emptywheel

Example: Your client/customer asks you to remove an embarrassing finding from your pentest/assessment report. Do you?

Example: You find your client/customer is breaking the law (such as not disclosing a big breach as required by law). Do you contact the police?

Example: You've signed an NDA, but then want to talk to the press about it, keeping your name and customer's name anonymous.

Example: Building tools that can be used for both (evil) attack and (good) defense:https://twitter.com/JBird_Vegas/status/986397958651432961 …

Example: An obvious fraud (e.g. Gregory Evans) promotes himself and appears often on TV. Should you point this out, or ignore it?

Example: You see a URL ending in ?articleId=473. Do you increment it to 474 in order to see what happens? Do you script this to grab all sequential article IDs? Note: I'm asking the 'ethical' question here, not debating the 'legal' question.

Example: Is breaking the law inherently unethical? You live in a country where encryption is outlawed, do you help activists encrypt their stuff?

Example: This recent incident (Kasperky outing a U.S. malware campaign against ISIS) brings up a lot of ethical questions:https://twitter.com/ryanaraine/status/986397613174931456 …