Hacker News Reader

Comment by eloff | Hacker News Reader

If I were a security researcher and put a lot of effort into finding vulnerabilities for Yahoo I would have simply sold the exploits to the highest bidder, and invited Yahoo to participate in the auction. If they lost, then I'd go to the press with the story of how little their user's security means to them (again to the highest bidder.) Either way, (only in the long run in the second case), the users win and I'd sleep like a baby.

It's just as well I'm not a security researcher.

Edit: Wow a lot of drive-by-downvotes. I'm not serious guys, but I hope I have made some people think about the moral issues involved. It's not as clear as people are making it out to be in other comments on this post.

View on HN

Why not just do the same for physical locations? You walk around a parking lot checking car doors, or maybe all the doors in an apartment building. If you find one unlocked, you text the owner and some local thieves so they can bid on the vulnerability...

Usually, behavior that would be shitty if done offline is just as shitty online. There is a fine line between freelance security research for bug bounties, which is basically crowdsourcing security testing, and rank extortion.

No, because in the car metaphor the person with the unlocked door is not putting thousands of innocents at risk. Now if he had an unlocked door, and the sign outside his building happened to read "Joe's Firearms and Ammunition" then forcing Joe to be more careful with his security, no matter if it's unpleasant for Joe, is a good thing for society on the whole. Doing that by auctioning the location of his store to thieves is obviously unethical.

But he is putting innocents at risk.

That's why in my jurisdiction you can get fined up to 2000 Euros for that (a realistic amount is a low double-digit amount -- if nothing further happens, of course).

Nope, Yahoo is putting innocents at risk for having the bug in the first place - the bug/risk/threat was there (and possibly known by blackhats) before the finding. It's the duty of Yahoo to find and fix issues with data that is entrusted to Yahoo - they can try to find everything themselves, or they can pay others to do it instead.

Pretty mercenary. What you propose is not ethically neutral... it is akin to blackmail.

It saddens me to see so many who feel this way.

If it leads to a better outcome, does it matter that it's blackmail? It's the age old moral question of do the ends justify the means. Like most moral questions the correct answer is not yes or no but "it depends." The real loser here would be the company with the retarded security policy, and they deserve what they get. If they have a bug bounty program, then naturally the ethical thing is to report the bug through the correct channels. If they don't then their users are the ones silently paying the price. If you wanted to be squeaky clean you could simply refuse to accept the highest bid if it wasn't from the company. In that case I really see no moral downside.

While the users would be paying the price, it would happens because you actively made the users suffer because you were not paid enough.

Even sitting on it is immoral, but in a lesser way. Users would then only lose in the case someone more malicious finds the same problem.

While it does violate a bunch of cultural moral norms ... there is absolutely an argument in there that overall, over time, it would produce a more positive outcome for users than a straight white hat approach.

Refuting or discussing the argument would be interesting; painting the suggestion as objectively wrong using emotive terms doesn't really move us forwards.

To argue the other side, I think it is wrong because you can't know that the good you do will outweigh the harm you do. But everything, even seemingly beneficial things, have both good and bad effects and morality seems to be the art of balancing them. However, if somehow you had knowledge that the long-term good far outweighed the short-term harm, it seems like it becomes the ethical thing to do. In real-life you don't usually get that kind of certainty though.

So what you're saying is that you're the kind of person that needs to be paid to not be a dick? Uh, congratulations?

No, if you read more closely, you'll see I'm the kind of person who likes to get paid for being a dick. My comment is a bit tongue-in-cheek, but the moral questions it raises are interesting. Well-being of company vs user. Short-term user security verus long-term user security. I don't think you can say categorically that it would be wrong, in some cases it could play out better for the innocent users. However, I don't think I'd really be comfortable selling an exploit to any party other than the company, but as mentioned in another of my comments here, the auction could be a bluff (especially if it's a hidden auction.)

Lol, fair enough ;)

Still, I think that the moral action (wherby "moral" I mean being disinterested and caring about outcomes for users) is fairly obvious in this specific case (Yahoo, has a good rep for taking security-issues seriously) - send them the patch that you have, regardless of compensation.

Yes, that's definitely more moral than my suggestion. However, you have to remember that not all "security researchers" are going to be so moral, and many of the more moral ones will simply not bother because they're not getting paid for their work. So users both gain and lose when you report an issue without compensation. It seems to me to be better to try to force the company into changing their policy, like what happened in this story. But it should be done without putting innocent users at risk (contrary to my original comment.)

At that point you've stopped even pretending to be a "security researcher"

Yes, I suppose I would need to get the business cards re-printed. "Professional Blackhat - ethics negotiable, for the right price."

That's some nice moral gymnastics to make selling exploits to criminals to mean that you actually did a favor to their victims.

Yes, it is cute isn't it? Being serious for a moment, I don't think you can justify harming users now in exchange for potentially better security for them down the road - even although it is bound to sometimes play out best for them overall. The problem is you can't know that, and you're responsible for what happens good or bad in this case.

That's a wrong way of looking at the situation.

You could just state that I'm wrong, or you could explain why you think that. The second is valuable, the first is a waste of a comment.

Edit: why would anyone downvote this? Other than the owner of the useless comment anyway... For the record, comments on HN should have substance, it's in the guidelines when you signed up.

Edit: why would anyone downvote this?

It's my policy to downvote any comment that complains about downvoting. However, it would be better in this case to not even respond to GP's inane scribbling. Trust the downvoters to get around to it eventually.

I prefer giving reasons why behavior should be corrected as opposed to downvoting and hoping they can divine why they were downvoted (like whoever downvoted my comment with the reason why his comment was bad, I have no clue what they objected to, so they accomplished little.)

Reply on news.ycombinator.com