Hacker News Reader

Comment by schoolornot | Hacker News Reader

> As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches.

In some ways this reminds me of a phishing exercise at work that was done under the guise of security awareness training. Is it just me or is there a pattern of behavioral issues among security people and a lack of empathy.

View on HN

At least those phishing exercises are done with the informed consent of the organization.

If they go too far and impact day-to-day work, or if people complain, the executives understand what is going on and who they can talk to about improving the process.

And if it feels lacking in empathy, consider that the company's management needs to sign off on any (legal) phishing tests that their employees are subjected to.

Please note that the senior management is always in the loop for the phishing tests along with some of the security team. It's just the users who are not told. You can't just send out a phishing email without telling anyone about it, you are liable to get fired for it. Remember the first rule of cybersecurity testing is to get written permission and then establish rules of engagement.

All these researchers had to do was reach out to Greg, loop him in the study to get his go ahead for it.

Now that several of these 'patches' are now in stable and in fact did introduce issues is a big problem and a major waste of time for the maintainers.

In my experience, it's not a lack of empathy, but trying to prove to management that they shouldn't get rid of the security team. At most companies I've done security testing at, telling management that you didn't find any vulnerabilities immediately puts you and your team on the chopping block because they think you're a waste of money if you don't find anything. I've noticed it's mostly new people who aren't confident they can easily find a job are the ones most often going out of their way to report security issues that aren't actually a big deal.

Reply on news.ycombinator.com