Hacker News Reader

Comment by geppeto | Hacker News Reader

I looked through the task manager of a corporate issued laptop and saw tasks belonging to very similar companies, as part of the disk image IT makes.

The corporation likely has a license for the software, as well as conditions for all their employees to expect monitoring.

A formalized bug bounty program would enable the software producer to have secure software.

Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is.

Is all monitoring software now banned from HackerOne under the guise of a moral high ground HackerOne just created?

View on HN

>Why exactly is HackerOne drawing a distinction with this software producer? I read the whole article and still miss what the controversy with this producer is.

FlexiSpy specifically marketed itself as a tool for spying on your spouse. Their front page used to include "read your partner's sms" https://web.archive.org/web/20060402200643/http://flexispy.c...

So the issue about how oblique they make their marketing message? If they rebrand and use lots of innuendo, then it's OK?

In some respects, yes, it's about the messaging. You'll attract certain customers, and they might be willing to press for certain things that might not be legal, depending on the message.

There's a difference between a gun company that markets their products as protection and sports, and one that markets them for revenge. In both cases, the usage of the gun is up to me, but in one case it looks like the company might be willing to assist me, or point me towards helpful information that assists me, in circumventing safeguards put in place on the purchase of weapons.

You're being obtuse if you think this use-case wasn't a huge part of their thinking while designing the software and offering support to customers.

>I asked a FlexiSpy salesperson a simple question: If I wanted to, could I use their spyware to snoop on my wife's cellphone without her knowing? The answer each time was yes. When asked if it was legal, they responded with a canned disclaimer explaining it was necessary to get the permission of the target. But what if I didn't want my wife to know? They could help me anyway.

https://www.forbes.com/sites/thomasbrewster/2017/02/22/flexi...

I have no doubt it is what they're selling. But the question is if the tool does something, then the marketing message shouldn't really be relevant. If a FlexiSpy clone comes along and is less direct about spouse-spying, and plays a stronger line of "you need authorization", then it's suddenly OK?

>the marketing message shouldn't really be relevant

my point was that it isn't just marketing, this use-case was a huge part of their thinking while designing the software and offering support to customers. [repeating my comment almost verbatim]

If a clone came along that wasn't designed so that it can be totally hidden while installed, then privacy advocates would be less angry.

Many tools have legitimate and illegitimate uses. There is rarely a clear sharp line; we have to make a judgement as to whether a given tool does more harm than good, on the whole, and there are no shortcuts. IMO it's entirely right to weigh the marketing message in that balance; after all, the marketing will by design affect what kind of people buy the tool with what kind of intentions.

That's helpful feedback on missing context from our post. Thanks.

This series by VICE articulates the sometimes subtle distinctions between legitimate monitoring software built for enterprises and parents vs this particular software (which they deem "stalkerware").

https://motherboard.vice.com/en_us/article/inside-stalkerwar...

There are a lot of dubious companies on HackerOne. Why did taking a stance on this one have a perceived more positive outcome than taking any stance at all?

Pretty much zero of the companies on HackerOne are part of any social responsibility index, shariah compliant index, or trendy b-corporation index. And even in the non-zero rebuttal, the vast majority can have entire dissertations written about weighing the ethical considerations for doing any business with them.

So why even make a stance at all?

The time it takes for the arbitrary nature of your ethical decisions to become apparent is simply longer than it will take for your runway to deplete.

shariah compliant index?

Did you include that just to question the objective nature of morality?

B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience.

Standard & Poors operates shariah compliant funds right over in Toronto and is also very popular in many markets.

Maybe it doesn't mean what you think it means, maybe you'll learn

> B corporations and socially responsible investing are shariah compliant investing rebranded for an islamaphobic audience.

Shariah compliant investing follows specifically and explicitly from a religious moral basis.

SRI seems much more concerned with issues of Social Justice and human welfare, in ways not always inline with Sharia principles.

If you say they are similar, the burden is on you to demonstrate.

Significant overlap in the concepts such as avoiding companies into firearms, profiting from conflict zones, tobacco sometimes and other vices.

Thats the demonstration. Shouldn't bother you that much.

Why exactly is HackerOne drawing a distinction with this software producer?

The truth is: because a H1 rep went on Risky Business and did not deliver a very good performance.

Patrick, who is absolutely okay with H1 having FiveEye clients like the US DoD, has a very serious problem with them also servicing an obscure spyware application provider. Because, I suppose, being murder-droned by a panopticon hegemony is much better than getting yelled at by an angry spouse?

The purpose of the DoD is not to spy on people, it is to protect people. That some actions by some programs and and departments may cross the line legally during certain periods is not that same as an entity whose sole, or majority of goods or services are for, or marketed as being for, an illegal action.

In the first case, you have an entity that has a proven record of breaking the law (on purpose) using technology. I can also argue that the purpose of DoD now is to protect the elites, from the people, but that's another story.

In the second, the legal line is not crossed. It may be crossed at some point by an adult person that can bear responsibility for his actions.

I would not work with both; I can understand how can one not be a hypocrite by choosing to work with the latter and not the former, but not the other way around.

Is it the right moral choice to protect the privacy of a cheater? Maybe, I don't know, I'm struggling to answer that to myself, let alone judge others.

> Is it the right moral choice to protect the privacy of a cheater?

Is this spyware used to find out if someone is cheating? If so, it means you'd install it, and violate their privacy, without knowing if they are a cheater, so the point is moot.

I was not referring to the app, but in general to discover a cheater you'll most likely violate their privacy.

My point is that privacy in a relationship is a relationship thing, and the moral choice for me would be to not interfere in other peoples relationships. This includes not judging you if you use spyware on your wife.

> to discover a cheater you'll most likely violate their privacy

I'm not sure this is true. There are often clear boundaries, like secretly observing them in public versus accessing their private phones.

> privacy in a relationship is a relationship thing

but it's also a privacy thing. Is domestic abuse a relationship thing? That would also interfere with a relationship.

"The purpose of the DoD is not to spy on people, it is to protect people. "

To protect the elites as the other commenter said. Start with the claims of a person who led a bunch of wars after getting Medal of Honor:

https://www.ratical.org/ratville/CAH/warisaracket.html

https://en.wikipedia.org/wiki/Smedley_Butler

The same patterns kept happening over and over from there. The politicians got to play politics. The big, war contractors made billions. Their CEO's millions. After the drafts, the eventual "volunteer" army of mostly poor or working class kept dying for their BS about protecting "freedom" and "democracy." Look up Operation Ajax and compare to how that event is treated today to know plenty about what DOD does in the world. ;)

What's so refreshing about their post is that they admit not to have an unassailable "moral high ground". They highlight the strongest arguments, including those arguing against their decision.

They do this because they recognise that decisions often have competing trade-offs, nuances, ambiguity. There is, unfortunately, almost no recognition of this fact in public these days. You're expected to pick a side, defend it, and attack others, using whatever rhetorical tool is available.

Among those tools of destructive debate: reducing any ambiguity in your favour, i. e. "They are banning Z, and I don't know Z, so I'll argue that Z is like A and banning A would be wrong". Or, equally bad, the slippery slope: "Z may be bad, but you can't give me an algorithm that unambiguously distinguishes Z and Y, nor Y and X, or, by transitivity, Z and A. Therefore, you can't ban Z without also eventually banning A, and that would be bad".

There are plenty of corporate applications; the majority of them are obvious and the user knows what's happening (in my country at least [UK] any employee would need to be specifically told and likely have to sign something before it could be used). Monitoring isn't the issue.

The problem is spying. Enabling people to more reliably spy on others is a problem.

Making the decision seems a lot easier to me when the monitoring software explicitly markets itself to and supports domestic abusers.

Reply on news.ycombinator.com