I (we) would obviously prefer the professional person who is doing good for society. The problem is, this behaviour isn't good for them. I am not an expert or anything but from what I know, pentesting without explicit prior permissions can easily lead to huge lawsuits. I would rather that the careless people get their cars stolen than the good people all lose heart completely.
Sure there is no perfect solution here.
I guess it’s a good idea to only pentest companies that do have a bug bounty program and an expressed interest in you pentesting.
While I enjoyed the article that GP referenced and agreed with most thing I thought the “hacking bad” take was a bit off.
Having a curious look is alright but it's the "beg bounty" attitude that these researchers need to rein in. It's like the sponge-and-bucket guy washing your grimy windscreen without you asking while you wait at the lights, then demanding cash for it. Thanks but no thanks.
Agreed, and all the "shame if next time someone would sell it on the black market" comments don't exactly make those "researchers" look like the good guys.
> I too, as the good samaritan that I am, like to stroll through my neighborhood and give all the cars and bikes I encounter a quick pentest, purely for the benefits of the owners of course.
In my neighborhood, "security researchers" can often be seen checking houses for vulnerabilities. During the day, it's usually a woman or a kid with a clipboard who knocks on front doors, checks for cameras, tests if the front door is locked, etc. I'm told they work with crews of men who will come back later to do a more thorough investigation when everyone is gone so as not to bother the homeowner.
Every night, there are other "security researchers" who test all the doors of all the cars parked on the street and in driveways. If you leave your car door unlocked just once, you'll be informed about it the next morning!
>I remember there was an article "the six dumbest ideas in computer security" on HN a while ago, one of those was the mindset that "hacking is cool". I'm reminded a bit of this here.
Half of that post is unhinged nonsense. "Hacking is Cool" is listed right after a rant about pentesting being dumb because your software should just be designed to be secure.
