3 ms·

> if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work? Interestingly

> if companies paid for in-house security professionals competitive with what one might imagine BM pays, would people still choose the grey work? Interestingly, they answer very clearly: > We have not been involved in legal pentesting and we believe that this could not bring the proper material reward. They're in only for the money, so the answer is "yes". Ransomware is not "grey" work though, if this is the implication; it's extortion, which is illegal.

dcow 5y ago
> Let’s assume what BM is doing is effectively legal in the country where they operate.
- pizza234 5y ago
  This specific activity has a direct contact with the victims, which makes it considerably different from other gray-area activities, where there is a strong disconnection with the victims (in which case, the concept of victim additionally becomes blurrier, e.g. tobacco industry or, uh, banking). Assuming that one has valid job alternatives (and they definitely have, since they're highly skilled professionals, with an available market), one needs to be have a certain degree of sociopathy in order to be able to do this line of work.
  - dcow 5y ago
    So you’re suggesting they can find better paying and more rewarding work elsewhere and they choose not to do so? That seems very unlikely for a self interested sociopath…
    - pizza234 5y ago
      No, i suggest that, with the assumption that they're highly talented individuals with very marketable skills (especially since they're not restricted by geographic borders), and they're trading 100% legal professions with a high reward (say, 200+ k$/year) with a directly violent and basically illegal one, with a very high reward (they could make an order of magnitude more; that's not uncommon for high-calibre spam groups). Since direct violence is involved, in my opinion this requires a degree of sociopathy. I'm not sympathetic to spam groups either, but at least their profession doesn't have a direct contact with the victims.

dcow 5y ago

> Let’s assume what BM is doing is effectively legal in the country where they operate.

pizza234 5y ago
This specific activity has a direct contact with the victims, which makes it considerably different from other gray-area activities, where there is a strong disconnection with the victims (in which case, the concept of victim additionally becomes blurrier, e.g. tobacco industry or, uh, banking). Assuming that one has valid job alternatives (and they definitely have, since they're highly skilled professionals, with an available market), one needs to be have a certain degree of sociopathy in order to be able to do this line of work.
- dcow 5y ago
  So you’re suggesting they can find better paying and more rewarding work elsewhere and they choose not to do so? That seems very unlikely for a self interested sociopath…
  - pizza234 5y ago
    No, i suggest that, with the assumption that they're highly talented individuals with very marketable skills (especially since they're not restricted by geographic borders), and they're trading 100% legal professions with a high reward (say, 200+ k$/year) with a directly violent and basically illegal one, with a very high reward (they could make an order of magnitude more; that's not uncommon for high-calibre spam groups). Since direct violence is involved, in my opinion this requires a degree of sociopathy. I'm not sympathetic to spam groups either, but at least their profession doesn't have a direct contact with the victims.