com/sites/thomasbrewster/2017/02/22/flexispy-malware-spy-on-spouse-illegal-wiretap-act-offences/ https://www.forbes.com/sites/thomasbrewster/2017/02/22/flexi...
  - 9y ago

thraway2016 9y ago

Why exactly is HackerOne drawing a distinction with this software producer? The truth is: because a H1 rep went on Risky Business and did not deliver a very good performance. Patrick, who is absolutely okay with H1 having FiveEye clients like the US DoD, has a very serious problem with them also servicing an obscure spyware application provider. Because, I suppose, being murder-droned by a panopticon hegemony is much better than getting yelled at by an angry spouse?

deleted 9y ago
[deleted]
kbenson 9y ago
The purpose of the DoD is not to spy on people, it is to protect people. That some actions by some programs and and departments may cross the line legally during certain periods is not that same as an entity whose sole, or majority of goods or services are for, or marketed as being for, an illegal action.
- sksnjd 9y ago
  Hahahahahahaha Just some bad apples right? Hahahahahahaha
- miopa 9y ago
  In the first case, you have an entity that has a proven record of breaking the law (on purpose) using technology. I can also argue that the purpose of DoD now is to protect the elites, from the people, but that's another story. In the second, the legal line is not crossed. It may be crossed at some point by an adult person that can bear responsibility for his actions. I would not work with both; I can understand how can one not be a hypocrite by choosing to work with the latter and not the former, but not the other way around. Is it the right moral choice to protect the privacy of a cheater? Maybe, I don't know, I'm struggling to answer that to myself, let alone judge others.
  - Chris2048 9y ago

matt4077 9y ago

What's so refreshing about their post is that they admit not to have an unassailable "moral high ground". They highlight the strongest arguments, including those arguing against their decision. They do this because they recognise that decisions often have competing trade-offs, nuances, ambiguity. There is, unfortunately, almost no recognition of this fact in public these days. You're expected to pick a side, defend it, and attack others, using whatever rhetorical tool is available. Among those tools of destructive debate: reducing any ambiguity in your favour, i. e. "They are banning Z, and I don't know Z, so I'll argue that Z is like A and banning A would be wrong". Or, equally bad, the slippery slope: "Z may be bad, but you can't give me an algorithm that unambiguously distinguishes Z and Y, nor Y and X, or, by transitivity, Z and A. Therefore, you can't ban Z without also eventually banning A, and that would be bad".