Canceled #HITBGSEC Talk Re-Ignites Controversy Over Legitimate Security Research
With apologies to George R. R. Martin, the drama around legitimate security research is starting to rival anything the Starks, Lannisters and Targaryens could muster.
Hardly a month goes by without some white-hat bug hunter wedged between a vendor or government threatening legal or regulatory action against disclosures that would serve only to make something more secure. Clearly some points on this vendor-researcher-policymaker triangle just don’t get that subtlety.
Instead, some vendors are threatened by bug reports and conference talks that expose weaknesses in software and devices. Sometimes private disclosures are ignored, and rather than take action to secure their heavily marketed software, connected automobiles or other Internet-enabled things, some vendors lash out at researchers. And lawmakers and policymakers, rather than listen to influential hackers, tend to dismiss them as basement-dwelling, Red Bull-drinking introverts with too much time on their hands. Or they endorse such things as the Wassenaar Arrangement.
