Developers, sysadmins, and users (the holy trinity SO, SF and SU) should know black hat techniques to defend themselves better against them. Posting such instructions on public forums, however, creates the risk of malicious use. Would you answer questions that require black hat knowledge?
Developers tend not to have been taught anything about security (see blog post) I particularly like the quote:
"I start my security training class by asking developers "how many years of development experience do you have?" On average there are about 3-5 years experience. Then I ask "how many people have done a one day software security class?" About one hand will usually go up.
So in class of 30 people, we can expect 150 years of programming experience and about one day of software security training experience! Is it just me or should we really give up on this stuff when we haven't even really started trying seriously yet? "
So if there is a base of knowledge that I can point develoers at and say "Here read this, follow the instructions and test the hell out of your app" then I'd be a little (not a lot) happier that the application may be secure.
Likewise I'd love QA/testers to do the same. Hell I'd love management to take it seriously too.
Ultimately all this knowledge is out there somewhere, and the blackhats are already using it. If we (as whitehats) do not equip ourselves with even the basic knowledge we don`t stand a chance of securing our computers.
If you ban guns, only bad guys will use them...
"Black hat" is based on intent, only. There's no difference between "black hat" and "white hat" knowledge. If it's publicly available info (e.g.-a public exploit, SQL injection), then I don't see a problem with it. Preferably, you leave something explaining how to protect against whatever it is you're explaining.
It is a difficult question to answer definitively. Increasingly there may be legal issues, and I'm no lawyer.
Computers and those that program and even use them have historically been regarded with some suspicion. As As Janet Reno, at the time the US Attorney General, said in 1998: "They have computers, and they may have other weapons of mass destruction."
Many countries, including the UK, log all web sites users visit and the source and destination of all emails, retaining this information for several years.
Several countries, including the UK and Germany, have, to varying extents, made the programming, possession, use or distribution of "hacker1 tools" illegal. Within this there seems to be little understanding of the dual-use possibilities of most software.
It may be that providing assistance in obtaining and using such tools could be seen as a criminal or at least terrorist activity, especially if the advice given did, indeed, lead to criminal use of the tools or methods.
Whether we need to take these possibilities too seriously is hard to know. Do they affect the amount and usefulness of information given in response to genuine queries from sysadmins? Probably yes. At least as worrying is the deleterious effect on dissemination of information about known weaknesses in software and systems and the availability of good tools for testing and evaluating software and systems.
1 Sadly, attempts to retain 'hacker' as a positive term seem long-since lost in the media and political worlds: perhaps we should have copies of Henry S Warren's "Hacker's Delight" on our desks to remind us of a happier use of the term.
Knowing the worst code is often the only way to truly understand how to know the best. I would have no objection to posting black hat techniques in response to a question as long as I was satisfied that nobody, including myself, would be vulnerable to any sort of trouble from it, that the person was not intending to use such information to no good, and that the information was already readily available and reported to those responsible for fixing said vulnerabilities.
If on one hand, I discovered a hole in a particularly important piece of software, I would make it my priority that I make sure I give due notice to those whose business it is to fix that hole, but on the other hand, I would surely not let it stop me from educating those in the community on best practises to prevent the exploit from affecting them.
Education is prevention, and even black hat techniques can be taught in an educational way.
"Black hat" or "White hat" is how the knowledge is used, not the actual knowledge.
The question is then are you writing for a Black hat or white hat audience?
- If you are writing for a white hat audience include information about how to defend against it.
- If you are writing for a black hat audience include information about ....
Short answer No Way. Just because it's possible to "---------" to make "--------" unusable by just typing "------" at the "----------" it should not be announced.
That's no different asking your buddy working airport security how to sneak xyz past airport security. I hope they don't tell you. I even hope they don't even know so they can't tell you.
If you know what I mean. If you don't know, sorry, I can't tell you :)