The conventional definitions of hackers often separate us into two camps. Hacker versus cracker, white-hat versus black-hat, and so on. If someone claims to be a White Hat, they are saying that they perform penetration tests and vulnerability research for the express purpose of securing systems. They will decry the activities of Black Hat hackers, whom they define as the bad guys who want your credit card numbers and secret futanari porn stash. These dichotomies are not only false, but the descriptions employed are actually harmful to growing as a technologist.
Simply put, hackers are people, and people are far too complex and interesting to compress to a single bit of classification. Most hackers should wear gray.
Let's say you discover a remotely exploitable vulnerability in every operating system on the planet. What do you do?
Classically, these practices are labelled respectively:
The ambiguity in the last three (arguably four) points is precisely the problem I have with the white-hat dichotomy. In reality, these hackers can be described as:
Furthermore, the dichotomy implies that whitehats and blackhats are enemies. While there is obviously an ideological disagreement between the two camps, the main adversary of a blackhat hacker is a system administrator. Sysadmins assume a defensive posture, but that says nothing about their ethics or arsenal.
In closing, before you call yourself a whitehat, grayhat, or blackhat, think long and hard about what you do and the context you do it in, and maybe consider not labelling yourself as such?
Simply put, hackers are people, and people are far too complex and interesting to compress to a single bit of classification. Most hackers should wear gray.
Let's say you discover a remotely exploitable vulnerability in every operating system on the planet. What do you do?
- Keep it to yourself; exploit it for fun and profit.
- Sell it to an exploit broker.
- Tell Microsoft, Apple, Google, and only large companies, to win their bug bounties.
- Discretely report it (via GPG encryption) to people who maintain the vulnerable component, including a PoC and patch. Then, after the fix is rolled out, email the PoC to Full Disclosure.
- Discretely report it (via GPG encryption) to people who maintain the vulnerable component, then publish a vague advisory (but not the PoC) to Full Disclosure.
Classically, these practices are labelled respectively:
- Black-hat.
- Gray-hat, but you're acting in good faith that this exploit will end up in the right hands, so it might as well be white!
- White-hat.
- White-hat.
- White-hat.
The ambiguity in the last three (arguably four) points is precisely the problem I have with the white-hat dichotomy. In reality, these hackers can be described as:
- Black-hat.
- Money-hungry.
- Siding with the rich and powerful.
- Reckless attention-whoring.
- White-hat.
Furthermore, the dichotomy implies that whitehats and blackhats are enemies. While there is obviously an ideological disagreement between the two camps, the main adversary of a blackhat hacker is a system administrator. Sysadmins assume a defensive posture, but that says nothing about their ethics or arsenal.
In closing, before you call yourself a whitehat, grayhat, or blackhat, think long and hard about what you do and the context you do it in, and maybe consider not labelling yourself as such?