What about black hat hacking?

Updated as GitHub Community is moving to GitHub Discussions

Overview

Since what has been going on in the past decade, especially with the Russo-Ukraine war, I've been noticing more cyber attacks lately on the news. If you all don't believe me, check out monitor.firefox.com/breaches to see how much damage has been caused by data breaches alone. I saw an even bigger loophole in the world of open source: a library/framework (ex. Angular, Lodash, Laravel, etc.) can be (ab)used not only by large organizations like Facebook, but individuals/groups as well. Essentially a developer's library/framework can be - and is probably being - used to cause massive collateral damage. For a library developer, knowing that they are enabling a hacker to cause more harm can be demoralizing.

Proposed Resolution

There's not much I can do here as I am not a legal expert, but I can tell you that there probably needs to be a way to make the vague concept of "no hacking/phishing[/...] allowed" into a less ambiguous phrase. However, I did post topics on Mozilla Discourse and GitHub Community (old) (new) that go deeper into the subject; these should help clarify the subject further.

Remarks

I would like to thank the group/organization behind this project for making a license for the greater good! I am hoping to make a few repos public, but I don't want to use current licenses that will allow harm.

[tommaitland]

I'm of two minds here. In most (all?) countries hacking is illegal and if you're already operating outside the law then you probably don't care about what the license of software you use to aid your hacking is. You'd have more luck enforcing criminal law and convicting for hacking than you would enforcing the incorrect use of software licensed under Do No Harm.

But maybe there's wording that's a little broader and would encompasses uses that are inside the law here, and appreciate that there are other things included in the license that are also illegal or unlawful in some countries.

If someone wants to suggest wording I think we can consider further.

According to FindLaw,

Hacking is broadly defined as the act of breaking into a computer system.

I will look for a more detailed definition of hacking.

[realpixelcode]

How about this?

• intentionally creating any malicious backdoors or security vulnerabilities in the derivative work
• intentionally making any malware or spyware disguised as harmless available to the general public

[tommaitland]

In the interest of simplicity I think if we include this we should be looking for broad wording, otherwise we start to get into debates at a level of detail that aren't helpful for the goal of the license.

For example, to cover the whole realm of environmental protection in the license we have 4 simple points:

the extraction or sale of fossil fuels
the destruction of habitats for threatened or endangered species, including through deforestation or burning of forests
the abuse, inhumane killing or neglect of animals under human control
industrial processes that generate waste products that threaten life

Perhaps this could be combined with #58 and we have a general clause on cyber? Something like:

add to d: d. addictive or destructive products and services

• products that facilitate state surveillance or unauthorised access to a computer or network

@tommaitland, @realpixelcode,

I think we can go one step further with combining this issue, and issues #58 and #75 (because Google Analytics is technically surveillance, which itself deals with cybersecurity, as well).

I still want to reiterate the reason why I created this issue in the first place. The reason is because a license like Do No Harm is useless and contradictory to its mission if it cannot defend the end user from attacks that could lead to identity theft or a grid outage at worst due to a phishing site for example. If a framework as complex as Angular or Svelte were used, then a hacker can easily fool the average person into entering in their credentials. Cyber warfare, data breaches, and other attacks are not to be taken lightly, especially right now when the stakes are at their highest.

[tommaitland]

The reason is because a license like Do No Harm is useless and contradictory to its mission if it cannot defend the end user from attacks that could lead to identity theft or a grid outage at worst due to a phishing site for example.

I'm not sure I'm understanding your intent. The license is designed to ensure that the efforts a developer has gone to in creating software they release into the world are not used for harm, the license does nothing to protect the users of tools themselves – so protecting a user from malware, surveillance or attacks is beyond the scope of what the license can achieve. The license is only able to say to the developers of software that may be malicious that they are not welcome to use code licensed with No Harm.

A hacker can use software to harm millions of vulnerable people. Think about it. With today's modern technology, countries are at risk of having their energy grids taken out by black hats, and we now rely on these grids more than ever. Back in 2021, my state lost power for about a week due to a winter storm, and countless people died of trying to stay warm with almost three necessities going out. Now imagine the consequences of a hacker in Russia or Belarus hitting the power grid. Substations would be out for months, and without power, the modern metropolitan world would grind to a halt. All of this would result in no food and drinkable water at the dinner table and no heating and air to prevent our homes from freezing or burning up respectively. This basically results in the tragic deaths of countless civilians.

[tommaitland]

I'm not disagreeing with you that hacking is bad! My suggestion above would disallow this:

add to d: d. addictive or destructive products and services

• products that facilitate state surveillance or unauthorised access to a computer or network

However I was also just making the point that if someone is doing something illegal they probably don't care about what license their dependencies have so this is all fairly academic.

[realpixelcode]

products that facilitate [...] unauthorised access to a computer or network

That's a dangerous phrasing, since it might, unintentionally, target white-hat hacking software. A phrasing that targets the act of accessing a computer or network without sufficient authorisation instead of the software would be better IMO.

[realpixelcode]

Merging #81:

Basically, there are companies that specialise in finding zero-day security vulnerabilites in software (“zero day” stands for “zero days since the developer discovered the vulnerability”, meaning it hasn't been discovered at all). Since they sell that information to cyber criminals and even authoritarian countries, their business model directly harms the digital security of end users as well as our critical infrastructure. That's why I propose banning it altogether.

Possible phrase to be included in the licence:

the systematic trade with zero-day security vulnerabilites in software accessible to the general public, without disclosing them to the public, the developer or the responsible state authority

@realpixelcode, @tommaitland, at least we have it in there as adeterrent. The licensor has the deterrents in the form of this license to have the legal grounds to perform audits themselves, or the GitHub staff could open the gates to potentially private repositories to allow investigators to find the perpetrator. Even state supported hacking should not go unchecked.

[realpixelcode]

@IRod22 I didn't mean vulnerabilities specifically in the licensed work, but generally in any software.