5 ms·

Serious question. If Apple won’t treat you in an ethical manner then why go the ethical route? Why not just sell the sploit to the highest bidder? Seems like th

Serious question. If Apple won’t treat you in an ethical manner then why go the ethical route? Why not just sell the sploit to the highest bidder? Seems like there’s a misplaced and unreciprocated sense of integrity on the part of many researchers.

lucasyvas 5y ago
I think this is a great question - In my opinion, carving the ethical path from the start can and should fulfill any moral obligation you might have. If they don't want to play ball, take it to someone that will appreciate your work. Should it be used nefariously, you are still helping because they might take you more seriously next time, as they should have in the first place. carrot versus stick.
saagarjha 5y ago
One, just because someone else is being unethical doesn't mean you can drop your ethics. Two: you don't really want to expose users to the exploit.
- paulryanrogers 5y ago
  Considering the half hearted and sluggish response of certain huge companies I can see why some researchers chose the middle path and publicly disclose immediately.
- ryanmarsh 5y ago
  Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.
- manquer 5y ago
  Usually such poor community engagement correlats to lack of acceptance or slow fixing timings. The best recourse is to disclose publicly after set number of days (90).
- anm89 5y ago
  Disagree if Apple is willfully mistreating people who it knows have zero days on them and want to work with them on fair terms, and then those zero days end up in the wrong hands, I place the blame SQUARLEY on Apple. I'm not going to victim blame a security researcher trying to put food on the table or provide for their family for what Apple forced their hand to do. simply put if Apple doesn't find a way to come to an agreement with this person in a timely manner, they are just saying they see the zero day and the consequences for their users as acceptable losses as preferable to the payment
chuckee 5y ago
Because you will harm not only Apple, but also their users, who Apple has misled into thinking they are the secure choice.
bawolff 5y ago
Apple is not behaving unethically here. There is no ethical imperative for apple to pay you or roll out the red carpet for you. Their ethical obligation is to not try to attack you legally or silence you. Beyond that, there is no obligations, just behaviours that are "nice".
- saagarjha 5y ago
  Apple has an ethical obligation to write secure software and incentivize efforts that would do this.
- tweetle_beetle 5y ago
  Couldn't it be argued that they have a moral imperative to protect their customers and those whose livelihoods depend on the Mac ecosystem (internally and externally). I suppose obligations to shareholders are similar, but more transactional than moral.

lucasyvas 5y ago

I think this is a great question - In my opinion, carving the ethical path from the start can and should fulfill any moral obligation you might have. If they don't want to play ball, take it to someone that will appreciate your work. Should it be used nefariously, you are still helping because they might take you more seriously next time, as they should have in the first place. carrot versus stick.

saagarjha 5y ago

One, just because someone else is being unethical doesn't mean you can drop your ethics. Two: you don't really want to expose users to the exploit.

paulryanrogers 5y ago
Considering the half hearted and sluggish response of certain huge companies I can see why some researchers chose the middle path and publicly disclose immediately.
ryanmarsh 5y ago
Sometimes the ethical thing to do is adversarial. It forces better behavior for short term pain. As far as exposing users, that makes assumptions about the actions of a number of people including the company in question which could, if it so desired, assemble the resources to push a fix within 48 hours.
manquer 5y ago
Usually such poor community engagement correlats to lack of acceptance or slow fixing timings. The best recourse is to disclose publicly after set number of days (90).
anm89 5y ago
Disagree if Apple is willfully mistreating people who it knows have zero days on them and want to work with them on fair terms, and then those zero days end up in the wrong hands, I place the blame SQUARLEY on Apple. I'm not going to victim blame a security researcher trying to put food on the table or provide for their family for what Apple forced their hand to do. simply put if Apple doesn't find a way to come to an agreement with this person in a timely manner, they are just saying they see the zero day and the consequences for their users as acceptable losses as preferable to the payment

chuckee 5y ago

Because you will harm not only Apple, but also their users, who Apple has misled into thinking they are the secure choice.

bawolff 5y ago

Apple is not behaving unethically here. There is no ethical imperative for apple to pay you or roll out the red carpet for you. Their ethical obligation is to not try to attack you legally or silence you. Beyond that, there is no obligations, just behaviours that are "nice".

saagarjha 5y ago
Apple has an ethical obligation to write secure software and incentivize efforts that would do this.
tweetle_beetle 5y ago
Couldn't it be argued that they have a moral imperative to protect their customers and those whose livelihoods depend on the Mac ecosystem (internally and externally). I suppose obligations to shareholders are similar, but more transactional than moral.