3 ms·

I consider myself an ethical person and I’d have a tough time ignoring the potential for $1 million dollars. After taxes I could buy a really nice house for ca

by ryan29 6y ago

I consider myself an ethical person and I’d have a tough time ignoring the potential for $1 million dollars. After taxes I could buy a really nice house for cash and have enough money left over to drive a new car for the rest of my life. One option is life changing and the “ethical” side might not pay enough to buy a gaming PC. Meanwhile the executives at the companies that claim security research needs ethics are making millions of dollars selling insecure apps. It’s like a church asking poor people to tithe IMO. I actually think it would be better if there were no laws regarding the sale of security exploits. Everything should go onto an anonymous marketplace and the companies that have affected products should have to pair fair market value for bug discoveries. Skimping on security and guilting researchers into being ethical is a total scam.

eschaton 6y ago
Sounds like maybe you shouldn’t consider yourself an ethical person. Otherwise, if you’re involved in enough startups, you’ll eventually be in the position where have to ignore the potential for insider trading to make you a million (or several) and it doesn’t sound like you’d be able to.
- higerordermap 6y ago
  No, that's perfectly ethical compared to betraying the company that employes you, because: * The money otherwise goes to the pockets of completely-useless C-suites. * The exploit is likely out anyway. * Nation state actors may indeed prevent yet another 9/11 attack. In worst case they don't use it to spread ransomware.
- ryan29 6y ago
  Those aren't even close to the same thing though. One is illegal and the other, selling to a company like Zerodium, isn't. The ethical objection I have is that you lose control over how that exploit is used if you sell it to someone like Zerodium and I think it's better for users and the general public if bugs are disclosed directly to software makers. However, the idea that security researchers are guilted into "being ethical" while the (rich) executives for massive, multi-billion dollar tech companies are saving money on security, plus skimping on paying security researchers fair value when bugs are discovered, frustrates me. It's hypocritical for big tech to expect "ethical" behavior from security researchers when it's a lot closer to "let us take advantage of you" IMO. If it becomes a debate about ethics, I think every time an exploit is sold to a company like Zerodium it's primarily the fault of the tech companies that are exploiting security researchers.
  - krageon 6y ago
    While I certainly understand the viewpoint of being bribable by a million dollars, legality has absolutely nothing to do with ethics. As you say, clamoring for ethical behaviour at all in this context is terrible and completely missing the point.

by ryan29 6y ago

eschaton 6y ago

Sounds like maybe you shouldn’t consider yourself an ethical person. Otherwise, if you’re involved in enough startups, you’ll eventually be in the position where have to ignore the potential for insider trading to make you a million (or several) and it doesn’t sound like you’d be able to.

higerordermap 6y ago
No, that's perfectly ethical compared to betraying the company that employes you, because: * The money otherwise goes to the pockets of completely-useless C-suites. * The exploit is likely out anyway. * Nation state actors may indeed prevent yet another 9/11 attack. In worst case they don't use it to spread ransomware.
ryan29 6y ago
Those aren't even close to the same thing though. One is illegal and the other, selling to a company like Zerodium, isn't. The ethical objection I have is that you lose control over how that exploit is used if you sell it to someone like Zerodium and I think it's better for users and the general public if bugs are disclosed directly to software makers. However, the idea that security researchers are guilted into "being ethical" while the (rich) executives for massive, multi-billion dollar tech companies are saving money on security, plus skimping on paying security researchers fair value when bugs are discovered, frustrates me. It's hypocritical for big tech to expect "ethical" behavior from security researchers when it's a lot closer to "let us take advantage of you" IMO. If it becomes a debate about ethics, I think every time an exploit is sold to a company like Zerodium it's primarily the fault of the tech companies that are exploiting security researchers.
- krageon 6y ago
  While I certainly understand the viewpoint of being bribable by a million dollars, legality has absolutely nothing to do with ethics. As you say, clamoring for ethical behaviour at all in this context is terrible and completely missing the point.