REPOST: Ode to Security Researchers:

After reading some articles (not only: ‘Linux Ignored, Not Immune,’ Says Hacker Contest Sponsor), I have decided to repost a previous entry ;-) In my opinion, the same applies to some journalists, bloggers, software developers, et cetera…

By Martin Pittenauer – 0×2a: Ode to security researchers

 “Dear security researchers, that…

• don’t prance around like a pwnie over every 0day
• value responsibility and public interests over your own ego
• have grown up
• don’t complain about people who haven’t, all the time
• understand software development processes and the meaning of “trivial”
• don’t insist on being baby-sitted 24/7 by $BIG_COMPANY
• aren’t at the center of the universe
• can resist making cheap jokes
• have written code worth mentioning, to broaden your horizon
• can make their outcome without having to pimp their personality, sell stuff to questionable characters or use tactics akin to extortion
• face discussion instead of declaring everybody else stupid
• don’t try so very hard to be a cool kid

…, I wish there were more of you.”

Well, as an open-mined person, I have decided to transcript this to your consideration…

Ken Thompson’s quote: “The act of breaking into a computer system has to have the same social stigma as breaking into a neighbor’s house.” (1984).

Nowadays, this and such an others similar “behaviours” are considered crimes in most of the UE countries. We think that what is a crime in the “real” life have to be also a crime in the “digital-virtual” life –when possible.

I say it, just in case –there are a lot of “special” people out there. :))

But Ken Thompson –father of UNIX–, said much more a lot of time ago (1984)…

Reflections on Trusting Trust
Ken Thompson

Another one to think about it…

“(…)
Moral
The moral is obvious. You can’t trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.
After trying to convince you that I cannot be trusted, I wish to moralize. I would like to criticize the press in its handling of the “hackers,” the 414 gang, the Dalton gang, etc. The acts performed by these kids are vandalism at best and probably trespass and theft at worst. It is only the inadequacy of the criminal code that saves the hackers from very serious prosecution. The companies that are vulnerable to this activity (and most large companies are very vulnerable) are pressing hard to update the criminal code. Unauthorized access to computer systems is already a serious crime in a few states and is currently being addressed in many more state legislatures as well as Congress.
There is an explosive situation brewing. On the one hand, the press, television, and movies make heroes of vandals by calling them whiz kids. On the other hand, the acts performed by these kids will soon be punishable by years in prison. ((italics are mine))
I have watched kids testifying before Congress. It is clear that they are completely unaware of the seriousness of their acts. There is obviously a cultural gap. The act of breaking into a computer system has to have the same social stigma as breaking into a neighbor’s house. It should not matter that the neighbor’s door is unlocked. The press must learn that misguided use of a computer is no more amazing than drunk driving of an automobile.”

Martin Pittenauer – 0×2a: Ode to security researchers

“Dear security researchers, that…

• don’t prance around like a pwnie over every 0day
• value responsibility and public interests over your own ego
• have grown up
• don’t complain about people who haven’t, all the time
• understand software development processes and the meaning of “trivial”
• don’t insist on being baby-sitted 24/7 by $BIG_COMPANY
• aren’t at the center of the universe
• can resist making cheap jokes
• have written code worth mentioning, to broaden your horizon
• can make their outcome without having to pimp their personality, sell stuff to questionable characters or use tactics akin to extortion
• face discussion instead of declaring everybody else stupid
• don’t try so very hard to be a cool kid

…, I wish there were more of you.”

Well, as an open-mined person, I have decided to transcript this to your consideration…