[Droid Ultra General] samwathegreat:
Ok guys...I was going to leave this one alone, but once again, I just have to share my thoughts.

[Rant]

First, Dan never rubbed it in our faces that he had discovered this vulnerability....it was brought to our attention by others. He exposed the vulnerability @ BlackHat. Just in case anyone isn't familiar with the purpose of BlackHat, here it is, right off their website:

"The Black Hat Briefings have become the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment."

If you don't understand what a vulnerability is or realize that a vulnerability goes far beyond the ability to root or unlock, you probably need to do some research. The same vulnerabilities that individuals in our community get so excited about can also be used by a malicious dev for any number of nasty things. Vulnerabilities aren't just rainbows and butterflies...they also have a much darker side to them. They compromise security.

That being said, so long as you exploit the vulnerability to your benefit (such as unlocking) and then take the update that patches the vulnerability, you are safe from the "dark side" of it.

But BlackHat exists not to show people how to take advantage of security flaws, but rather to "Deliver actionable security information" (quote from above).

If you found out that Dan's vulnerability was being used to steal your personal information, you wouldn't be so happy, right? In fact, I'd be willing to bet that you would be quite upset with Dan if he disclosed the intricate details, allowing your security to be compromised. Interesting how the opinions change when the roles are reversed....

Some BlackHat speakers have exposed vulnerabilities in ATM machines (allow individuals to steal cash from them), even information that could allow hackers to more-or-less take down the entire internet. The purpose of exposing the vulnerabilities is to allow them to be fixed. The very infrastructure that we depend on to survive depends on this. What if a vulnerability was discovered that allowed hackers to shut down entire power plants, leaving cities powerless for extended periods of time? Would you also feel that this information should be disclosed?

And going back to the whole issue of donations.....It has little to do with the money itself, although you should realize that Bounty Threads exist for a reason -- namely to get DEVS interested in making developments that they might not otherwise be interested in. As such, it really IS a driving force behind development in its own way. Why should a DEV want to develop "XYZ" app just because Sally and Joey want it when the Dev isn't interested in doing "XYZ" at all? But if Sally and Joey are willing to compensate the DEV for his/her efforts, it's a different matter all together. Bounty threads exist for this exact reason. Disallowing them would be detrimental to future development, as DEVS would only work on projects that interest them, and not necessarily what the community wants. Lack of donations and people not keeping their bounty pledges aren't just what this is all about either. It's also about respect. About respecting someone enough to not steal their work (and sometimes use it for profit). It's about showing gratitude and appreciation.

Beyond that - consider that this isn't necessarily Dan's "hobby". Dan works full time as a Security Researcher. It's his JOB. He owns a security company called Azimuth Security. Much of his work is devoted to protecting us from theft of personal information by way of security vulnerabilities.

Imagine for a moment that you work as a locksmith. During your daily work routine, you re-key locks, help individuals access their vehicles that they have been locked out of, etc. Then, an individual comes across you and says "Hey, you're really good at that. Would you mind opening my car door for me? I seem to have locked my keys inside. I'll give you $20 for it.....". So you get out your tools, and open their door for them. Now that the door is open, they hop inside their car, shut and lock the door, and drive off leaving you in the dust. How incredibly disrespectful! This is precisely what Dan has dealt with in the past.

Now I really don't have an opinion on this either way. I'm only trying to point out facts that need to be considered. Dan seems to share this viewpoint with a recent tweet he made:

"The only "wrong" side of the disclosure debate is one that believes it has the only defensible position."

I couldn't agree more. On the one hand, we have the ability to unlock our bootloader. On the other, we have inherent security risks. It's hard to give more weight to one than the other.

Once again, I don't have an opinion either way. We could argue these points 'til the cows come home, but at the end of the day, it is Dan's decision to make, and his alone....unless of course another individual skilled enough in cryptography can also find and exploit the vulnerability.

[/End Rant]