After lurking on slashdot for the last 10 years, this post finally got me to set up an account. Woo! It's my... well, you know.
The hypothesis here is that yahoo didn't pay for the exploits, so obviously grey hats will go to the black market. Further, it's ethically justified because of the slap in the face.
I think if you tell a private company that they have a security problem, and they thank you, you can pat yourself on the back. If you're doing it specifically for money, then don't spend your time on yahoo. I don't think it's ethically justified to specifically look for and sell these exploits on the black market, just because you feel morally righteous about a t-shirt. Where are your hacker ethics?
Even more, you've forgotten that you have a civic responsibility. Recently, I drove past a high tension line on route 1, and noticed that one of the towers was about to fall over. I could see it from the highway, and I'm a nerd, so I'm observant. I told dominion VA power about it, and within a day, they had a crew out to fix it. It potentially saved them millions. I asked for nothing in return and got nothing. By your logic, I should sell the location of the next messed up tower to terrorists so they can destroy a chunk of the power grid. Why on earth would I want to do that? Even if I don't use power from those lines, I almost certainly have friends and family that do.
Same with yahoo. Even if I don't use them, someone I know almost certainly does. Why wouldn't I want to perform a civic duty to protect them?
Again, if they won't pay me, I'm not going to walk the entire length of their lines and function as a free lineman for the power company. I'm also not going to be a dick about it. I'm just going to feel good about myself.
Slashdot Mirror
Used to posting as AC, all my formatting was lost, hence the wall of text. internet n00b in 2013 FTW?
After lurking on slashdot for the last 10 years, this post finally got me to set up an account. Woo! It's my ... well, you know.
The hypothesis here is that yahoo didn't pay for the exploits, so obviously grey hats will go to the black market. Further, it's ethically justified because of the slap in the face.
I think if you tell a private company that they have a security problem, and they thank you, you can pat yourself on the back. If you're doing it specifically for money, then don't spend your time on yahoo. I don't think it's ethically justified to specifically look for and sell these exploits on the black market, just because you feel morally righteous about a t-shirt. Where are your hacker ethics?
Even more, you've forgotten that you have a civic responsibility. Recently, I drove past a high tension line on route 1, and noticed that one of the towers was about to fall over. I could see it from the highway, and I'm a nerd, so I'm observant. I told dominion VA power about it, and within a day, they had a crew out to fix it. It potentially saved them millions. I asked for nothing in return and got nothing. By your logic, I should sell the location of the next messed up tower to terrorists so they can destroy a chunk of the power grid. Why on earth would I want to do that? Even if I don't use power from those lines, I almost certainly have friends and family that do.
Same with yahoo. Even if I don't use them, someone I know almost certainly does. Why wouldn't I want to perform a civic duty to protect them?
Again, if they won't pay me, I'm not going to walk the entire length of their lines and function as a free lineman for the power company. I'm also not going to be a dick about it. I'm just going to feel good about myself.