I agree with you Tim, I too, share the frustration that worms bring, but how do we tell the good guys from the bad guys. I think proposing something like this is going to bring on excuses for hundreds of blackhat's - "I was trying to kill the worm" - How do you prove that?

Like Lamo, who is notorious for obtaining access to systems, then hoarding information, and month's later reporting it, is he a good guy? IMO, no. But why isn't he held accountable for his so called "white hat" hacks?

He done the company a service, sure. But only after he got information he shouldn't have had. If it was just a "Oh, you have a problem with this, this, and this, immidiatly after he found the vulns, then his actions are still questionable, but at least he's in clearer waters.

I think it'd be to hard to distinguish between real "white hat vigilantes" and those with other things on their agenda. Who should they prosecute?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17586#17586