3 ms·
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar
by PaulRobinson 2y ago
I think if somebody wants to describe themselves as an "ethical hacker", and a conference wants to let people talk about exploits they've found, the minimum bar for disclosure is at least a description of a mitigation that could be taken, and ideally an actual code diff if its an open source project.
There's a bit of street cred for finding a 0day, a bit of glamour about figuring out the puzzle. There's not much for the person who fixes it. I think as an industry it might be worth trying to fix that somehow.
- calvinmorrison 2y agoSelling hacks is ethical
- berkes 2y agoWhy? And: Always?
- calvinmorrison 2y agoPaying for bounties is paying for exploits. That is to say, choosing not to pay for exploits is tantamount to selling your customers off for a price, the price of the bounty.
- PaulRobinson 2y agoLet's suppose you are right. Why not accompany that with a proposed fix, too?
- frogsRnice 2y agoDon’t necessarily agree that selling hacks is ethical, but if I already spent time figuring out how to exploit a system - reporting it to the relevant place is charity. Ill do that, but Im definitely not spending time trying to fix the code if the solution isn’t immediately obvious. ++ so if you have to fight to get the bug recognised in the first place
- SoftTalker 2y agoI actually agree, in the same way that selling lock picks or guns is ethical. They are just tools. How they are used is the responsibility of the person wielding them.
- bigyikes 2y agoI can think of benign uses for lock picks and guns. What is the benign use of a secret exploit?
- bratwurst3000 2y agoit doesnt have to be secret. for example unlocking old phones. There are certainly people waiting for the right exploits to get access to their old wallet.
- username44 2y agoOne example I can think of is the WoW private server Warmane uses an RCE to extend client functionality. https://www.reddit.com/r/wowservers/comments/1eebxwf/warning_rce_exploit_in_335_game_client/ https://www.reddit.com/r/wowservers/comments/1eebxwf/warning...
- SoftTalker 2y agoYou've never needed to get root access on an old computer when nobody knows the password?