10 ms·

Perfect example of the guilt-tripping crap seen in infosec. Where I come from, when you say if you do X, I'll pay you Y, it's unethical and a tort NOT to pay Y

by pierat 3y ago

Perfect example of the guilt-tripping crap seen in infosec. Where I come from, when you say if you do X, I'll pay you Y, it's unethical and a tort NOT to pay Y if you do X. You can do whatever contortions around 3rd parties (users). As long as the exploit vendor doesn't say they're doing anything illegal, I'm in the clear. I've had 1 vendor say that they were engaging in illegal activities, and refused to sell. Again, some may want to auction to highest bidder. Whereas I just like to eat. The companies are the ultimate unethical entities here, that summarily made everyone else look bad, all the while they're hitting users and saying "quit making us hit users!"

piva00 3y ago
> Where I come from, when you say if you do X, I'll pay you Y, it's unethical and a tort NOT to pay Y if you do X. Two wrongs don't make a right. I did agree that companies are being unethical if they don't pay, that does not give the leeway to then act unethically because of them. Again, ultimately who pays the price if an exploit that was sold is then used in the wild by bad actors are real life users. Also, the case being discussed is not about companies not paying X, the comment I replied was talking about not paying what the highest bidder would pay, that is not the agreement for a lot of zero-day programs offered by companies trying to secure their software, they give ranges of payments depending on severity of the exploit, not a "we will pay whatever is the highest bid you can get for your exploit". Is it guilt tripping to ask about ethical questions around infosec? That sounds to me like a thought-terminating cliche, attempting to terminate a discussion for what I believe is very clearly an ethical issue. It does have ethical ramifications, I will not stand on the side of "I will just auction to the highest bidder a potentially harmful exploit", that does not sit right with my moral code. > As long as the exploit vendor doesn't say they're doing anything illegal, I'm in the clear. I've had 1 vendor say that they were engaging in illegal activities, and refused to sell. What stops an exploit vendor from lying to you?

by pierat 3y ago

piva00 3y ago

> Where I come from, when you say if you do X, I'll pay you Y, it's unethical and a tort NOT to pay Y if you do X. Two wrongs don't make a right. I did agree that companies are being unethical if they don't pay, that does not give the leeway to then act unethically because of them. Again, ultimately who pays the price if an exploit that was sold is then used in the wild by bad actors are real life users. Also, the case being discussed is not about companies not paying X, the comment I replied was talking about not paying what the highest bidder would pay, that is not the agreement for a lot of zero-day programs offered by companies trying to secure their software, they give ranges of payments depending on severity of the exploit, not a "we will pay whatever is the highest bid you can get for your exploit". Is it guilt tripping to ask about ethical questions around infosec? That sounds to me like a thought-terminating cliche, attempting to terminate a discussion for what I believe is very clearly an ethical issue. It does have ethical ramifications, I will not stand on the side of "I will just auction to the highest bidder a potentially harmful exploit", that does not sit right with my moral code. > As long as the exploit vendor doesn't say they're doing anything illegal, I'm in the clear. I've had 1 vendor say that they were engaging in illegal activities, and refused to sell. What stops an exploit vendor from lying to you?