4 ms·

If I were a security researcher and put a lot of effort into finding vulnerabilities for Yahoo I would have simply sold the exploits to the highest bidder, and

• umsm 13y ago
  That's a wrong way of looking at the situation.
  • eloff 13y ago
    You could just state that I'm wrong, or you could explain why you think that. The second is valuable, the first is a waste of a comment. Edit: why would anyone downvote this? Other than the owner of the useless comment anyway... For the record, comments on HN should have substance, it's in the guidelines when you signed up.
    • jessaustin 13y ago
      Edit: why would anyone downvote this? It's my policy to downvote any comment that complains about downvoting. However, it would be better in this case to not even respond to GP's inane scribbling. Trust the downvoters to get around to it eventually.
      • eloff 13y ago
        I prefer giving reasons why behavior should be corrected as opposed to downvoting and hoping they can divine why they were downvoted (like whoever downvoted my comment with the reason why his comment was bad, I have no clue what they objected to, so they accomplished little.)
• peapicker 13y ago
  Pretty mercenary. What you propose is not ethically neutral... it is akin to blackmail. It saddens me to see so many who feel this way.
  • eloff 13y ago
    If it leads to a better outcome, does it matter that it's blackmail? It's the age old moral question of do the ends justify the means. Like most moral questions the correct answer is not yes or no but "it depends." The real loser here would be the company with the retarded security policy, and they deserve what they get. If they have a bug bounty program, then naturally the ethical thing is to report the bug through the correct channels. If they don't then their users are the ones silently paying the price. If you wanted to be squeaky clean you could simply refuse to accept the highest bid if it wasn't from the company. In that case I really see no moral downside.
    • wmt 13y ago
      While the users would be paying the price, it would happens because you actively made the users suffer because you were not paid enough. Even sitting on it is immoral, but in a lesser way. Users would then only lose in the case someone more malicious finds the same problem.
  • mst 13y ago
    While it does violate a bunch of cultural moral norms ... there is absolutely an argument in there that overall, over time, it would produce a more positive outcome for users than a straight white hat approach. Refuting or discussing the argument would be interesting; painting the suggestion as objectively wrong using emotive terms doesn't really move us forwards.
    • eloff 13y ago
      To argue the other side, I think it is wrong because you can't know that the good you do will outweigh the harm you do. But everything, even seemingly beneficial things, have both good and bad effects and morality seems to be the art of balancing them. However, if somehow you had knowledge that the long-term good far outweighed the short-term harm, it seems like it becomes the ethical thing to do. In real-life you don't usually get that kind of certainty though.
• antimagic 13y ago
  So what you're saying is that you're the kind of person that needs to be paid to not be a dick? Uh, congratulations?
  • eloff 13y ago
    No, if you read more closely, you'll see I'm the kind of person who likes to get paid for being a dick. My comment is a bit tongue-in-cheek, but the moral questions it raises are interesting. Well-being of company vs user. Short-term user security verus long-term user security. I don't think you can say categorically that it would be wrong, in some cases it could play out better for the innocent users. However, I don't think I'd really be comfortable selling an exploit to any party other than the company, but as mentioned in another of my comments here, the auction could be a bluff (especially if it's a hidden auction.)
    • antimagic 13y ago
      Lol, fair enough ;) Still, I think that the moral action (wherby "moral" I mean being disinterested and caring about outcomes for users) is fairly obvious in this specific case (Yahoo, has a good rep for taking security-issues seriously) - send them the patch that you have, regardless of compensation.
      • eloff 13y ago
        Yes, that's definitely more moral than my suggestion. However, you have to remember that not all "security researchers" are going to be so moral, and many of the more moral ones will simply not bother because they're not getting paid for their work. So users both gain and lose when you report an issue without compensation. It seems to me to be better to try to force the company into changing their policy, like what happened in this story. But it should be done without putting innocent users at risk (contrary to my original comment.)
• wmt 13y ago
  That's some nice moral gymnastics to make selling exploits to criminals to mean that you actually did a favor to their victims.
  • eloff 13y ago
    Yes, it is cute isn't it? Being serious for a moment, I don't think you can justify harming users now in exchange for potentially better security for them down the road - even although it is bound to sometimes play out best for them overall. The problem is you can't know that, and you're responsible for what happens good or bad in this case.
• kneisley 13y ago
  Why not just do the same for physical locations? You walk around a parking lot checking car doors, or maybe all the doors in an apartment building. If you find one unlocked, you text the owner and some local thieves so they can bid on the vulnerability... Usually, behavior that would be shitty if done offline is just as shitty online. There is a fine line between freelance security research for bug bounties, which is basically crowdsourcing security testing, and rank extortion.
  • eloff 13y ago
    No, because in the car metaphor the person with the unlocked door is not putting thousands of innocents at risk. Now if he had an unlocked door, and the sign outside his building happened to read "Joe's Firearms and Ammunition" then forcing Joe to be more careful with his security, no matter if it's unpleasant for Joe, is a good thing for society on the whole. Doing that by auctioning the location of his store to thieves is obviously unethical.
    • Tomte 13y ago
      But he is putting innocents at risk. That's why in my jurisdiction you can get fined up to 2000 Euros for that (a realistic amount is a low double-digit amount -- if nothing further happens, of course).
      • PeterisP 13y ago
        Nope, Yahoo is putting innocents at risk for having the bug in the first place - the bug/risk/threat was there (and possibly known by blackhats) before the finding. It's the duty of Yahoo to find and fix issues with data that is entrusted to Yahoo - they can try to find everything themselves, or they can pay others to do it instead.
• bcoates 13y ago
  At that point you've stopped even pretending to be a "security researcher"
  • eloff 13y ago
    Yes, I suppose I would need to get the business cards re-printed. "Professional Blackhat - ethics negotiable, for the right price."