When your classmates threaten you with felony charges

I'm reminded of the concept of a "tact filter", which is basically "do you alter what you say to avoid causing offense, or do you alter what you hear to avoid taking offense?"

https://www.mit.edu/~jcb/tact.html

The part the original essay leaves out is that optimal behavior depends on the scale and persistence of the relationship. In personal, 1:1, long-term relationships, you should apply outgoing tact filters because if you cause offense you've torched the relationship permanently and will suffer long-term consequences from it. But in public discourse, many-to-many, transactional relationships, it's better to apply incoming tact filters because there are so many people you interact with that invariably there will be someone who forgot to set their outgoing tact filter. (And in public discourse where you have longstanding relationships with your customers with serious negative consequences for pissing them off, you want to be very, very careful what you say. The entire field of PR is devoted to this.)

So anyone who spends a significant amount of time with the general public basically needs to develop a translation layer. "i hope you hang yourself" on an Internet forum becomes "somebody had a bad day and is letting off steam by trolling." "Your business is probably in violation of federal labor laws because you haven't displayed these $400 posters we're trying to sell you" becomes "Better download some PDFs off the Department of Labor for free" [1]. "We're calling from XYZ Collection Agency about your debt" or "This is the Deputy Sheriffs office. You have a warrant out for your arrest for failing to appear for jury duty" or "This is the IRS calling requesting you pay back taxes in the amount of $X over the phone" = ignore them and hang up because it's a scam. "Continued involvement in Russia's internal affairs will lead to nuclear consequences" = Putin is feeling insecure with his base and needs to rattle some sabers to maintain support. "You are in violation of several state and federal laws facing up to 20 years in prison" = they want something from me, lawyer up and make sure we're not in violation and then let's negotiate.

[1] https://www.dol.gov/general/topics/posters

Yeah, I sort of get your point.

> So we did what any good security researcher does: We responsibly disclosed what we found. We wrote a detailed vulnerability disclosure report. We suggested remediations. And we proactively agreed not to talk about our findings publicly before an embargo date to give them time to fix the issues. Then we sent them the report via email.

This is why the whole “I can’t believe my classmates threatened legal action” line of thinking doesn’t make sense. They weren’t acting like classmates themselves. They were acting like professionals. I imagine the embargo date wasn’t well-received.

It’s also interesting that they listed all of the steps they followed that a “good security researcher” would do. So why didn’t they start with communication first before trying to hack the system? Good security researchers do that. (Not all of the time, obviously.)

> Well, a me and few security-minded friends were drawn like moths to a flame when we heard that. Our classmates were posting quite sensitive stories on Fizz, and we wanted to make sure their information was secure.

> So one Friday night…

And this is where the “good-faith security research” line of reasoning broke down for me. Think about the wording. To my ears/eyes, those sentences above seem like a carefully crafted but still flimsy excuse. It’s like a lie that you tell yourself over and over so much that you end up believing it. It seems like the researchers just wanted to have some fun on a Friday night (like he said). (And there’s nothing wrong with that. But to characterize it as only doing “good faith security research” seems like a stretch.) I guess I’m saying that I’m just not convinced. I don’t buy it.

But I get it. Articles need to be written. Talks needs to be given.

(And yes, I do believe that Fizz didn’t need to threaten legal action.)

The scooter company was well aware of it as I told them about that + several other issues immediately. :)

What about due diligence? If you're about to send and store sensitive information with a service, a service that claims to be 100% secure.... shouldn't you have the right to verify that the security is up to snuff? These researchers weren't attempting to harm anybody. What's wrong with kicking the tires?

There is no precedent for consequence-free probing of others' defenses. Unauthorized "testing conducted in ways unfavorable to vendors" is generally considered a crime of trespass, because everybody has the right to exist unmolested. Whether or not they have their shit together, you aren't authorized to test your kids' school's evacuation procedure by randomly showing up with a toy gun and a vest rigged with hotdogs and wires.

The way this goes in the digital space, people expect to break into my "house," see if they can get into my safe, snoop around in my wife's/daughter's nightstands, steal some of their underwear as a CTF exercise, help themselves to my liquor on the way out, then send me an invoice for their time while also demanding the right (or threatening) to publish everything they found on their blog. Unsolicited "security research" is a shakedown desperate to legitimize itself. Unlawful search/"fruit of the poisoned tree" exists to keep the cops from doing this to you, but it's totally acceptable for self-appointed "researchers" to do to anybody else I guess.

"Ethical hacking" is notifying the owner/authorities there's a potential problem at an address, seeing if they want your help in investigating, and working with them in that capacity-- proceeding to investigate only with explicit direction. Even if their incompetence or negligence in response affects you personally, that's not a cue to break a window and run your own investigation while collecting leverage you can use to shame them into compliance. That shit is just espionage masquerading as concern trolling.