The Security Ecology

Probably a bigger one than you think, according to security guru Richard M. Smith.

"Hackers represent a vital niche in the whole ecology of network security," he says.

The hacker's most important security role is as the "bugspotter". Many attacks on computer systems exploit software weaknesses: either mistakes in the underlying code, or unexpected used of known features. These glitches are an inevitable part of the development process, and some will always get by even the best programmers and make their way into shipping software. Few, if any of these bugs can escape the intense scrutiny of the hacking community for very long, however. As a whole, the community represents a testing ground far more effective than any one corporation could ever construct.

Working under the same "full disclosure" philosophy that underlies the Open Source movement, hackers hunt down these bugs and bring them to the public's attention. This is a controversial practice; while most hackers at least give software companies a chance to release a patch before announcing their finds, many argue that bug reports provide the black hats with tools they wouldn't otherwise have.

But such speculation might give too much credence to the threat that black hats pose.

"The good guys often overestimate the bad guys," says Smith. "The bad guys are often pretty lazy, and won't find holes unless someone else points them out."

Still, it's a pervasive fear. Last year, Microsoft cried foul after security firm eEye publicised a major hole in its server software, stating that "responsible security companies do not provide tools that can be used to attack innocent people."

What do you think? Tell the Mailroom. And read what others have said.

Take me to Hackers