Hacker News Reader

Comment by Canada | Hacker News Reader

If I find a bug on my own I can do as I please with it. I have no obligation to inform the vendor. I can write an exploit and publish it, share it with my friends, or sell knowledge of it to whomever I please. The vendor has zero right to my work or to dictate what I do with it.

There are few things more frustrating than dealing with a vendor that doesn't understand this.

On the other hand, if I find something while being paid to look then I must tell only the client and hope that they are responsible enough to disclose it instead of silently patching.

I don't these are minority views.

View on HN

> There are few things more frustrating than dealing with a vendor that doesn't understand this.

I think they do understand this very well; they just want to brainwash people into thinking it's a civic duty to do what they say. It's not. Ethical security researchers' responsibility is to the users, not to the vendors.

The line is crossed if you attempt to market and sell it for illicit use, or a prosecutor thinks they can demonstrate that you did effectively that. See: recent case about the guy writing the remote system control software then became a popular hacking tool / RaT.

Just to clarify, he was not charged for writting the RAT, he was charged for maybe wanting to sell an exploit in some fashion, possibly to a third-party that wanted to sell it on.

IANAL: And the prosc has to prove that you intend or effectively did both market/sell and that it was for illegal use - selling information about an exploit in e.g Chrome is quite different if you try to sell it to the Chrome developers.

There's right and there's right thing. The right is something that if you go against it, you are violating the law and can be punished by the police, courts, etc. But the right thing is much wider - there is myriad of things which are legal but not the right thing to do. The right thing is regulated by community norms and culture. Responsible disclosure is that kind of thing. It's not unlawful, but it is a becoming more and more a community norm.

Now, people that try to legislate community norms - outside of obvious cases like prohibiting murder - usually make things worse. But ignoring community norms is also not a smart thing to do.

> If I find a bug on my own I can do as I please with it.

only if your access to the vendor's systems wasn't precluded with an eula that you agreed to beforehand. I don't see company be stupid enough to not put in broad legal terms in the eula to prohibit this sort of penetration.

But if you weren't given permission first (which may involve said eula) then that must mean you're accessing without permission - which is illegal.

That argument doesn't hold up. If it did security researchers who publish findings in commercial products would all have been sued by now. Many countries have fair use exemptions to prevent copyright holders from engaging in the kind of abuse you describe.

Yes - this does happen.

[1] https://www.cnet.com/news/dutch-chipmaker-sues-to-silence-se...

[2] http://www.eweek.com/blogs/security-watch/german-software-co...

[3] http://www.securityfocus.com/news/11259

[0] https://duckduckgo.com/?q=security+researcher+sued&t=ffsb&ia...

Yeah, companies sometimes bully and intimidate, but all those links point at baseless lawsuits that didn't legally succeed.

> If it did security researchers who publish findings in commercial products would all have been sued by now.

they have the option - and some chose not to sue for either PR reasons and/or unlikely to recoupe anything from a researcher anyway, so rather not spend the cost.

Reply on news.ycombinator.com