Hacker News Front Page · gslin ·
The Duty of a Scholar
Sostiene que quienes poseen conocimiento técnico tienen el deber moral de llevarlo activamente a las personas que pueden actuar, en lugar de limitarse a publicarlo o esperar que alguien pregunte. A partir de su experiencia coordinando la divulgación de una vulnerabilidad en Intel, relaciona ese deber con la ética profesional y la idea de Fichte de que el conocimiento debe servir a la sociedad. Distingue entre investigadores, que crean conocimiento, y académicos, que lo acercan a quienes lo necesitan; el deber es informar, no obligar a actuar, y termina cuando las personas pertinentes ya conocen la información.
There was a joke at the time that although the National Security Agency had opened up in recent years and started taking their defensive role more seriously, the one aspect of cryptography which they would never discuss publicly was side channel attacks — and this itself constituted a side channel, revealing the importance they attributed to the field. Being active in computer security, and recognizing that the NSA knew a few things about the topic, my immediate priority was to determine whether the information leakage I had identified was sufficient to construct a practical cryptographic side channel. By mid-December I had a proof-of-concept exploit which stole enough bits of an RSA private key for the entire key to be reconstructed, and I turned my attention to the hard part of the problem: Quietly notifying security teams and working together to get the issue fixed before disclosing it publicly.