> it's usually just ordinary security researchers and devs with dubious morals (some are probably even former cybercriminals) not sure if we should easily judg

> it's usually just ordinary security researchers and devs with dubious morals (some are probably even former cybercriminals) not sure if we should easily judge offsec and the private-public partnership that provides intel and offensive capabilities. whether they're ex-criminals or must be accused of "dubious morals" would depend whether their clients (or targets) are what one considers the enemy. and what about the guy who silently works on a "dubious project" patiently for years ... and then, at the right moment, knowingly throws a spanner in the works? aren't they the true hero?