I did? Which is why you're here?
> or to really acknowledge what the guy you're responding to here said
I did? "If these odds aren't good enough for you to live up to your values, what are?" is a genuine question. Note that you didn't answer the question.
And everything said before _was_ a response to privilege, but to be more explicit: if you have the _privilege_ of discovering a vuln and the technical knowhow of recognizing its magnitude and potential effect on others, is it not YOU that are using your privilege for ill? "The indifference of good men...", etc, etc.
Listen. We're all cowards and bitches, me included. We all have faults, we all take the easy path, we all could do better. Me especially. I have a history that I'm not proud of, and my character is as flawed as anyone's. I apologize again for using crass language, perhaps if you're willing to extend some charity, substitute whatever language you feel like would be more appropriate. Unfortunately if I come up with other words they'd _still_ read as negative, so I'll refrain.
Agree. Again, the system sucks, and will always suck.
> so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term.
Agree. I lean utilitarian philosophically. If we lived in a society akin to Russia where Doing The Right Thing would get you thrown out of a window, then I would not be telling people to do so.
> there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?
I admit I'm having trouble parsing this. But if you're saying corps use lawfare to get away with as much as they can: I agree.
I'm not saying that you should Always Do The Right Thing At The Cost of Everything. I'm only saying yall are indexing very, very hard on 2 edge cases that were dropped and led to no arrests or jailtime. My anecdote/advice does NOT apply to those living in authoritarian regimes where the tallest nail gets hammered down. (You could argue that Hong Kong is such an authoritarian regime; I won't disagree.)
Let me phrase it this way: if you're too risk-averse to report when you see security issues because you fear charges, then you should also always stay within the speed limit, come to a complete stop at stop signs, never jaywalk, loiter or consume alcohol in public. Heck while we're at it you should also stop driving; the risk of death is much higher than that of being arrested for reporting a security issue. We all have different risk tolerances, but I think the numbers here are in my favor.
Sure, I could caveat my arguments down to nothing (unless you live in a authoriatrian government, unless you're an investigative journalist whose livelihood and sources would be threatened by your arrest, unless you're 9months pregant and cannot in good conscience undergo even imagined stress, etc. etc.) Or I could simply say "Do the Right Thing", give the base rate, and let you handle the nuances for your situation.
This is why my follow-up was a critique of cynicism. Perhaps I could've said that sometimes cynicism is well earned; there ARE people that in shitty situations where cynicism is warranted. But the vast majority of the people on HN reading that comment? Nah dawg. NGL this thread feels peak HN "well ackshully". I cannot speak in a way that is 100% correct for all people at all times.
Sure, jaywalking is not a crime in some areas. Engage with the steelman of my argument dude, don't just find the weakest example out of ~5 and go after it.