13 ms·
The White Hat's Dilemma
- Selfcommit 13y agoWho is the finnish guy?
- interknot 13y agoMikko Hypponen, from F-Secure. http://mikko.hypponen.com/ http://mikko.hypponen.com/ http://www.f-secure.com/weblog/ http://www.f-secure.com/weblog/
- deleted 13y ago[deleted]
- dajusu 13y agoWhat letter was asked to be signed at the end?
- secalex 13y agoThe EFF's CFAA reform letter. They had folks in the room to gather paper signatures from attendees, and remote folks will eventually get a chance to sign electronically. https://www.eff.org/deeplinks/2013/08/letter?utm_source=twitterfeed&utm_medium=twitter https://www.eff.org/deeplinks/2013/08/letter?utm_source=twit...
- gnosis 13y agoDoes anyone have a link to a plain-text version of this that doesn't require access to the Google spyware site?
- casca 13y agoAre you asking for this? https://docs.google.com/presentation/d/1UfOxCIIlcU-iRcUeA6p6fyEE4qUbSuFMqmSuWjRsL_4/export/pdf https://docs.google.com/presentation/d/1UfOxCIIlcU-iRcUeA6p6...
- delinka 13y agoI think you missed the whole "...doesn't require access to Google..."
- glomph 13y agohttps://mega.co.nz/#!VAkR2bzR!cn7P3VIsAR2ub8O2T6acJCCGgK1vaNlbpqATowabtEw https://mega.co.nz/#!VAkR2bzR!cn7P3VIsAR2ub8O2T6acJCCGgK1vaN...
- casca 13y agoI love the Ultima 4 reference
- secalex 13y agoThanks. Still my favorite game ever.
- neilk 13y agoWhat class did you get?
- secalex 13y agoI don't remember what I got the first couple of times I answered honestly. I do remember manipulating the system to become a Paladin, which perhaps negates the entire point of the morality system and makes me a rogue in real life.
- neilk 13y agoYeah, I did the same thing. I wanted to be a Ranger, because Aragorn in Lord of the Rings is one, so I manipulated my answers. Plus it's in the center of the graph, so I thought that had to be better. But, I do recall I would get Mage (Honesty) if I did it, er... honestly. Today I get Bard (Compassion). I guess people really do change over the course of their life.
- throwaway3902 13y agoI used to work for Blizzard. The Chinese government requested that we modify the WoW client so that they could intercept all chat. As far as I know, no-one said anything, including me - and Blizzard, of course, was more than happy to comply, given the size of the market and the risk of being forbidden to do business there. There were plenty of other MMOGs happy to play ball and eat that cake. I didn't say anything. It was happening to "them", Chinese nationals. Not only that, but "they" should know better than to say sensitive things online, because even if we didn't install the back door, I reasoned, it wouldn't be too hard to get that data through various other means. I really regret not only my participation, but not making a big stink about it. No-one did. I strongly suspect that that same system is being being used domestically, now. Clearly it was the wrong thing to do. I've regretted my role in that implementation for several years. I shouldn't have participated, and I should have protested. Even if it didn't stop it, at least the company leadership might have felt the heat. But I was a coward and I didn't want to lose my job, didn't want to fight a legal battle, and, like I said, it was just China spying on it's people, which everyone knew they do anyway. And who knows? The news probably would have been ignored, or, if it wasn't, I might have been branded as a coward and a disloyal employee, betraying the people who put food on my table. And I being under 30, overpaid, over-priviledged, etc. I can hear the Fox News commentators even now. That, to me, has been the most difficult thing about Snowden, is that here's someone who did the right thing, who revealed wrong-doing on the part of our government, and there are a lot of people who say he's the wrongdoer, who attack him as disloyal and worse. A back door in a game used by China? Who would even care about that? And if they did, I'd just be torn to shreds, unemployable and with heaven-knows-what kind of future. The reaction to Manning and Snowden, particularly the lack of strong public support, sends a strong signal that people don't want to know. They don't want to upset the apple cart. They don't want to challenge the government, they don't want to question it, not even when it's clearly violating it's own most important rules - the rules that, presumably, we've been fighting to promote these last 200 years. It seems hopeless.
- ihsw 13y agoThat's what it means to be an ideologue - willingness to die for your values. Don't be ashamed about your decisions, a strong sense of self-preservation is perfectly natural.
- cyanbane 13y agoGreat presentation and something that programmers in general (not just infosec) need to have a personal decision model for. Everyone should be able to make their own decision to these questions as they see fit, but the more we talk about issues like this the more we see where other people like us (who maybe were put into this position in the context of "work") have decided on a stance (and the repercussions of said stance) the better off we all are. We who work on machines and not man don't have an oath that we are taught to follow and/or live by, and I don't necessarily think we should. That being said, the Jr. programmer working for a small firm can encounter decisions of ethical importance as much as a black/white/grey/green/mauve hat infosec can. To me, this is the core value of what a site like HN provides and probably the main reason I read the comments on HN more than I do the articles.
- scotty79 13y agoI'd say correct answer almost always is to leave quietly. Let's leave doing immoral things to immoral people and let's hope their employers starve due to elevated fees. Also if you live in US you should always put your own safety in the first place. US justice system becomes most significant threat to capable citizens.
- glomph 13y agoI think it is worth thinking about the idea that whatever your particular moral framework is it should not be about 'making a difference' but making the most effective difference you can. Actually if you hold something to be important you should want to do the most that you can. Exceedingly often what this means is doing something different to the majority of people. Often this goes against conventional wisdom.
- tptacek 13y agoHere's an alternative vantage point, my vantage point, one I think makes these kinds of ethical quandaries easier to navigate: * I'm not a "white hat" or a "black hat" * I'm not deliberately involved in any kind of "cyber" conflict * I don't do what I do because I'm battling the forces of evil, or organized crime, or anything else Instead: I do engineering. The same way a contract driver developer does, or a Rails dev. I happen to work in a particularly challenging problem domain. My work happens to have some interesting implications. But those implications are not the reason I work in the field; I work here because it allows me to grapple with compilers, number theory, low-level networking, hardware, OS kernels, and every imaginable development platform. It's about the craft. I find this vantage point, which appears amoral, makes the ethical dilemmas easier to resolve. If a company like Narus asks me to help them make a network monitoring system harder to evade, I don't have to put that request into some ethical framework that considers the good that application might do. I just turn the work down. Same goes for the US Government; no, sorry, not interested. Total respect for Alex (the "white hat consulting company" he founded is iSec Partners, our sister company and former archrival). I get the sense that Alex engages intentionally with these dilemmas, that he wants to be a part of something larger than himself and, I think, larger than the craft. As a result, sure, he has to live a carefully examined life, and make sure the projects he's working on aren't skewing his compass. I admire him for picking his way through those problems. But I'm every bit as engaged with the field as Alex is, and I'm here to tell you that you don't have to get tangled up in these kinds of ethical problems if you don't want to.
- cgag 13y agoWhat about this vantage point leads you to say no when Narus asks you to help with their spy software or whatever?
- dylangs1030 13y agoIt's categorical rejection. Instead of opening up that venue and having to navigate the murky waters of cognitive dissonance and moral obligations against lucrative opportunity, you simply don't open the door. You stick to a client base that is meaningful (relatively so) but not highly impactful and potentially dangerous down the road.
- dlitz 13y agoSlide 28. What does "IR" mean?
- agnokapathetic 13y agoIncident Response
- dlitz 13y agoThanks!
- deleted 13y ago[deleted]
- Qantourisc 13y agoWhy do people even sign NDA's ?
- lmartel 13y agoHave you ever worked for a company that didn't ask you to sign one? That's not rhetorical, I'm curious--it seems that virtually every company has some amount of proprietary information, isn't that what drives competitive advantage in software?
- xnxn 13y agoSure, I've never had to sign one (for any employer).
- osivertsson 13y agoI signed them when I was younger, but have been able to avoid them since a couple of years. In my opinion, the law should be enough in most cases. Recently I was offered a good and well-paying job. Late in the recruitment phase there was this far-reaching NDA I would have to sign. I asked to be given two days to read and evaluate it, which apparently labeled me as someone very strange, I should just flip through it in 10 seconds and sign like everybody else. Two days later when I questioned their HR/Legal about some of the clauses they got very uncomfortable, and tried to avoid making a big deal out of them, saying it was "standard" and "at this site, they had never taken anyone to court based on it". I didn't sign, and hence they could no longer offer me the job. Oh well, their loss, they would have to do without the value I could provide to their business.
- lmm 13y ago> That's not rhetorical, I'm curious--it seems that virtually every company has some amount of proprietary information, isn't that what drives competitive advantage in software? Very rarely in the software side IME. Software is basically a commodity at this point - sure, there are better and worse ways to write it, but given the requirements and UI, any vaguely competent company could implement it in comparable timeframes. Competitive advantage tends to lie either in a faster turnaround time on making changes (but there's no secret to how you do that - hire good programmers and keep your codebase clean - taking a competitor's code is not going to help with this), or in the non-software side of the business (client relationships etc.)
- nonchalance 13y agoI question the slide regarding trade secrets: * the names are misspelled: first person is Sergey Aleynikov (not alinikov) and second person is Samarth Agarwal (not agrawal) * in each circumstance, there was actual trade secret theft. That part is clear. The slide itself seems to suggest something beyond that, but they essentially took code that they wrote for their employer (and they signed contracts clearly saying that it belongs to the employers)
- secalex 13y agoThank you for catching the spelling mistakes. The point of that slide is that trade secret theft is a very old problem, and that there is a long history of criminal and civil case law to look to when punishing that kind of action. Those individuals were all charged under the Economic Espionage Act and face extreme penalties. I see this as another version of overcharging under the CFAA; the Federal Government has one standard for doing something on paper and a much harsher one for the same activities while using an SVN repo. I am not defending the actions of those men, I just feel that the civil remedies that have been used for decades are more appropriate than having the soul-destroying power of the US DOJ turned against them on behalf of their employers. The ethical dilemma exists for the technologist who performs the investigation and testifies against her former co-worker. What responsibility does she have to see justice done? I don't have an answer, but that was the question posed by the slides on justice.
- chipsy 13y agoMy favored moral framework for most situations is the noblesse oblige: If, by chance or by choice, you have the privilege of affecting a lot of people, you now have the responsibility of supporting the most marginalized members of that group, regardless of whatever prejudice against them you may have had. This is, in a lot of cases, a nearly impossible obligation to completely fulfill, but in application, it leads to both a closer examination of privilege and to moral decisions and outcomes that are progressive.
- treenyc 13y agoThank you ALex for bring up these issues. I just would like to point out that ethics and morality are both normative propositions (in the sense that they are different cross culture and society). Basically what is consider desirable vs. undesirable behavior. As we all must have found out by now, what is consider desirable and undesirable that very different from place to place. It would perhaps to be more constructive to consider a positive model of integrity (Positive as in positive theory in economics). In many ways we have confused morality and ethics with integrity. Integrity when distinguished in the positive model it can be apply consistently across culture, societies, groups or organization (kind like the law of gravity). For those who are interested, you download the short paper by Dr. Mike Jensen on social science research network related to positive model of integrity: http://ssrn.com/abstract=1511274 http://ssrn.com/abstract=1511274
- Rickasaurus 13y agoWas this talk recorded?