3 ms·
the theft itself is obviously a crime. But that wasn't the question. The question was: "is selling the source back to the company extortion?" The answer is no.
by beaconstudios 8y ago
the theft itself is obviously a crime. But that wasn't the question. The question was: "is selling the source back to the company extortion?"
The answer is no.
- pbhjpbhj 8y agoI didn't think we were contemplating selling the source back, rather selling details of how a malicious person could easily acquire the source - as one may have done as a slightly-off-white hat hacker. It's not theft either; and we could have immediately destroyed all our data except some excerpt as proof the hack is available so we would not be handling any infringing data (despite the initial act potentially being infringing, depending on jurisdiction). This is akin to "I went past your property and saw the door open, stepped inside and took a picture as proof; do you want to see the picture?".
- beaconstudios 8y agoYes you're right, my description of the scenario wasn't quite accurate. Personally I don't think this scenario is unethical (beyond your responsibility to disclose potentially being to the company's users, not the company itself, meaning withholding the vulnerability might be ethically dubious) but as I understand (IANAL) it is illegal. But the law doesn't always map well onto ethics.
- acct1771 8y agoRarely, the more you study implementation and edge cases.