Hacker News Reader

Comment by tptacek | Hacker News Reader

There is no universal duty to disclose security flaws. Some people have value systems that require disclosure (I'm one of them), but other people don't, and there are coherent, ethical rationales behind those value systems. A lot of it comes down to what you personally believe will happen after you disclose.

I'm automatically itchy when people talk about "ethical disclosure". If you truly do believe that people who become aware of vulnerabilities are ethically obligated to disclose them, setting terms on how they do that seems hard to defend. "Ethical" or "responsible disclosure" seem more like coercive rhetorical devices to get unpaid researchers to adopt the values and priorities of vendors than anything else --- that's part of the reason the term "responsible disclosure" has fallen out of fashion (it's been replaced with "coordinated disclosure", which is value-neutral).

View on HN

> Some people have value systems that require disclosure (I'm one of them), but other people don't

If you don't believe that your value system binds anyone else to behave in a certain way then how much does it really bind you to behave that way? Ethics and morality are either objective and universally binding or they're merely an arbitrary personal inclination that isn't even binding on those that have the inclination beyond legal or professional implications.

"Morality is either objective or completely arbitrary" is a false dichotomy. Obviously ethics isn't objective (I mean what would that even mean, absent some deity?), but with some reasonable foundational beliefs such as "I generally want people to have it good and not suffer", you're already pretty constrained and guided in your reasoning. But the belief that it's generally good when people don't suffer is obviously subjective, even if widespread.

Ethics is hard. There's a reason it's not a solved problem.

> "Morality is either objective or completely arbitrary" is a false dichotomy > some reasonable foundational beliefs such as "I generally want people to have it good and not suffer" > But the belief that it's generally good when people don't suffer is obviously subjective, even if widespread.

Why is generally not wanting to hurt people a "reasonable foundational belief?" It's definitely not universal in humanity right now let alone historically just look at the celebrations of war crimes in Russia. Everyone who thinks there are binding ethical beliefs in any way must ascribe it to others otherwise they're just talking about personal taste and we don't need words like "ethics" or "morals."

>> look at the celebrations of war crimes in Russia

Unfortunately this point doesn't prove/refute any point about morality.

Because most of the russians pro-war idiots (including most propaganda producers) sincerely believe propaganda and from their moral perspective they really are doing good by fighting Ukranian war criminals.

This is a discussion that started with notifying people of a possible webcam bug and ended with Russian war crimes. I think we can declare the thread spent.

Does Godwin's law need to be updated to mention Russia from now on?

I'm not sure what your point is. I think a good amount of people at least like to think they value the absence of suffering, which makes that a useful shared idea which ethical discussions can be had on top of, but my whole point is that it's not universal or objective.

Agreeing with the other comment, that’s a false binary in your logic. Ethics, and morality, are different things and can’t be contained in an either/or statement well.

Reply on news.ycombinator.com