OSNews

Any comparison in this case that involves people dying is completely over-thetop-. We're talking a bloody software bug here, that's not a life-or-death matter.

I know the internet has a tendency to bring out everyone's inner drama queen but this is just over the top.

I guess you didn't notice that we are comparing the actions, not the results. Ethics doesn't go out the windows just because the results aren't life threatening.
Replace "death" with injury or whatever.



Oh the irony.

Edited 2009-03-21 17:17 UTC

It's not like you just stumble upon software vulnerabilities as you would see a crack in a bridge, unless you are a developer of the particular project where the vulnerability is found. It's useful work, and a very difficult one at that. Disclosing it for free is working for free.



That's killing the messenger. If, instead of being glad that someone found out about a problem, he's immediately accused of being so "callous and selfish" to want to make a buck out of it, less people will bother and less problems will be found in time.

In your example, maybe the research doctor would do the "right thing", disclose the information as soon as possible and, let's assume, earn no money or fame. But then he would decide that trying to find out flaws in company X products does not pay, and he would find something else to do.

What do medical researchers do in practice? Well, they are rather callous and selfish by your standards. They don't go out screaming as soon as they suspect some pharmaceutical drug may be harmful. They take the time to gather information, double-check their results, write a nice article and then find a suitable medical journal to publish those results. The journal's reputation matters more than the money they get for the article, but the incentive is ultimately economic.

My point is, if medical researchers were seriously expected to behave, as you say they should, with no regard for their personal benefit when human lives are at stake (as usual), there would be preciously few of them.

I see you are trying a reductio ad absurdum, but beware, you are getting something of a slippery slope fallacy. Your argument goes like "if you find it morally acceptable for someone to let other people suffer some minor harm to their property instead of warning them, them you also find it morally acceptable for someone to let other people die when he could save them". Of course, it doesn't follow. On the other hand, as it turns out, I'm not morally outraged that someone whose job is such that life-and-death decisions are his bread and butter will let some people die from time to time, usually in a non-obvious way. It's a hard thing to say, but the example itself is hard to begin with. You smuggled the topic of death and suffering into a discussion about browsers and malware, and this move rather clouds than clarifies the arguments.

I am sorry to jump at the tail end of this... In the interview I just posted it sounds like he basicly did it for free: the payoff wasn't very big in itself to justify the amount of time that went into pulling it off. However, the economic factor is there as well. His company is hired to find these types of issue, so if anything it builds up a good rep for his company.