Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

After reading all this including your story,Personally I will never report any security or other incident to anybody(If I happen to find one).

Because no good deed goes unpunished. No one appreciates what good caused by your help.

It just bruises peoples egos and they violently lynch you for 'How dare you point a mistake at a genius like me, you should have tried whispering in my year'.

Its for incidents like this people refuse to help in not just security situations but also in emergency situations because you get entangled in unnecessary mess. People just let the world burn.



Reporting security flaws is fine.

Doing it by demonstration on a live product without asking first is not as fine.


"Houses aren't very secure, here's a video of me picking the lock on my own front door."

"I demonstrated how insecure your house is by picking the front door lock and leaving a note on your bed."

Sometimes it can be difficult to have the empathy and perspective to see how frightening and unconscionable the 2nd action can be, but it very much is.


"But thats exactly why I left you that note. Because it frightens me just how insecure your house is. I care about you and don't want to see you hurt. I did it as a last resort, I tried to inform you but you clearly didn't take me seriously.

Empathy was casusing me pain everytime I saw you 'lock' your door with that elastic band. Attention seeking or malicious behaviour would have been to break into all the insecure doors on the street.

I broke into yours, so you would take security seriously, because I care about you and your wellbeing."


How is that so very different from, say, kidnapping someone's children and holding them hostage until they fix whatever you want fixed?

The problem here is that when you violate someone's trust you change the landscape. People get scared, they question your motives, they go into a fight or flight response. Yes, this sometimes results in the problem being fixed faster because they are very much more motivated now, but the same is true if you kidnap their family, right?

If you think someone is letting down their customers by not responding fast enough, then you go public. But violating trust is a quick way to end a professional relationship.


Surely you and every other commenter can see that breaking into houses and kidnapping children are in a completely different universe from posting comments sent from 1000 years in the future on Github right?


This isn't breaking into someone's house and leaving a note.

This is breaking into a huge commercial factory with thousands of clients, where you could cause colossal damage, and only leaving a note.


where you could cause colossal damage

Exactly, you and every other hacker with out there. At least you had the good conscience to leave a note.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: