While we're in agreement that bad actors should be exiled from the infosec community, let me be vocal about something we DO NOT NEED: a database of bad actors and their alleged transgressions.
If you understand legal and privacy issues, you know why this is such dumb idea. 1/
If you understand legal and privacy issues, you know why this is such dumb idea. 1/
Who will build this database?
Supply infrastructure for it?
Maintain it?
Secure it?
Address the obvious legal issues that will come from those seeking to be removed from it?
These are serious questions and can't be answered with "we'll figure that out." Because we won't. 2/
Supply infrastructure for it?
Maintain it?
Secure it?
Address the obvious legal issues that will come from those seeking to be removed from it?
These are serious questions and can't be answered with "we'll figure that out." Because we won't. 2/
Another central issue with this is "what behavior justifies inclusion?" We can all pick out a few people who obviously belong, but as soon as you back away from the extreme cases, "should this person be on the list" often gets murky. 3/
Bad actors suck, but we shouldn't fight bad behavior with more behavior likely to cause problems. I'm not protecting abusers, anything but.
Sometimes "we have to do something" ends up causing more issues than it solves. That's certainly the case with a central DB. 4/4
Sometimes "we have to do something" ends up causing more issues than it solves. That's certainly the case with a central DB. 4/4
