Hacker News Reader

Comment by morsch | Hacker News Reader

He's not saying they must conform with these ambiguous rules. But if they don't, it's fair to be contemptuous of them. There is nothing at all unusual about this, there are lots of actions that won't get you in jail but will get you punished in various social manners.

Social pressure can later be codified into a legal solution, but in some cases the rules are necessarily ambiguous and resist codification, in which case social pressure is the next best thing.

View on HN

> He's not saying they must conform with these ambiguous rules. But if they don't, it's fair to be contemptuous of them. There is nothing at all unusual about this, there are lots of actions that won't get you in jail but will get you punished in various social manners.

I disagree, though. They're following the law as written, which the vast majority of people and organizations do daily. The distinction is that by doing so, they've found a "bug" in the system, and that's something that deserves admiration rather than contempt. Here's the analogy: someone spots a bug in a program, and they're exploiting that bug in a way that's harming other users. Who deserves those users contempt more: (1) the hacker who found & exploits the bug; or (2) or the quiescent software developer who fails to timely patch that bug? I think it's (2), which is why I'm reluctant to socially punish NPEs. They're publicizing flaws in patent legislation to the detriment to many innocents. Consider this akin to "crowdsourcing" Congress, subject to a cost function (namely, the magnitude of harm suffered by the innocents). It's Congress' continued inaction that deserves the magnitude of our contempt; socially vilifying the 'hacker' is just a band-aid solution.

Consider this: what happens when that same hacker then spends some of the money he stole from legit users to lobby the software company to ignore the bug in the system (or make it even easier for him to exploit). Do you still admire his ingenuity? Or do you (rightfully) despise his inability and unwillingness to play by the rules that everyone else follows, because he has been able to use his dirty money to keep the loopholes open?

To lobby a software company? That makes no sense. If anything, that hacker would be lobbying Congress...and frankly, that's his or her prerogative. I don't care what they do. It's not dirty money just because you say it is; it's legally-acquired money that a subset of the population feels was obtained illegitimately. I don't like what has happened with the patent system any more than you do, but I'm choosing my battles. I'm disdainful toward patent trolls; I'm thankful for them, because they effectively give me work (invalidating their patents)

"I don't care what they do."

Exactly the point of the OP. Thanks for not helping.

Both. If hacker who discovered bug in a system should have reported it, instead of exploiting it.

However, the analogy is flawed because if you find a loophole in the law and it is discovered you are usually not liable. If, however, you find a "bug" in an inadequately secured system you are still likely to be liable for exploiting it. Similarly, if you find physical security exploit in a building (a broken window, unlocked) you can still liable for taking advantage of it (trespassing, etc).

However, you point was about "admiration" vs. "contempt." This is obviously a matter of opinion, but I don't share admiration for hackers who take advantage "exploits" without at least attempting to report or taking some other "good faith" action. Neither writing software nor governing a society is easy. Finding and reporting "bugs" is a helpful and productive activity, exploiting "bugs" is not.

It's the difference between someone who has a lot of exposure to software bugs deciding 1. this is something we need to work to fix versus 2. this is a potential way to make money as long as it stays broken if we take a role as middlemen in the problem.

I'll detail the analogy more in another comment below.

Except patent trolls are not even close to the first groups of people to notice this "bug." Many "white hat hackers" came first; there are many law review articles published concerning the flaws in the patent system. It's not like Congress didn't know about it. They, like always, decided to punt. This is their wake-up call.

Reply on news.ycombinator.com