📸 Photo

Max Vision

With his government service at an end, Max went to work building his reputation as a white-hat hacker, even as he lived under the sword of Damocles of a pending federal indictment.

The BIND vulnerability and the resultant success of Whitehats.com had given him a running start. Now Max hung up his own shingle as a computer security consultant, erecting a new website touting his services as a hacker for hire at one hundred dollars an hour—or free to nonprofit groups. His chief selling point: a 100 percent success rate in penetration tests. He had never once confronted a network he couldn't crack.

It was an exciting time to be a white hat. The rebellious spirit that drove the open-source software movement was planting itself in the computer security world, and a new crop of college graduates, dropouts, and former and current black hats was upending the conservative assumptions that had dominated security thinking for decades.

First to be dustbinned was the tenet that security holes and attack methods should be kept quiet, held privately among a cadre of trusted responsible adults. The white hats called this notion “security through obscurity.” The new generation preferred “full disclosure.” Discussing security problems widely not only helped get them fixed, but it also advanced the science of security, and hacking, as a whole. Keeping bugs private only benefited two groups: the bad guys who were exploiting them, and ven-