4 ms·

You had the best of intentions, and tried to do everything right. Unfortunately, in modern times that just paints a bigger target on your back. This is why I g

You had the best of intentions, and tried to do everything right. Unfortunately, in modern times that just paints a bigger target on your back. This is why I got out of cybersecurity. Even when you are a good guy, the other folks look at you like it's only a matter of time before you steal the crown jewels while their back is turned. And if you are disclosing vulns you found when not actually hired to do so, forget about it - the best you can hope for is a thank you and a bounty that doesn't make it worth the time it took. The sky's the limit on the worst you can get. The prospects of folks probing systems for the fun of it and disclosing how to secure them better to the owners in order to make the world a better place have become too grim. If you really want to do this, then I recommend you join a security company and do it as an employee to get that protection. Every decade since 1989 I have marveled at how much closer our world has gotten to the world of Shadowrun. I just wish we had gotten the magic to go with the pall of shadows that hang over us now.

czbond 6y ago
I agree with you. My view now when approaching all (and similar) situations in life - is "Can someone with mild to average intelligence interpret this negatively against me and act upon that perception?" Because let's be honest, that is Occam's razor most probabilistic outcomes.
- jjoonathan 6y ago
  100%. Joe Bureaucrat doesn't give one whit about race conditions in his employer's business logic. He has no reason to. If he can creatively interpret the situation as himself catching a hacker (the hacker being the researcher submitting the report)? That's prime. He can brag about it to the end of his days and monetize it at promotion time.
  - czbond 6y ago
    I love the application of phrasing of "race conditions" to one's logic; I had never thought of that concept. And your deduction on the outcome is very likely!
    - pierrec 6y ago
      I think you're over-interpreting here: https://en.wikipedia.org/wiki/Business_logic https://en.wikipedia.org/wiki/Business_logic
      - czbond 6y ago
        I may have been - but it opened up a whole new thought process. Imagine bounded logic competing for resources and otherwise causing mis-appropriated logic. Profound.
packetlost 6y ago
I mean... we've got the plague part down: https://shadowrun.fandom.com/wiki/VITAS https://shadowrun.fandom.com/wiki/VITAS
- Nexxius 6y ago
  I'm waiting for Dunk to show up.
Mandatum 6y ago
> This is why I got out of cybersecurity. So accurate. It's doom and gloom in that space, you either do it because you couldn't literally see yourself doing anything else - or for ego/cash. I'd argue there's much better ways to make cash in other engineering jobs, often skills in security overlap with SRE, admin and compliance roles. It's the golden years for blackhats right now. And it has been for about 15 years, and I really don't see it changing at all any time soon.
sneak 6y ago
> If you really want to do this, then I recommend you join a security company and do it as an employee to get that protection. “My boss told me to do it” is not a defense against criminal charges. https://www.techdirt.com/articles/20200131/11153743831/criminal-charges-finally-dropped-against-security-researchers-who-broke-into-iowa-courthouse.shtml https://www.techdirt.com/articles/20200131/11153743831/crimi...
- Communitivity 6y ago
  100% correct. What I meant though was that the good security companies get their clients to sign a contract that precludes the security company, or it's employees, from being sued as long as their penetration falls within the parameters specified by the client (the Rules of Engagement if you will). That is the protection I would want.
whatsmyusername 6y ago
I second this. It's pointless to do it for free. I'm getting out of ops for the simple reason that it's way more lucrative to be called in after the fact rather than try to stop incidents ahead of time (whether by probing and disclosing or trying to build out a blue team without being paid a contract to do so).

czbond 6y ago

I agree with you. My view now when approaching all (and similar) situations in life - is "Can someone with mild to average intelligence interpret this negatively against me and act upon that perception?" Because let's be honest, that is Occam's razor most probabilistic outcomes.

jjoonathan 6y ago
100%. Joe Bureaucrat doesn't give one whit about race conditions in his employer's business logic. He has no reason to. If he can creatively interpret the situation as himself catching a hacker (the hacker being the researcher submitting the report)? That's prime. He can brag about it to the end of his days and monetize it at promotion time.
- czbond 6y ago
  I love the application of phrasing of "race conditions" to one's logic; I had never thought of that concept. And your deduction on the outcome is very likely!
  - pierrec 6y ago
    I think you're over-interpreting here: https://en.wikipedia.org/wiki/Business_logic https://en.wikipedia.org/wiki/Business_logic
    - czbond 6y ago
      I may have been - but it opened up a whole new thought process. Imagine bounded logic competing for resources and otherwise causing mis-appropriated logic. Profound.

packetlost 6y ago

I mean... we've got the plague part down: https://shadowrun.fandom.com/wiki/VITAS https://shadowrun.fandom.com/wiki/VITAS

Nexxius 6y ago
I'm waiting for Dunk to show up.

Mandatum 6y ago

> This is why I got out of cybersecurity. So accurate. It's doom and gloom in that space, you either do it because you couldn't literally see yourself doing anything else - or for ego/cash. I'd argue there's much better ways to make cash in other engineering jobs, often skills in security overlap with SRE, admin and compliance roles. It's the golden years for blackhats right now. And it has been for about 15 years, and I really don't see it changing at all any time soon.

sneak 6y ago

> If you really want to do this, then I recommend you join a security company and do it as an employee to get that protection. “My boss told me to do it” is not a defense against criminal charges. https://www.techdirt.com/articles/20200131/11153743831/criminal-charges-finally-dropped-against-security-researchers-who-broke-into-iowa-courthouse.shtml https://www.techdirt.com/articles/20200131/11153743831/crimi...

Communitivity 6y ago
100% correct. What I meant though was that the good security companies get their clients to sign a contract that precludes the security company, or it's employees, from being sued as long as their penetration falls within the parameters specified by the client (the Rules of Engagement if you will). That is the protection I would want.

whatsmyusername 6y ago

I second this. It's pointless to do it for free. I'm getting out of ops for the simple reason that it's way more lucrative to be called in after the fact rather than try to stop incidents ahead of time (whether by probing and disclosing or trying to build out a blue team without being paid a contract to do so).