On one hand your right to run your business as you see fit and respecting your principles.
On the other hand you have discrimination of all kinds.
Think about the recent cases of a small baker with strong religious views refusing to create cakes for gay couples.
Think about CloudFlare protecting ISIS sites.
1. there are evil people, but
2. those people frequently have more social power than nice people, and
3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.")
If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers" built into your system will mostly be used by those with power against those without it, regardless of which side is "correct."
So: If you let people speak freely, the powerful will shout down the powerless. But if you let people silence others, then the powerful will silence the powerless.
Morally, it really comes down to a choice of which kind of hammer hurts wronged innocent powerless people the least. (Which can often mean offering no hammer that can truly be used to "deal with" obviously-evil people.)
At Matasano, we wouldn't do work for the USG or arms manufacturers. We didn't have a coherent framework to fit that decision into. We just wouldn't do it. I worry that we may be overthinking things here.
I agree that going with your gut feeling is very likely good enough, but I don't agree with the term "overthinking". I think codifying the decision a bit is beneficial, as any of us is likely to run into a case that falls into a gray area, and having more fleshed-out decision lines will be helpful in that case.
I think it's the same in ethics vs morals. The ethics you inherited from society will be good enough for the vast majority of decisions, but sometimes it's good to logically deduce morality for yourself. You might realize you used to believe things that didn't stand to reason.
Though I completely agree with HackerOne's moral stance here, does this particular scenario complicate things?
EDIT: I do see they took this into consideration in their writeup... still curious.
Because that's mostly my stance on the question "should a project have a code of conduct?": It's overspecifying things because we believe we can control them better the more we're spelling it out.
I'd prefer a blanket "we're against harassment of any kind and will act if harassment comes to our attention", over many paragraphs trying to spell out what exactly we consider actionable, leaving loopholes for language lawyers (and we nerds have this tendency!) all over the place.
I know that you're strongly in favor of CoCs. Do you see a qualitative difference between those things?
I'll grant that harassment is a much more explosive issue today, but "who is allowed to participate in a bug bounty community" also seems to have potential for bitter quarrels.
Thank you, you succintly worded my main issue with CoCs and why I much prefer "Community rules: Don't be an asshole" over "Community rules: [3 pages]".
I have yet to see a single situation faithfully resolved with the latter that couldn't have been with the former.
But that doesn't mean there's no value in having clearly laid-out principles, and in particular, clear descriptions of proscribed behavior and protected groups. Because in the absence of that, the same kind of people who would language-lawyer in the presence of a code of conduct will try to slickly excuse their behavior as acceptable in the absence of one.
Some of the most insidious people around will be superficially nice to someone's face (some of the time), while taking the time in a policy process to calmly and politely inquire if it would be reasonable to treat people like them as subhuman, with ever so much justification and honeyed words. Head it off in advance, set a line for what you expect, and don't assume that "be nice to each other" will make everyone feel safe and welcome.
This much is true. Do codes of conduct help or hinder such efforts, on the whole?
When two people are in conflict (which is really the only case that matters), popular codes of conduct seem to favour the person who can best convince that the conflicting behaviour on their part is part of their identity while that on the other person's part is just them choosing to be mean. I'm not at all convinced that this consistently favours the person we should be favouring.
You're not a court of law, you're an organization, a club, whatever. This club has officers or a president.
Put your foot down and make a dictatorial decision that is only announced, not discussed.
You're not recognizing their "right to argue". They cannot "lawyer" if there is no venue open to them. Ignore their complaints on Facebook or whatever.
It's worth remembering that people (rightly, I think) get far angrier about breakdowns of due process than the absence of it. Some of the people upset about the Drupal mess recently didn't seem to care much about the specifics of what happened, but were incredibly disturbed that the official process appeared to have been circumvented. At that point it would have been far better to say up front "we make decisions at our discretion, in the manner we choose".
To me --- and, let's be honest, to pretty much the overwhelming majority of all other people --- it's enough to say "we've decided we're not going to work with spyware companies", just as for the most part it's fine to say "we're not going to work with people who publicly lobby for racism or misogyny"† without connecting the dots on that statement all the way back through Rawls and John Stuart Mill.
I think at present it's a courtesy to announce those kinds of beliefs, preferably in the simplest way possible, just so nobody is shocked when you exercise your prerogative to enforce them. I obviously don't think the resulting "code of conduct" statements need to be formally impregnable.
† You could make the opposite statement as well, as I think at least one project has sort of done implicitly. I don't begrudge anyone that right; why would I bother? If you want to pour kerosene over your professional reputation and light a match, who am I to stop you?
https://www.reddit.com/r/rational/comments/69f7nw/d_friday_o...
I'm pretty sure the Feds are happy to have traffic to ISIS sites be routed (unencrypted) through an American company's service...