1<!DOCTYPE html> 2<html lang="en"> 3 <head> 4 <meta charset="utf-8"> 5 <title>Responsible disclosure and White hacking it's about Caring - Philosophy - Delving Bitcoin</title> 6 <meta name="description" content="With all the current hacks, Iâm often asked at local meetups what are the ethical guidelines when you have to do responsible disclosures to a vendor, especially when there is real money on the line. To have been in the sâ¦"> 7 <meta name="generator" content="Discourse 2026.8.0-latest.1 - https://github.com/discourse/discourse version 7df32723f1c80f5dcf6cc736df517dd5676bb20e"> 8<link rel="icon" type="image/png" href="https://delvingbitcoin.org/uploads/default/optimized/1X/863d31b22a9d4d4072777bffb9b9ded86a1638bc_2_32x32.svg"> 9<link rel="apple-touch-icon" type="image/png" href="https://delvingbitcoin.org/uploads/default/optimized/1X/863d31b22a9d4d4072777bffb9b9ded86a1638bc_2_180x180.svg"> 10<meta name="theme-color" media="(prefers-color-scheme: light)" content="#ffffff"> 11<meta name="theme-color" media="(prefers-color-scheme: dark)" content="#111111"> 12 13<meta name="color-scheme" content="light dark"> 14 15<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, viewport-fit=cover"> 16<link rel="canonical" href="https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910" /> 17 18<meta name="discourse-track-view-session-id" content="eIo7QuREq6jrBe1Xu2LPhNBozw653CAT"><meta name="discourse-beacon-pageview-enabled" content="true"><meta name="discourse-engagement-tracking-enabled" content="true"> 19<link rel="search" type="application/opensearchdescription+xml" href="https://delvingbitcoin.org/opensearch.xml" title="Delving Bitcoin Search"> 20 21 22 <link href="/stylesheets/color_definitions_light_7_1_da3f5cc9802a1f15c128b578b44ef4f24498f9d6.css?__ws=delvingbitcoin.org" media="(prefers-color-scheme: light)" rel="stylesheet" class="light-scheme" data-scheme-id="7"/><link href="/stylesheets/color_definitions_dark_1_1_79e68b9f5e22aee97f450375fb16052c151c4d27.css?__ws=delvingbitcoin.org" media="(prefers-color-scheme: dark)" rel="stylesheet" class="dark-scheme" data-scheme-id="1"/> 23 24<link href="/stylesheets/common_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="common" /> 25 26 27 28 <link href="/stylesheets/automation_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="automation" /> 29 <link href="/stylesheets/checklist_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="checklist" /> 30 <link href="/stylesheets/discourse-cakeday_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-cakeday" /> 31 <link href="/stylesheets/discourse-data-explorer_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-data-explorer" /> 32 <link href="/stylesheets/discourse-details_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-details" /> 33 <link href="/stylesheets/discourse-github_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-github" /> 34 <link href="/stylesheets/discourse-graphviz_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-graphviz" /> 35 <link href="/stylesheets/discourse-lazy-videos_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-lazy-videos" /> 36 <link href="/stylesheets/discourse-local-dates_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-local-dates" /> 37 <link href="/stylesheets/discourse-math_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-math" /> 38 <link href="/stylesheets/discourse-narrative-bot_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-narrative-bot" /> 39 <link href="/stylesheets/discourse-presence_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-presence" /> 40 <link href="/stylesheets/discourse-reactions_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-reactions" /> 41 <link href="/stylesheets/discourse-solved_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-solved" /> 42 <link href="/stylesheets/discourse-templates_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-templates" /> 43 <link href="/stylesheets/discourse-topic-voting_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-topic-voting" /> 44 <link href="/stylesheets/discourse-user-notes_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="discourse-user-notes" /> 45 <link href="/stylesheets/docker_manager_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="docker_manager" /> 46 <link href="/stylesheets/footnote_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="footnote" /> 47 <link href="/stylesheets/poll_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="poll" /> 48 <link href="/stylesheets/spoiler-alert_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="spoiler-alert" /> 49 <link href="/stylesheets/discourse-reactions_mobile_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="(width < 40rem)" rel="stylesheet" data-target="discourse-reactions_mobile" /> 50 <link href="/stylesheets/discourse-reactions_desktop_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="(width >= 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /> 51 <link href="/stylesheets/poll_desktop_9adf6367736040a3be3b22dc750fd896956794c8.css?__ws=delvingbitcoin.org" media="(width >= 40rem)" rel="stylesheet" data-target="poll_desktop" /> 52 53 <link href="/stylesheets/common_theme_3_b15d65fc05aa70b8e635cc2a4de745b16d1d8fc9.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="common_theme" data-theme-id="3" data-theme-name="discotoc"/> 54<link href="/stylesheets/common_theme_6_61f283a0e4386fffe4d4071c06e67dc923620b01.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="common_theme" data-theme-id="6" data-theme-name="discourse plotly"/> 55<link href="/stylesheets/common_theme_2_ecf3220f7d050b334fcb761c74f7cd0bb7048082.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="common_theme" data-theme-id="2" data-theme-name="discourse-mermaid-theme-component"/>
56<link href="/stylesheets/common_theme_1_bb22801594b3d0411fcda4ecd39c1f65c289bbf9.css?__ws=delvingbitcoin.org" media="all" rel="stylesheet" data-target="common_theme" data-theme-id="1" data-theme-name="default"/> 57 58 59 60 61 62 <link rel="alternate nofollow" type="application/rss+xml" title="RSS feed of 'Responsible disclosure and White hacking it's about Caring'" href="https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910.rss" /> 63 <meta property="og:site_name" content="Delving Bitcoin" /> 64<meta property="og:type" content="website" /> 65<meta name="twitter:card" content="summary" /> 66<meta property="og:image" content="https://delvingbitcoin.org/uploads/default/original/1X/863d31b22a9d4d4072777bffb9b9ded86a1638bc.svg" /> 67<meta property="og:url" content="https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910" /> 68<meta name="twitter:url" content="https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910" /> 69<meta property="og:title" content="Responsible disclosure and White hacking it's about Caring" /> 70<meta name="twitter:title" content="Responsible disclosure and White hacking it's about Caring" /> 71<meta property="og:description" content="With all the current hacks, Iâm often asked at local meetups what are the ethical guidelines when you have to do responsible disclosures to a vendor, especially when there is real money on the line. To have been in the situation few times in the pre-LLM era w.r.t bitcoin L2s security research, e.g with things like CVE-2020-26895 which would have been easy to exploit for direct gain, oneâs become very familiar with the rules in the infosec community, and more strictly the legal redlines. So letâ..." /> 72<meta name="twitter:description" content="With all the current hacks, Iâm often asked at local meetups what are the ethical guidelines when you have to do responsible disclosures to a vendor, especially when there is real money on the line. To have been in the situation few times in the pre-LLM era w.r.t bitcoin L2s security research, e.g with things like CVE-2020-26895 which would have been easy to exploit for direct gain, oneâs become very familiar with the rules in the infosec community, and more strictly the legal redlines. So letâ..." /> 73<meta property="og:article:section" content="Philosophy" /> 74<meta property="og:article:section:color" content="92278F" /> 75<meta property="article:published_time" content="2026-09-23T23:36:16+00:00" /> 76<meta property="og:ignore_canonical" content="true" /> 77 78 79 80 </head> 81 <body class="crawler "> 82 83 <header> 84 <a href="/">Delving Bitcoin</a> 85</header> 86 87 <div id="main-outlet" class="wrap" role="main"> 88 <div id="topic-title"> 89 <h1> 90 <a href="/t/responsible-disclosure-and-white-hacking-its-about-caring/2910">Responsible disclosure and White hacking it's about Caring</a> 91 </h1> 92 93 <div class="topic-category" itemscope itemtype="http://schema.org/BreadcrumbList"> 94 <span itemprop="itemListElement" itemscope itemtype="http://schema.org/ListItem"> 95 <a href="/c/philosophy/5" class="badge-wrapper bullet" itemprop="item"> 96 <span class='badge-category-bg' style='background-color: #92278F'></span> 97 <span class='badge-category clear-badge'> 98 <span class='category-name' itemprop='name'>Philosophy</span> 99 </span> 100 </a> 101 <meta itemprop="position" content="1" /> 102 </span> 103 </div> 104 105 </div> 106 107 108 109 <div itemscope="itemscope" itemtype="http://schema.org/DiscussionForumPosting"> 110 <meta itemprop='headline' content='Responsible disclosure and White hacking it's about Caring'> 111 <link itemprop='url' href='https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910'> 112 <meta itemprop='datePublished' content='2026-09-23T23:36:16Z'> 113 <meta itemprop='keywords' content=''> 114 <meta itemprop='articleSection' content='Philosophy'> 115 <div itemprop='publisher' itemscope itemtype="http://schema.org/Organization"> 116 <meta itemprop='name' content='Delving Bitcoin'> 117 </div> 118 119 120 121 <div id='post_1' class='topic-body crawler-post'> 122 <div class='crawler-post-meta'>
123 <span class="creator" itemprop="author" itemscope="itemscope" itemtype="http://schema.org/Person"> 124 <a rel='nofollow' href='https://delvingbitcoin.org/u/ariard'><span itemprop="name">ariard</span></a> 125 <meta itemprop='url' content='https://delvingbitcoin.org/u/ariard'> 126 127 </span> 128 129 <link itemprop="mainEntityOfPage" href="https://delvingbitcoin.org/t/responsible-disclosure-and-white-hacking-its-about-caring/2910"> 130 131 132 <span class="crawler-post-infos"> 133 <time datetime='2026-09-23T23:36:16Z' class='post-time'> 134 September 23, 2026, 11:36pm 135 </time> 136 <meta itemprop='dateModified' content='2026-09-23T23:36:16Z'> 137 <span itemprop="position">1</span> 138 </span> 139 </div> 140 <div class='post' itemprop="text"> 141 <p>With all the current hacks, Iâm often asked at local meetups what are the ethical guidelines when you have to do responsible disclosures to a vendor, especially when there is real money on the line. To have been in the situation few times in the pre-LLM era w.r.t bitcoin L2s security research, e.g with things like CVE-2020-26895 which would have been easy to exploit for direct gain, oneâs become very familiar with the rules in the infosec community, and more strictly the legal redlines.</p> 142<p>So letâs said it clearly about the Liquid situation going to exploit a known vulnerability under the motivation to protect users funds, and keeping a substantial amount as a self-granted bounty is clearly theft, if not on the legal dimension, at the very least on an ethical ground. Indeed, it is laudable to have sent back the wide majority funds, and this is clear act that the person or the group of person acting, are not completely assholes or malevolent. Still, itâs okay to withhold users funds as a self-appointed bounty and we should not make a bad precedent of it.</p> 143<p>Of course, the bitcoin network is living in the cypherpunk lalaland and on the wide and wild Internet there are no unified set of social rules, so generally we have only sheer ethics and principles as raw belt-and-suspenders in this kind of situations. In matters of ethics, there is the basic â<em>Silver</em>â rule, â<em>do not treat others in ways that you would not like to be treated</em>â. Somehow, I believe this rule has some universal scope, i.e whatever the culture youâve grown within, itâs a bit valuable.</p> 144<p>Now if one goes to appreciate legal considerations, for the folks who are both security and legal nerds, there is no way a self-granted bounty coming from a live exploitation is ever going to be held legally valid, as some kind of legally contractual reward from the vendor. Why of course every juridiction has its own legal system, there is half a dozen of subjects which are mostly the same across the major juridictions, be it a common law or civil law system, and appreciation of contractual consent is one of them. So whatever, a vendor says during a live exploitation or whatever their lawyers can say, any âagreementâ is most likely to be unenforceable in front of a court due to âduressâ and likely voided as such.</p> 145<p>With a high degree of certainty, a situation where a party threats to disappear with exploited funds if the âcontractualâ terms are not agreed on what is asking for, can be be qualified as âduressâ, even if the vendor has been particularly disagreeable, condescending or lazy it doesnât create a safe habor to justify anything. Iâll brush aside criminal qualification, though at least under one major European jurisdiction, courts has said that one can be held responsible on the civil ground for grey exploitation. And in the US law, as far as I know, it has been already analyzed very recently in <a href="https://law.justia.com/cases/federal/appellate-courts/ca9/23-927/23-927-2025-11-12.html" rel="noopener nofollow ugc">USA v. SULLIVAN (9th Cir. 2025)</a>.</p> 146<p>Iâm copying pasting the Sullivanâs decision on it, as itâs quite eloquently said by judges of the 9th Circuit: â<em>â¦allowing post hoc authorization could encourage extortionary schemes: hackers could download sensitive data, demand a data ransom, and then insist that the c
146ompany alter its bug bounty program terms to retroactively immunize their conduc</em>tâ. Iâm not a lawyer, though may I say itâs generally a wise move not to be in a situation where a vendor can sue you for $40 bucks in front of a court that will move forward with such a civil claim.</p> 147<p>Responsible disclosure is not about protecting or being nice with the vendors, sadly it can happen that their corporate incentives structure make it such that they donât have real skin in the game to be proactive in fixing vulnerabilities. Any seasoned security researcher knows that corporate incentives misalignement is a real thing, though it doesnât change the equation. Responsible disclosure itâs about caring for the end users, and when you act as white hackers it is their interests that you should keep in mind, ideally holding it above youâre own material interests.</p> 148<p>As a matter of disclosure, Iâve never been at Blockstream, never been in business with them either and since the start of my involvement in this industry back in 2019 I have an ethical line to never take bug bounty for responsible disclosures being done on my own initiative so I humbly believe Iâm very free about what I can say about the present situation, and speaking my mind based on my own multiple experiences working on responsible disclosures. Letâs keep high standards in this space, and we all benefit from that on the long term.</p> 149<p>So yes responsible disclosure or white hacking <em>itâs about caring a whole lot</em>, and about the users first.</p> 150 </div> 151 152 <div itemprop="interactionStatistic" itemscope="itemscope" itemtype="http://schema.org/InteractionCounter"> 153 <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> 154 <meta itemprop="userInteractionCount" content="0" /> 155 <span class='post-likes'></span> 156 </div> 157 158 159 160 161 162 </div> 163 164 </div> 165 166 167 168 169 170 171 172 </div> 173 <footer class="container wrap"> 174 <nav class='crawler-nav'> 175 <ul> 176 <li itemscope itemtype='http://schema.org/SiteNavigationElement'> 177 <span itemprop='name'> 178 <a href='/' itemprop="url">Home </a> 179 </span> 180 </li> 181 <li itemscope itemtype='http://schema.org/SiteNavigationElement'> 182 <span itemprop='name'> 183 <a href='/categories' itemprop="url">Categories </a> 184 </span> 185 </li> 186 <li itemscope itemtype='http://schema.org/SiteNavigationElement'> 187 <span itemprop='name'> 188 <a href='/guidelines' itemprop="url">Guidelines </a> 189 </span> 190 </li> 191 <li itemscope itemtype='http://schema.org/SiteNavigationElement'> 192 <span itemprop='name'> 193 <a href='/tos' itemprop="url">Terms of Service </a> 194 </span> 195 </li> 196 <li itemscope itemtype='http://schema.org/SiteNavigationElement'> 197 <span itemprop='name'> 198 <a href='/privacy' itemprop="url">Privacy Policy </a> 199 </span> 200 </li> 201 </ul> 202 </nav> 203 <p class='powered-by-link'>Powered by <a href="https://www.discourse.org">Discourse</a>, best viewed with JavaScript enabled</p> 204</footer> 205 206 207 208 </body> 209 210</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.