11–20 of 336 posts
Earlier quoted context omitted.
That’s a legal disclaimer, not a moral one.
It is an attempt at a legal disclaimer. It may not hold up in court.
> Authors and contributing developers assume no liability and are not responsible for any misuse or damage caused by the use of this program. Anything that can be created, will be created. However, that doesn't free you from all moral culpability. If you create something, make it freely accessible and easy to use, then I think you are partly responsible for its misuse. I'm not saying that they shouldn't have created…
I don't agree, but people will never reach consensus on this moral topic. So please don't call the other side "at best naive".
Hi there, one of the maintainers here. Thanks for sharing & AMA!
Even if you claim that you are legally not responsible for any abuses of this software do you feel any moral responsibility?
Yet this question seems unfairly loaded. At the least - premature.
Though we can easily imagine it, afaik there is no evidence of any actual abuse to date.
Earlier quoted context omitted.
It is an attempt at a legal disclaimer. It may not hold up in court.
Under what charges? If we're talking about the US, they have the first ammendment and all that. As for defamation laws and similar, the person who used the tool for those purposes would be on the hook, not the creators.
My only point was: you can disclaim anything you want, but that won't stop people from suing you if they feel like it (this can happen anyway, even if you disclaim any and all responsibility) and creating something that can very easily be abused and then thrown out into the public even though it is standard practice in the security community may well end up being a boomerang.
There is some precedent for the creators of such software being sued:
https://knowtechie.com/a-company-that-makes-iphone-hacking-s...
So I would not be too quick to dismiss that this could happen to smaller entities or even open source creators of such tools.
Earlier quoted context omitted.
Even if you claim that you are legally not responsible for any abuses of this software do you feel any moral responsibility?
I too would like to imagine whether or not I would release something like this in similar circumstances. Yet this question seems unfairly loaded. At the least - premature. Though we can easily imagine it, afaik there is no evidence of any actual abuse to date.
I've often wondered whether the net effect of the whole security research community is a net positive or a net negative and I honestly do not know the answer. So yes, it is a loaded question. But asking yourself if what you can do is actually the right thing to do is always good, especially if you - as these authors imply - know up front that there is a large chance of abuse.
from the article: Real-time, controllable deepfakes ready for virtual camera injection. Created for performing penetration testing against e.g. identity verification and video conferencing systems, for the use by security analysts, Red Team members, and biometrics researchers. Reminds one of the vulnerable world hypothesis. It's only a matter of time before a technology comes along that is both destructive and so sim…
There are two very rough "proofs of a kind" I use to explain this to students, both well known in military and counter-terrorism analysis.
One is called Blotto analysis. As the number of fronts grows large (>12 is an important point) the game favours the attackers. Defenders have to always win on all fronts, but terrorists only have to win once on any of n fronts. Another scenario comes from finite board games like Go. Defenders lose when their back is against a wall. Because the space of practical human security solutions is smaller than the inventiveness of attackers, eventually the attackers win. Biometrics is the poster child for this kind of folly. There are only two edge cases. One is to create proven trustless systems. Such systems cannot involve humans in any way shape or form, and therefore fail by definition as human security solutions. The other is to eliminate all attackers.
This does indeed create a fountain of fascinating ethical conundrums with regard to security research and the possibility for strategic limitation of knowledge hazards.