Ethical considerations of access to the HackerOne community

Post by MichaelGG » Fri, May 05, 2017, 1:45 AM UTC

sigmar wrote: post #24

MichaelGG wrote: post #18

Earlier quoted context omitted.

So the issue about how oblique they make their marketing message? If they rebrand and use lots of innuendo, then it's OK?

You're being obtuse if you think this use-case wasn't a huge part of their thinking while designing the software and offering support to customers. >I asked a FlexiSpy salesperson a simple question: If I wanted to, could I use their spyware to snoop on my wife's cellphone without her knowing? The answer each time was yes. When asked if it was legal, they responded with a canned disclaimer explaining it was necessary…

Post by nojvek » Fri, May 05, 2017, 2:31 AM UTC

drvdevd wrote: post #40

tptacek wrote: post #27

Earlier quoted context omitted.

I understand what you're writing, and what HackerOne wrote, but to me it pretty much seems like "we won't run a security service for spyware companies". At Matasano, we wouldn't do work for the USG or arms manufacturers. We didn't have a coherent framework to fit that decision into. We just wouldn't do it. I worry that we may be overthinking things here.

The only question I have, in this particular case is: what about the victims of the original app? Are they possibly the subject of re-victimization if the app on their device is compromised further by 3rd parties? Though I completely agree with HackerOne's moral stance here, does this particular scenario complicate things? EDIT: I do see they took this into consideration in their writeup... still curious.

Post by Houshalter » Fri, May 05, 2017, 4:15 AM UTC

nvahalik wrote: post #34

sqeaky wrote: post #28

Earlier quoted context omitted.

This is going to earn me huge downvotes, but not all surveillance is equally illegal or equally unethical. To me it seems that groups that run spy satellites and look out for nuclear missile launches are in a different ethical category than people who make software for perpetuating domestic abuse. Clearly, I picked two extremes. That was just to show that not all surveillance is equally bad and that some can be bette…

> people who make software for perpetuating domestic abuse That's a bit like saying the authors of Wordpress perpetuate fake news. I've used similar products to monitor usages on teenager's devices and I can attest to their usefulness far beyond "perpetuating domestic abuse".

Post by martenmickos » Fri, May 05, 2017, 5:07 AM UTC

tetrep wrote: post #11

> Companies should defer judgement to the courts rather than make arbitrary moral judgements. Uh, no. Please no. I do not want the courts to arbitrate morality. That's a far far far more dystopian world than one where corporations do (supposing I accept their false dilemma). Companies can, in theory, be created by any person, with any moral alignment. That is not the case with governments (minus authoritarian ones, w…

Post by Tomte » Fri, May 05, 2017, 6:37 AM UTC

tptacek wrote: post #27

derefr wrote: post #21

Earlier quoted context omitted.

To me, it seems to come down to: 1. there are evil people, but 2. those people frequently have more social power than nice people, and 3. the evil people will use their social power to paint nice people as evil (i.e. "bullying.") If you're defining the laws for a community or society, or the Terms of Use for a piece infrastructure for such a community/society to use—then it behooves you to consider that any "hammers"…

I understand what you're writing, and what HackerOne wrote, but to me it pretty much seems like "we won't run a security service for spyware companies". At Matasano, we wouldn't do work for the USG or arms manufacturers. We didn't have a coherent framework to fit that decision into. We just wouldn't do it. I worry that we may be overthinking things here.