3 ms·

So if you make it easier for someone else to develop an exploit, which is then deployed before mitigation can be, that's OK so long as you didn't directly profi

So if you make it easier for someone else to develop an exploit, which is then deployed before mitigation can be, that's OK so long as you didn't directly profit from it? I think reasonable people can take a different view. It's all too easy to say "let the chips fall where they may" when you feel none of the consequences. It's even easier when maintaining a general atmosphere of threat is in your own business interest.

tptacek 9y ago
And I think it's awfully easy for people who don't do independent unpaid research, and don't contribute in any way to its being conducted, to have strong opinions about the responsibilities researchers have to them. Let me sum this up: they're not working for you. You don't get to tell them what to do. If AMD wanted to protect their users, they'd quadruple their security verification budget. What do you think that budget is as a percentage of R&D costs at AMD? Take a guess.
- Erlangolem 9y ago
  You still seem to be (intentionally?) ignoring the difference between permissible, and ethical.
  - tptacek 9y ago
    It is not unethical to discover things on your own and reveal some or all of it to the world. Sorry. What's your guess at AMD's security verification budget as a percentage of R&D? And what do you think it should be?
    - Erlangolem 9y ago
      I don’t seriously have to explain the concept of two wrongs not making a right, do I? Hopefully by the same token, you’re not really confused by the notion of waiting a month before making something public, vs. being told to never release it. It’s possible to be disgusted with large companies treating security as an afterthought, and people pushing a release in 24 hours because of their disclosed financial interest in the outcome. Likewise, I can support your argument that independent researchers aren’t beholden to AMD or Intel, etc, while finding your total lack of espoused ethics disturbing.
      - tptacek 9y ago
        No, see, I answered your question directly. You can't pretend my followup question was that answer and then play the "2 wrongs" card. Can you please first acknowledge that, then, if possible, actually answer the question I asked?
        Erlangolem 9y ago
        I didn’t ask you a question, I made a statement about you persistently attacking the strawman of “I can do what I want” when what’s been presented over and over is an ethical argument. You still seem to be (intentionally?) ignoring the difference between permissible, and ethical. You’re free to ignore or reject the ethical dimension of your work, but there is a word for that you can’t talk your way out of: unethical.
- notacoward 9y ago
  That's one of the worst appeals to authority I've ever seen. What hubris. Yes, many of us are busy building the things that you merely criticize. Some of us even have experience in security, but it's not what we do now. But because we're not your tribe, you consistently act like we're not entitled to opinions. You didn't even try to engage with the actual argument here.

tptacek 9y ago

And I think it's awfully easy for people who don't do independent unpaid research, and don't contribute in any way to its being conducted, to have strong opinions about the responsibilities researchers have to them. Let me sum this up: they're not working for you. You don't get to tell them what to do. If AMD wanted to protect their users, they'd quadruple their security verification budget. What do you think that budget is as a percentage of R&D costs at AMD? Take a guess.

Erlangolem 9y ago
You still seem to be (intentionally?) ignoring the difference between permissible, and ethical.
- tptacek 9y ago
  It is not unethical to discover things on your own and reveal some or all of it to the world. Sorry. What's your guess at AMD's security verification budget as a percentage of R&D? And what do you think it should be?
  - Erlangolem 9y ago
    I don’t seriously have to explain the concept of two wrongs not making a right, do I? Hopefully by the same token, you’re not really confused by the notion of waiting a month before making something public, vs. being told to never release it. It’s possible to be disgusted with large companies treating security as an afterthought, and people pushing a release in 24 hours because of their disclosed financial interest in the outcome. Likewise, I can support your argument that independent researchers aren’t beholden to AMD or Intel, etc, while finding your total lack of espoused ethics disturbing.
    - tptacek 9y ago
      No, see, I answered your question directly. You can't pretend my followup question was that answer and then play the "2 wrongs" card. Can you please first acknowledge that, then, if possible, actually answer the question I asked?
      - Erlangolem 9y ago
        I didn’t ask you a question, I made a statement about you persistently attacking the strawman of “I can do what I want” when what’s been presented over and over is an ethical argument. You still seem to be (intentionally?) ignoring the difference between permissible, and ethical. You’re free to ignore or reject the ethical dimension of your work, but there is a word for that you can’t talk your way out of: unethical.
notacoward 9y ago
That's one of the worst appeals to authority I've ever seen. What hubris. Yes, many of us are busy building the things that you merely criticize. Some of us even have experience in security, but it's not what we do now. But because we're not your tribe, you consistently act like we're not entitled to opinions. You didn't even try to engage with the actual argument here.