4 ms·

Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. They should have strong protections; they are helping all

Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. They should have strong protections; they are helping all of society and national security. Instead, we have politicians and executives who make legal threats to cover their mistakes and everyone suffers for it. I have this view because I have personally walked away from security problems I've discovered simply by pressing F12, I don't want the legal hastles and costs. Sadly, I think we're more likely to see pressing F12 become illegal, meanwhile society will lament that half the country's personal data is leaked on a weekly basis and ransomware runs rampant.

munificent 4y ago
> Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. Digital Good Samaritan laws.
- hinkley 4y ago
  There's an overlap between privacy, civil liberties, and anti-discrimination concerns where laws that can be selectively enforced get disproportionately applied to any and all groups that have 'isms' attacking them. I confess that while I used to spend quite a deal of time thinking about this class of problem, I haven't done much of it recently, so the following is a mix of potentially outdated thoughts and speculative nonfiction. If you have the privilege to be outside of any or all of those groups, I feel like it falls on us to speak up to ensure that other people are okay, and Good Samaritan laws can be problematic in this respect, because it's too easy to convince a jury to deny 'those people' standing. I wondered in another response if some sort of self-reporting system would better serve this space. Possibly 'feature-parity' with other citizen-action laws where community policing and reporting are carried out. The latter closes out a learning opportunity however because you're identifying and reporting a suspicion of an issue and allowing The Authorities to look into it. "We will take it from here." doesn't afford you the opportunity to become part of 'we'. Perhaps there's precedent with confidential informant laws, and we need to reframe white hat hackers under that umbrella.
FrenchDevRemote 4y ago
> Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. you mean increase the rewards?
- bowsamic 4y ago
  In America they are aggressively prosecuted
- Buttons840 4y ago
  No, I mean they need stronger protections. Knowing that I would probably prevail and get justice after spending 10s of thousands of dollars on lawyers was not enough protection for me to speak up about what I saw after pressing F12, and I suspect I'm not the only one who simply chooses to keep quiet and let the world burn. Give me stronger legal protection if you want my help.
hinkley 4y ago
Having better ways to telegraph your intentions is, as far as I'm aware, still an issue, and I would support improved/expanded methods of 'escrow' for this sort of work. Way back in college, I talked myself into doing a white-hat hack of a service another student was running that I valued highly. He had used software with a rather nasty CERT advisory outstanding. My attempts failed, which meant he had patched his system, probably at the firewall. I shrugged and went on with life. Or at least I tried to, because the next day I got an email from him telling me that he saw what I did and if I ever pulled shit like that again he'd report me to the Dean's Office. For the time, the university had some pretty sophisticated auditing tools to backtrack problems including shenanigans of this sort and because I was doing something 'good' I had just accessed his system straight from my dorm room (I found out shortly after that even if I had attempted to remote in he still would have been able to send that email). I offered an "apology" that was about what you'd expect from a 20 year old white male: all excuses and rationalization. It hadn't quite sunk in yet that this distinction between black and white hat existed solely in my brain. I don't even think I bothered to tell my roommate what I was planning to do. I had zero alibi because I was impulsive. I never did anything like that again. If memory serves, I told him I'd never do something like that again (which means it was sinking in a little bit), and that has been largely true. In hindsight, I was such an earnest kid that any decent lawyer could have would have been able to get me off with a warning, that would have saddled me with debts that would have fucked up my 20's, even if we had gotten a good rate through a family friend. I'd probably have still failed a background check on the piece of software that I worked on in my 30's that is and probably will remain one of the mantelpieces of my career. The Venn diagram of people with a suspicious enough mind to think of trying what I did and the personality that would keep them out of big trouble is very narrow. But to your point, the circles for aptitude, desire, and history are pretty small. As it turns out, I didn't enjoy being a low-bus-number person responsible for the security of the system, so I now fall outside of the 'desire' circle. These days I'm content to help people sort out/select auth libraries, configure CA certs, and occasionally talk trash about cryptocurrency. I have enough other interests that I'm probably booked out until after retirement.
- dfxm12 4y ago
  Way back in college, I talked myself into doing a white-hat hack of a service another student was running that I valued highly. "White hat" describes someone acting on behalf of the owner of the system being tested. It sounds like you acted on your own and thus were grey hat hacking. I only bring this up because it has different ramifications, legal, social, and otherwise.

munificent 4y ago

> Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. Digital Good Samaritan laws.

hinkley 4y ago
There's an overlap between privacy, civil liberties, and anti-discrimination concerns where laws that can be selectively enforced get disproportionately applied to any and all groups that have 'isms' attacking them. I confess that while I used to spend quite a deal of time thinking about this class of problem, I haven't done much of it recently, so the following is a mix of potentially outdated thoughts and speculative nonfiction. If you have the privilege to be outside of any or all of those groups, I feel like it falls on us to speak up to ensure that other people are okay, and Good Samaritan laws can be problematic in this respect, because it's too easy to convince a jury to deny 'those people' standing. I wondered in another response if some sort of self-reporting system would better serve this space. Possibly 'feature-parity' with other citizen-action laws where community policing and reporting are carried out. The latter closes out a learning opportunity however because you're identifying and reporting a suspicion of an issue and allowing The Authorities to look into it. "We will take it from here." doesn't afford you the opportunity to become part of 'we'. Perhaps there's precedent with confidential informant laws, and we need to reframe white hat hackers under that umbrella.

FrenchDevRemote 4y ago

> Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. you mean increase the rewards?

bowsamic 4y ago
In America they are aggressively prosecuted
Buttons840 4y ago
No, I mean they need stronger protections. Knowing that I would probably prevail and get justice after spending 10s of thousands of dollars on lawyers was not enough protection for me to speak up about what I saw after pressing F12, and I suspect I'm not the only one who simply chooses to keep quiet and let the world burn. Give me stronger legal protection if you want my help.

hinkley 4y ago

Having better ways to telegraph your intentions is, as far as I'm aware, still an issue, and I would support improved/expanded methods of 'escrow' for this sort of work. Way back in college, I talked myself into doing a white-hat hack of a service another student was running that I valued highly. He had used software with a rather nasty CERT advisory outstanding. My attempts failed, which meant he had patched his system, probably at the firewall. I shrugged and went on with life. Or at least I tried to, because the next day I got an email from him telling me that he saw what I did and if I ever pulled shit like that again he'd report me to the Dean's Office. For the time, the university had some pretty sophisticated auditing tools to backtrack problems including shenanigans of this sort and because I was doing something 'good' I had just accessed his system straight from my dorm room (I found out shortly after that even if I had attempted to remote in he still would have been able to send that email). I offered an "apology" that was about what you'd expect from a 20 year old white male: all excuses and rationalization. It hadn't quite sunk in yet that this distinction between black and white hat existed solely in my brain. I don't even think I bothered to tell my roommate what I was planning to do. I had zero alibi because I was impulsive. I never did anything like that again. If memory serves, I told him I'd never do something like that again (which means it was sinking in a little bit), and that has been largely true. In hindsight, I was such an earnest kid that any decent lawyer could have would have been able to get me off with a warning, that would have saddled me with debts that would have fucked up my 20's, even if we had gotten a good rate through a family friend. I'd probably have still failed a background check on the piece of software that I worked on in my 30's that is and probably will remain one of the mantelpieces of my career. The Venn diagram of people with a suspicious enough mind to think of trying what I did and the personality that would keep them out of big trouble is very narrow. But to your point, the circles for aptitude, desire, and history are pretty small. As it turns out, I didn't enjoy being a low-bus-number person responsible for the security of the system, so I now fall outside of the 'desire' circle. These days I'm content to help people sort out/select auth libraries, configure CA certs, and occasionally talk trash about cryptocurrency. I have enough other interests that I'm probably booked out until after retirement.

dfxm12 4y ago
Way back in college, I talked myself into doing a white-hat hack of a service another student was running that I valued highly. "White hat" describes someone acting on behalf of the owner of the system being tested. It sounds like you acted on your own and thus were grey hat hacking. I only bring this up because it has different ramifications, legal, social, and otherwise.