3 ms·
The security situation with these companies shows no signs of improving. My hot take is to make many forms of hacking legal so long as the hacker reports their
by Buttons840 4y ago
The security situation with these companies shows no signs of improving.
My hot take is to make many forms of hacking legal so long as the hacker reports their findings to the government. Let's have a free for all where every white hat and grey hat hacker gets to test the security of all companies, no permission from the companies required. Otherwise, it's only black hats that get to do the hacking, and they won't tell anyone when the find a vulnerability.
Everyone wins except for the companies who will be embarrassed they can't build a secure system to save their life. And they won't be able to legally bully someone for pressing F12 anymore.
This is important, it's a national security issue. Extreme measures like this are justified.
Some hacks, such as DDoS attacks might have to remain illegal. But otherwise, unless your proven to be stealing and selling data, let there be strong legal protections for those who responsibly report vulnerabilities.
And this is practical too. With vulnerability bounties you can solve the problem just by throwing money at it. But bounties can't be an opt-in thing, the companies who need them most are not opting-in.
- photon12 4y agoLack of knowledge of vulnerability is not the limiting factor in this case. All a "free for all" would do in this case is make more noise in which malicious actors can hide in the logs.
- Buttons840 4y agoAre you saying they're aware of all these vulnerabilities? Why don't they fix them? Can one of the wealthiest companies in the nation not fix vulnerabilities they're already aware of? What is the limiting factor here? Competence? My conspiracy theory is that my idea will never be implemented because it would expose the "job creator" class to an objective measure of their competence, and they would not fare well. Headlines like "97% of US organizations are incapable of building secure systems" would not be fun.
- photon12 4y agoYou can read lots of comments in these threads about the cost/benefit analysis of mitigating the vulnerabilities. And whenever that cost/benefit calculation gets very complex, the default is to not get too worked up about fixing the status quo because "it's complicated."
- Buttons840 4y agoYeah, the cost would be corporate profits, and the benefit would be privacy for average people. Given those tradeoffs, I'm not surprised that those benefiting from corporate profits say "it's complicated", and then choose the course that results in more profits for them (while harming the general public and national security). I'm not surprised, but not happy about it either. But this is turning into more of a political rant so I'll end here.