Dishonest Software: Fighting Back Against the Industry Norms
summary
Built a network tap pipeline capturing pcapp traffic and inspecting with Wireshark to spot APT exfiltration via chunked RAR over FTP; deleted staged archives and hacked back into an FTP server, which accidentally erased a contractor’s personal photos and destroyed trust. Defines dishonest software by whether informed consent breaks the value proposition and shows honest alternatives: Slack-based alerts, a loss mode requiring an explicit click, visible collected data, and instant revocation; cites FullStory session replay and legal context like ECPA and GDPR.
AI-written summary · about
chapters (13)
- 0:00Dishonest software concept
- 2:28Honest versus legal software
- 3:30Surveillance at GE
- 11:30Rationalizing mass surveillance
- 16:22Dishonest security consequences
- 17:47Honest software at Collide
- 18:31Testing dishonest software
- 19:53Full Story privacy case
- 21:59Steve Jobs’ privacy insight
- 22:42Informed consent anatomy
- 24:50Fighting dishonest software
- 27:55Honesty benefits organizations
- 28:38Q&A
related talks
35mFriendly Fire: How Security Software Messes Up
45mWinning by deception: tactics, techniques, and procedures of adversarial A.I.
01h 06mKeynote: Online Child Sexual Abuse Material (CSAM): The Insider Attack You Have Not Seen Coming
21mHow Software is Developed for Privacy Professionals
15mAn Ethnographic Understanding of Software (In)Security and a Co-Creation Model
52mWhistleblowing 101
30mFair game: the ethics of telco fraud
30mArrested DevOps Live...