Item — HN Reader

> Claiming that you somehow were not aware of what NSO is doing is just not one of those

The parent comment of the comment I replied to (try saying that twice as fast backwards) was attempting to point out that we should avoid using guilt by association. i.e. We should focus on innocence for the individual until guilt is proven.

How do you know for absolute certainty that at least one developer (who has ever worked at NSO at any point in time) never said "this is completely illegal and I'm not comfortable with being near it."?

How do you know for absolute certainty that at least one developer (who has ever worked at NSO at any point in time) never said "You know what, I'm really not comfortable doing this work. I thought this was a good gig and I'd be okay with type of work... but I'm really not. It's killing my soul and I can't stand it."?

> at least I won't give you the benefit of the doubt if you're working there as a dev.

Fair enough. You're entitled to that position.

For me: People can make mistakes. People can get in over their head. People can mistakenly believe the lies other people tell them. I'd rather assume someone is innocent until guilt is proven by evidence.

> Likewise, if you work for Hacking team, you know what you are doing.

What even is a "Hacking" team?

Project Zero could be considered a "Hacking" team. Are they bad people for doing what they do? We know about loads of new zero days thanks to them. Extending this, am I part of a hacking team? I do white hat research. Does that mean I'm bad?

Do you mean "malicious adversary" perhaps? Because that is an entirely different concept. Then we are dealing with malicious intent. That's when someone may indeed be guilty (if backed up evidence, of course).

> What even is a "Hacking" team?

I believe @black_puppydog is talking about the company that literally is called "Hacking Team"

https://en.wikipedia.org/wiki/Hacking_Team

> HackingTeam is a Milan-based information technology company that sells offensive intrusion and surveillance capabilities to governments, law enforcement agencies and corporations.

Ah fair enough! Thanks for pointing that out.

As @svane pointed out, "Hacking Team" are exactly one of the companies that are on my personal list of companies where if you work for them, you lose (my) benefit of the doubt.

From your comment I do take the point that maybe not everyone is aware of all of these actors. But if you sign a contract with them, you either know what you're doing and are cool with it, or you didn't care enough to google them. (And I have a very hard time believing the latter.)

The former I find morally wrong, the latter I find negligent (note the "I find", indicating personal choice here) and I do think both should be disqualifying if not explained well.

Edit: even though my personal attitude towards this doesn't matter in the grand (or even small) scheme of things, I'd consider this a situation where I'd invert the burden of proof. Yes, being associated with these companies should put a burden on the person working there if they want a different job. They should have to think about that before they sign. High-skilled people who consider their offers should have a strong incentive to decline.