News for hackers. Stuff that matters.

A comment on Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability. Parent comment

Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by big_surprise on Wednesday August 17, 2016 @11:32PM (#12310259)
No. By my logic, you are better off not doing vulnerability research in your spare time if you have to worry about the legal ramifications of your actions.

The ethical conundrums are unavoidable, and those calculations are indeed difficult.

The legal consequences are artifice, and by agreeing to those (while ignoring externalities and not going public), you are likely putting others at risk.

[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @11:39PM (#12310285)
Forget the legal consequences. Reporting vulnerabilities is work. By your logic, by doing some work in my spare time, I am morally obligated to do more work for others. I'm better off just picking something else to work on.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by big_surprise on Wednesday August 17, 2016 @11:46PM (#12310314)
Perhaps so... As long as you recognize that your work is inherently dual-use (it has effects beyond your initial intent), and you don't intentionally hide that fact from yourself or others, then I have no problem with what you do.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by tptacek on Wednesday August 17, 2016 @11:48PM (#12310322)
I feel like you have unusually strong feelings about this whose implications you might not have fully thought through.
[ Parent | on HN ]
Re:Cisco Adaptive Security Appliance SNMP Remote Code Execut... by big_surprise on Wednesday August 17, 2016 @11:58PM (#12310355)
I feel the same about you.
[ Parent | on HN ]