3 ms·

> Anyone who attacks a system with the intent of causing minimal harm and reporting what they find should be protected. Do you think that people should be allo

> Anyone who attacks a system with the intent of causing minimal harm and reporting what they find should be protected. Do you think that people should be allowed to penetration test your house without your permission? At what point does a system become big enough that you think people should be allowed to attack that system - regardless of its owner’s desires - as long as the attacker has subjectively good intentions? I am sympathetic to the idea behind your comment, but I don’t see how it’s compatible with strong private property rights. I don’t want you attacking my systems without my permission.

Buttons840 3y ago
A thought provoking analogy, but I don't think it's applicable because my house isn't performing an essential service for other people. A better analogy might be a friend stopping to double check that my front door is locked before he walks away leaving his child in my care. If we use an analogy at all, it must account for the fact that millions of bad actors are constantly wandering by and checking the security of my proverbial house. Like, if my house was on an extremely busy street and a someone came to me and said "hey, the lock on your front door doesn't work", I would not have them arrested, nor would it be practical for me to arrest every passerby that checked the lock for whatever reason.
jpambrun 3y ago
If my house depends on your house being sound, then yes, I should be allowed to nondestructively inspect your house form the outside or with whatever access you gave me. This analogy has limits, but I work in the medical field. I even worked at change healthcare until last year. The consequences of PHI data breach are almost unbounded. Furthermore, If I put my reputation and that of the business on your service you better bet I will poke around with whatever access you gave me.

Buttons840 3y ago

A thought provoking analogy, but I don't think it's applicable because my house isn't performing an essential service for other people. A better analogy might be a friend stopping to double check that my front door is locked before he walks away leaving his child in my care. If we use an analogy at all, it must account for the fact that millions of bad actors are constantly wandering by and checking the security of my proverbial house. Like, if my house was on an extremely busy street and a someone came to me and said "hey, the lock on your front door doesn't work", I would not have them arrested, nor would it be practical for me to arrest every passerby that checked the lock for whatever reason.

jpambrun 3y ago

If my house depends on your house being sound, then yes, I should be allowed to nondestructively inspect your house form the outside or with whatever access you gave me. This analogy has limits, but I work in the medical field. I even worked at change healthcare until last year. The consequences of PHI data breach are almost unbounded. Furthermore, If I put my reputation and that of the business on your service you better bet I will poke around with whatever access you gave me.