5 ms·

>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. There is even a bigger problem. These research

>Calling the police on security researchers...I honestly cannot believe this is considered acceptable behavior. There is even a bigger problem. These researchers, even if they were negligent, are far more at risk of legal punishment for creating a small risk for the sake of increasing safety standards overall than the people who choose to cut security funding and put magnitudes more people at risk for the sake of making more money. Isn't it odd that we have a legal system where the ones attempt to expose and fix the problem for the sake of safety are facing far greater legal trouble than those who knowingly allowed for the problem to first occur due to increasing profits?

danielweber 11y ago
I think researchers should have complete 100% legal cover if they test private vehicles and private roads. But as someone who says the car manufacturer ought to face legal consequences for failing to fix a remotely exploitable stall-out in a timely manner (even without demonstration of anyone being harmed), I also say that people who fuck with moving cars on the road are a menace as well.
- the8472 11y ago
  We could easily reverse that reasoning: Security researchers should only be liable for potential risks if we manage to hold those companies for potential risks. If we fail to do the latter it's quite unfair to let individuals bear the brunt of legal enforcement.
  - Lawtonfogle 11y ago
    Unfair but also of great benefit to the corporations creating products with security holes. It reminds me of 'identity theft' where the average citizen bears the risk due to the poor verification practices of loaning institutions instead of the institutions who create the risk as a byproduct of profiting off making the loans. If anyone thinks this is accidental, you should contact me as I have a great deal on this new bridge that is about to hit the market.
- TheIronYuppie 11y ago
  Depends. For example, in some states, it's still illegal to put someone intoxicated in a car driving on private vehicles on private roads. http://www.lawyerinlongbeach.com/Torrance-DUI-Attorney.html http://www.lawyerinlongbeach.com/Torrance-DUI-Attorney.html
freshyill 11y ago
A small risk? Disabling a car on a busy highway is not a small risk. What about this "experiment" could not be done in controlled environment on a track… or a country road… or an empty parking lot. I suppose we could just have infectious disease researchers set up shop on a street corner by this logic. Whatever! It's just a small risk! They're doing it for the sake of increasing safety standards!
- Lawtonfogle 11y ago
  Small compared to the risk of under-funding security research as a cost cutting measure knowing that weaken security will allow for these exploits to occur.
  - freshyill 11y ago
    OK, just making sure I follow: They should exploit security holes and put people at risk to ensure that security research is not underfunded, which could lead to someone exploiting security holes, which would put people at risk.
    - Lawtonfogle 11y ago
      Your argument would make sense if all exploits were equal. Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease. The weakened form, while it may not be risk free, is not equal to the harm of a full own infection.
      - freshyill 11y ago
        > Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease. If these guys want to be regarded as researchers, they need to act like them and be accountable like them. No ethics committee would ever approve a test like this.
hsod 11y ago
It doesn't strike me as so odd, and your framing of the situations doesn't strike me as particularly conducive to honest discussion. The people who "choose to cut security funding" (I'm assuming you mean congress?) acted within the bounds of the law and within their power as elected officials. They broke no laws and your disagreement with the results does not make them criminals. I don't know if these researchers broke the law. All that's happening now is they are being investigated. If they did break the law, then it seems to me perfectly logical that they would be in "far greater legal trouble" than someone who didn't. TL;DR it's not odd that someone who broke the law is in more legal trouble than someone who didn't

danielweber 11y ago

I think researchers should have complete 100% legal cover if they test private vehicles and private roads. But as someone who says the car manufacturer ought to face legal consequences for failing to fix a remotely exploitable stall-out in a timely manner (even without demonstration of anyone being harmed), I also say that people who fuck with moving cars on the road are a menace as well.

the8472 11y ago
We could easily reverse that reasoning: Security researchers should only be liable for potential risks if we manage to hold those companies for potential risks. If we fail to do the latter it's quite unfair to let individuals bear the brunt of legal enforcement.
- Lawtonfogle 11y ago
  Unfair but also of great benefit to the corporations creating products with security holes. It reminds me of 'identity theft' where the average citizen bears the risk due to the poor verification practices of loaning institutions instead of the institutions who create the risk as a byproduct of profiting off making the loans. If anyone thinks this is accidental, you should contact me as I have a great deal on this new bridge that is about to hit the market.
TheIronYuppie 11y ago
Depends. For example, in some states, it's still illegal to put someone intoxicated in a car driving on private vehicles on private roads. http://www.lawyerinlongbeach.com/Torrance-DUI-Attorney.html http://www.lawyerinlongbeach.com/Torrance-DUI-Attorney.html

freshyill 11y ago

A small risk? Disabling a car on a busy highway is not a small risk. What about this "experiment" could not be done in controlled environment on a track… or a country road… or an empty parking lot. I suppose we could just have infectious disease researchers set up shop on a street corner by this logic. Whatever! It's just a small risk! They're doing it for the sake of increasing safety standards!

Lawtonfogle 11y ago
Small compared to the risk of under-funding security research as a cost cutting measure knowing that weaken security will allow for these exploits to occur.
- freshyill 11y ago
  OK, just making sure I follow: They should exploit security holes and put people at risk to ensure that security research is not underfunded, which could lead to someone exploiting security holes, which would put people at risk.
  - Lawtonfogle 11y ago
    Your argument would make sense if all exploits were equal. Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease. The weakened form, while it may not be risk free, is not equal to the harm of a full own infection.
    - freshyill 11y ago
      > Think of it more like infecting people with weakened/dead forms of potentially deadly diseases so they will be better protected against that disease. If these guys want to be regarded as researchers, they need to act like them and be accountable like them. No ethics committee would ever approve a test like this.

hsod 11y ago

It doesn't strike me as so odd, and your framing of the situations doesn't strike me as particularly conducive to honest discussion. The people who "choose to cut security funding" (I'm assuming you mean congress?) acted within the bounds of the law and within their power as elected officials. They broke no laws and your disagreement with the results does not make them criminals. I don't know if these researchers broke the law. All that's happening now is they are being investigated. If they did break the law, then it seems to me perfectly logical that they would be in "far greater legal trouble" than someone who didn't. TL;DR it's not odd that someone who broke the law is in more legal trouble than someone who didn't