3 ms·

The problem with your first line is that it leaves the definition of black hat open to interpretation, when that is not how the word is actually used in the sec

by dsacco 9y ago

The problem with your first line is that it leaves the definition of black hat open to interpretation, when that is not how the word is actually used in the security industry or in popular reporting. Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute. By your reasoning, I am free to call security researchers black hats if they don't give vendors advance notice. You might disagree with that, but you can't say I'm wrong without making a normative argument about whether or not something is ultimately unethical. There is no categorical difference between me choosing to call people black hats if I disagree with their behavior and you calling these researchers black hats because they're doubling as activist investors. On the other hand, this entire sideshow is bypassed if we use the well-established definition for "black hat", which refers exclusively to illegal behavior involving security vulnerabilities and online fraud. More to the point, reporting facts is not "market manipulation" (which is also a well established term) even if you want it to be, and "social engineering" is not the same as publicizing information with the intent to move the markets. Using these words in the way you are is the same as flippantly redefining them as you go along, with the result that the conclusion is quite brittle. There could be a strong argument that the behavior is unethical, but using these terms as you are doesn't help that point along, it hampers it.

cat199 9y ago
> Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute stock manipulation is clearly criminal, if you want to take the 'letter of the law' approach.. beyond this, this gets into the same debate as letter of the law vs spirit of the law, which has both nothing and everything to do with this topic.. black hat is not 'defined exclusively' anywhere, and of course one leaning to a 'letter of the law' argument would then also look for 'exclusive definitions' as to your point: > free to call security researchers black hats if they don't give vendors advance notice. if they are doing this for malicious purposes, yes if it is for an ideological stance, then, well, it depends on how you view their ideology. what happens if the law is incorrect? again, letter of the law vs spirit of the law. "normative argument about whether or not something is ultimately unethical" laws are normative arguments about whether or not something is ultimately unethical.. not neutral 'things' that exist in a vacuum. and they can be correct or incorrect, and also incompletely defined.. how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Say for example, actively portscanning (legality nebulous) for already infected computers and then overcharging 2000% for cleanup? Then spamming virii from a jurisdiction where it is not illegal in order to grow this 'business'? All legal.. so it's "white hat?" or is it 'grey hat' because it is in a legal 'gray area'? I don't think that's what grey hat means either..
- dsacco 9y ago
  > laws are normative arguments about whether or not something is ultimately unethical That wasn't the distinction I was making. A law is a positive statement. An argument of what should be lawful, or an interpretation of a law, is of course normative. But I already said that in this thread. By the "letter of the law" (section 9(4)(a) of the SEC act and existing case law), stock manipulation involves promulgating outright falsehoods. Case law shows us that exemplary falsehoods have to be categorically untrue; a biased presentation of something that is true does not pass the bar. Being that there is a vulnerability here, the material we have to go on does not paint a favorable outlook on the researchers being indicted. Activist investors routinely present facts to the media with a clear agenda, but the SEC virtually never prosecutes them if there is an inarguable, material kernel of truth to their allegations. There's a vulnerability here. Reasonable people can disagree on the severity of the vulnerability and how it should have been disclosed. But it's not fraud. > how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Your question has a presupposition; if the security researchers traded on their knowledge of this vulnerability, I find that to be neither unethical nor illegal stock manipulation.
  - cat199 9y ago
    > Your question has a presupposition that it is specifically tied to this case.

by dsacco 9y ago

cat199 9y ago

> Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute stock manipulation is clearly criminal, if you want to take the 'letter of the law' approach.. beyond this, this gets into the same debate as letter of the law vs spirit of the law, which has both nothing and everything to do with this topic.. black hat is not 'defined exclusively' anywhere, and of course one leaning to a 'letter of the law' argument would then also look for 'exclusive definitions' as to your point: > free to call security researchers black hats if they don't give vendors advance notice. if they are doing this for malicious purposes, yes if it is for an ideological stance, then, well, it depends on how you view their ideology. what happens if the law is incorrect? again, letter of the law vs spirit of the law. "normative argument about whether or not something is ultimately unethical" laws are normative arguments about whether or not something is ultimately unethical.. not neutral 'things' that exist in a vacuum. and they can be correct or incorrect, and also incompletely defined.. how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Say for example, actively portscanning (legality nebulous) for already infected computers and then overcharging 2000% for cleanup? Then spamming virii from a jurisdiction where it is not illegal in order to grow this 'business'? All legal.. so it's "white hat?" or is it 'grey hat' because it is in a legal 'gray area'? I don't think that's what grey hat means either..

dsacco 9y ago
> laws are normative arguments about whether or not something is ultimately unethical That wasn't the distinction I was making. A law is a positive statement. An argument of what should be lawful, or an interpretation of a law, is of course normative. But I already said that in this thread. By the "letter of the law" (section 9(4)(a) of the SEC act and existing case law), stock manipulation involves promulgating outright falsehoods. Case law shows us that exemplary falsehoods have to be categorically untrue; a biased presentation of something that is true does not pass the bar. Being that there is a vulnerability here, the material we have to go on does not paint a favorable outlook on the researchers being indicted. Activist investors routinely present facts to the media with a clear agenda, but the SEC virtually never prosecutes them if there is an inarguable, material kernel of truth to their allegations. There's a vulnerability here. Reasonable people can disagree on the severity of the vulnerability and how it should have been disclosed. But it's not fraud. > how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Your question has a presupposition; if the security researchers traded on their knowledge of this vulnerability, I find that to be neither unethical nor illegal stock manipulation.
- cat199 9y ago
  > Your question has a presupposition that it is specifically tied to this case.