►
Description
The Morality of Code - Glen Goodwin, SAS Institute, inc.
The act of writing code seems pretty innocuous. But what if it isn't? What if the code we write was being used in the wrong ways to hurt, to destroy, to exploit? What are the moral implications we should be considering as we hack away late into the night? How do we do the right thing in a world of software patents, privacy concerns, open source, and technological anarchy? Are we asking ourselves the right questions to find our own personal moral guidelines for writing code or are we just hoping for the best? This talk aims to not give anyone the answers but instead focus on the questions so that each of us can come to our own answers for ourselves
About Glen R. Goodwin
Glen started hacking on a Commodore PET in 1981 when he sat down at the computer and asked the kid next to him what to do. Since that first fateful `poke 59468,14` he has been hacking away on anything with a keyboard and a screen. This included a Timex Sinclair 1000, a TI 99/4A, a slew of Atari's, and too many PCs to count. He believes that the ZX81 is the best CPU ever made, Action! is the best programming language every written for the 6502, and that anyone who says anything bad about JavaScript should be forced to write LISP for the rest of their lives. Glen is the author of the STATCHAT program for the Atari ST and the D&D modules "A Wish for Temptation" and "Strongwind" (Polyhedron #123 and #130). He currently works for SAS Institute as the Chief Architect for Cyber Security R&D products and swears that Maven will never ever be in the product's build chain. In his spare time he plays a lot of Ultimate Frisbee, drinks nothing but craft beer, and hopes to one day achieve his life goal of looking exactly like Brian Posehn. He lives in Columbia, Maryland, USA, with his partner Jennifer, his cats Escher and Dolby, and a stuffed dragon named Steve.
A
Alright,
so
hi
my
name
is
Glen.
This
is
a
slide
where
I
spent
about
five
minutes.
Tell
you
who
I
am
above
me
things
like
that,
but
honestly
it
doesn't
matter
who
I
am
is
not
important
here.
Instead,
what
really
matters
at
least
to
me,
and
hopefully
to
all
of
you
by
the
end
of
this
talk,
is
what
something
I'm,
calling
the
morality
of
code
and
before
I
go
any
further.
A
I
want
to
be
very
clear
here
that
I'm
not
trying
to
lecture
anybody
or
about
their
moral
opinions
or
what
my
moral
opinions
be
instead
I'm
here
to
talk
about
the
idea
that
we
as
software
engineers,
we
need
to
take
the
time
to
consider
our
moral
opinions,
whatever
they
may
be
both
before
and
after
we
write
our
code.
My
goal
isn't
to
tell
you
what
to
do,
but
to
help
you
find
a
way
to
make
your
own
moral
decisions
regarding
your
code.
A
Okay.
So
with
that
put
aside,
what
do
I
mean
when
I
say
morality
of
code,
so
that
is
to
say
what
morality
does
a
block
of
code
have?
Of
course,
many
of
you
might
say
that
code
could
have
any
morality,
it's
just
bits
to
be
incapable
of
morality,
but
and
and
I'm
going
to
agree
with
you
there.
It's
just
bits
bits
are
not
the
problem.
It's
what
you
do
with
the
bits
morality
of
code
isn't
about
whether
or
not
those
bits
in
and
of
themselves
are
moral.
Instead,
it's
about
how
those
bits
are
used.
A
A
So
there's
a
paper
out
in
the
cryptographic
community,
it's
called
the
moral
character
of
graphic
work
and
I
think
it
applies
equally
as
well
here
to
the
greater
computer
science
community,
the
author
dr.
roadway,
he
writes
I,
suspect
that
many
of
you
see
no
real
connection
between
social,
political
and
ethical
values
and
what
you
work
on
and
I
think
he's
right.
Most
of
us
never
really
think
about
this
stuff
at
all.
We
never
consider
the
moral
consequences
of
the
code.
We
are
writing.
A
We
never
ask
ourselves:
can
this
code
be
used
to
cause
pain
or
spread
hate
induce
fear
or
oppress
others?
We
never
ask
ourselves
these
questions,
because
the
more
because
considering
the
moral
consequences
of
things
is
hard,
I
think
it
takes
courage
and
I
think
it
takes
work.
In
fact,
instead
of
confronting
these
topics,
we
come
up
with
comedian.
Little
shortcuts
little
white
lies.
If
you
will
that
we
tell
ourselves
and
others
to
avoid
facing
this
subject.
A
These
are
things
like
I'm,
just
writing
code
here,
I'm
not
responsible
for
what
people
do
with
it
or
nobody
would
ever
use
my
code
like
that
or
if
I
didn't
write
it.
Someone
else
would
these
little
platitudes
they
let
a
sidestep
the
moral
considerations
of
what
we
do
and
the
little
white
lie
we
tell
ourselves
most
commonly.
Is
this
one
here,
my
stuff
isn't
harming
anyone?
A
Listen.
We
all
want
to
believe
that
our
code
is
just
code.
We
put
it
out
there
into
the
universe
and
it's
only
used
to
make
I.
Don't
know
sunshine
and
rainbows
accept
the
reality.
Is
our
code
is
out
there
for
anyone
to
do
whatever
they
want
to
steal?
To
harass,
to
bully
to
a
press.
Tell
me
a
group
that
you
are
morally
opposed
to
and
I
bet
I
can
show
you
an
example
of
them
using
common
tools.
I
went
to
literally
the
website
of
literally
the
first
hate
group.
A
This
is
all
good
and
well
until
you
realize
that
something
you
wrote
is
killing
people
I'm
sure
that
sounds
a
little
overly
dramatic
to
some
of
you.
You
may
think
I'm
even
playing
this
up
a
bit
but
realized
again
that
this
is
just
your
brain
trying
to
avoid
thinking
about
this
subject.
This
is
hard
stuff
and
ultimately
nobody
wants
to
believe
that
we
are
participants
in
other
people's
suffering,
our
famous
in
or
infamous
JavaScript
community
satirist,
Jen
shiver.
If
you
don't
know
who
she
is
look
her
up,
her
talks
are
great.
A
Once
you
share
your
code
for
others
to
use
whether
you
do
it
commercially
or
open
source,
there
is
no
limit
to
what
other
people
can
do
with
it
and
by
not
weighing
the
moral
consequences
of
our
work.
We
are
allowing
permitting
encouraging
even
our
code
to
be
used
in
ways
that
we
as
individuals
and
as
a
community
may
find
reprehensible.
A
A
Well,
let's
start
by
looking
at
what
we
mean
by
morally
responsible
first,
so
to
me,
morally
responsible
means
in
alignment
with
my
moral
and
ethical
opinions.
You
obviously
are
different
and
have
your
own
moral,
ethical
pendants
that
are
different
than
mine.
We
each
have
our
own
morality
to
be
morally
responsible.
We
need
to
act
in
a
manner
consistent
with
our
opinions.
A
What
we
want
is
for
the
users
of
our
code
to
behave
in
a
moral
and
ethical
manner
that
is
consistent
with
ours.
This
is
the
expectation
we
have
when
we
release
our
code,
it's
a
while
that
are
into
the
wild
that
our
code
is
being
used
in
a
morally
consistent
manner
to
our
own
and
not
contrary
to
it
to
use
our
code,
otherwise,
would
be
used
in
a
morally
irresponsible
fashion.
A
So
what
we
mean
by
more
responsible
is
morally
consistent
manner
to
our
own.
Now,
with
that
in
mind,
we
can
begin
to
examine
our
code
to
understand
the
moral
opinions
within
it.
So
I
propose
you
do
this
by
asking
yourself
for
questions
I'm
going
to
run
through
here,
question
1.
What
are
my
moral
intense
as
the
author
of
the
code,
that
is
to
say
what
morality
do
I
bring
to
the
code
itself
if
I
write
a
program,
for
example,
for
engaging
a
distributed,
denial-of-service
attack.
A
A
Second,
one
of
my
users
going
to
do
with
this
code
in
order
to
understand
the
moral
implications
of
your
code.
You
first
need
to
understand
what
can
be
done
with
your
code,
so
here
I
say
challenge
yourself
to
imagine
all
of
the
possible
scenarios,
all
the
ways
your
code
could
be
used
for
both
good
and
for
evil.
This
is
kind
of
a
thought
experiment
and
it
may
be
a
little
hard.
It
may
take
a
while,
or
it
may
be
really
easy.
A
I
think
this
largely
depends
on
the
scope
of
what
you're
writing
and
the
audacity
of
the
idea
that
you
are
trying
to
implement,
but
once
you
understand
what
can
be
done
with
the
code,
you
can
ask
yourself
the
third
question:
what
are
my
obligations
to
those
who
suffer
the
effects
of
my
code?
See
the
users
of
your
code
or
not?
Who
you
need
to
worry
about
if
I
write
a
twitter
bot
library
that
just
replies
to
tweets,
for
example,
it
is
the
user
of
the
library
who
decides
how
to
direct
the
Twitter
bot.
A
The
user
of
the
library
is
not
the
target
of
the
library.
The
target
is
whomever
the
twitter
bot
is
aimed
at
the
recipients
of
your
code
are
those
who
suffer
the
consequences
of
it.
So
how
do
you
feel
about
the
people
being
targeted
by
your
code?
Can
you
empathize
with
them?
Are
they
being
wronged
once
you
know
how
you
feel
about
these
people?
A
A
Now
I'm
not
advocating
the
I'll
stop
writing
code,
but
maybe
for
some
things,
maybe
it's
better
if
it
was
never
written
at
all.
All
I'm
asking
is
that
before
you
write
it
think
about
whether
or
not
it
should
be
written
in
the
past
year,
futuris
sam
Harris
gave
a
TED
talk
entitled.
Can
we
build
AI
without
losing
control
over
it
in
it?
He
argues
not
that
we
don't
try
to
build
AI,
but
that
we
first
must
develop
the
ethical
and
moral
understanding
necessary
to
do
it
safely.
Maybe
that's
the
responsible
thing
to
do
here.
A
Don't
give
up,
but
first
understand
the
moral
impact
of
what
we
are
doing
and
ask
yourself.
Is
this
right
or
is
this
raw?
Now,
if
you
absolutely
must
write
something,
consider
not
releasing
everything
again,
don't
get
me
wrong.
I
love
the
open
source
movement
I
participated
in
it,
just
like
everybody
else
in
this
room,
but
maybe
we
don't
need
to
release
every
little
thing
to
get
up.
Maybe
sometimes
we
need
to
keep
some
code
for
ourselves.
A
Of
course,
we
know
that
anything
can
be
circumvented
and
in
JavaScript,
especially
code
is
very
easy
to
edit
a
disabled,
but
again
at
least
you
are
trying
to
be
responsible
and
your
safeguards
force
others
to
actively
be
irresponsible.
This
is
like
locking
your
car
doors,
it's
not
going
to
prevent
someone
from
stealing
something
out
of
your
car,
but
it
does
make
them
have
to
work
and
we're
so
slightly
harder
at
it.
This
is
also
the
keeping
honest
people-
honest
philosophy,
I
believe
that
it
works
for
code
as
well.
A
So,
regardless
of
whether
or
not
you
do
build
in
safeguards,
I
encourage
everyone
to
explain
your
intent
for
every
project
that
you
have
right.
A
mission
statement
explain
why
you
wrote
the
code,
explain
your
intended
usage
and
discourage
the
usage
that
you
disagree
with
again.
Another
gin
shiver
quote
from
that
same
blog
post
that
she
wrote.
A
She
said
if
you
create
something
that
is
used
other
than
your
initial
you're
responsible,
to
make
it
clear
what
your
artist
statement
is
or
what
the
lesson
you
are
trying
to
teach
is
so
this
could
be
as
simple
as
adding
a
readme
or
a
license
file
to
your
project,
a
usage
statement
txt.
If
you
will
and
here's
a
small
example
for
a
project
that
I
maintain.
A
So
a
usage
statement
could
be
as
simple
or
as
detailed
as
you
want
so
long
as
it
includes
your
purpose
for
writing
the
project
and
any
usage
that
you
would
deem
inappropriate
and
the
cost
of
adding
such
a
usage
statement
file
to
your
project
is
very
low.
So
this
is
a
low
risk,
low
effort,
vast
upside
kind
of
thing.
A
Finally,
before
you
do
release
anything
considered,
limiting
usage
through
licensing,
one
of
the
major
things
that
we
do
control
in
our
projects
is
the
license
that
gives
our
users
certain
permissions
on
how
when
and
where
they
can
execute
our
code.
As
you
may
know,
a
license
is
a
grant
of
specific
rights
under
specific
conditions,
the
right
to
use
to
copy
to
distribute
to
sell
to
make
derivative
works.
These
are
all
scoped
in
your
license
file.
So
why
not
use
that
license
to
specifically
deny
usages
that
you
want
to
prevent
here
is
the
MIT
license.
A
A
A
Prohibiting
a
group
or
class
of
people
is
against
the
motives
of
the
open
source
movement
ed
by
limiting
your
license
in
such
a
manner.
You
may
be
violating
the
openness
of
it.
Also
modify.
One
of
their
licenses
may
not
be
compatible
with
the
license
itself.
You
will
need
to
do
some
homework
here.
You
will
need
to
find
the
license
that
best
suits
your
project
and
how
it
can
be
modified
to
limit
against
the
kind
of
usage
that
you
deem
you're.
Morally
irresponsible.
A
So
that's
it
in
closing,
let
me
break
the
rule
I
mentioned
in
the
beginning
about
how
I
am
not
going
to
impose
my
moral
opinions
on
anyone.
I
am
going
to
give
you
one
moral
opinion
of
mine.
I
believe
that
we
have
a
moral
responsibility
to
examine
our
code
to
ensure
that
it
is
being
used
in
a
fashion
that
is
morally
consistent
with
our
intended
design.
A
C
C
There
is
in
fact,
no
way
in
my
distribution
chain
that
I
could
have
actually
precluded
individual
from
buying
that
app.
The
organization
would
have
respected
your
limitations
in
my
license
agreement,
but
in
practice
there
was
no
way
to
actually
enforce
it
from
any
person
actually
using
the
tool.
So
I
had
a
moral
quandary
to
decide
whether
I
need
to
call
them
or
to
pull
it
back
or
not,
and
I
thought
because
of.
C
The
medical
applications
and
other
things
I
was
I
felt
that
I
could
not
go
and
put
the
kind
of
restrictions
that
you've
just
asked
me
to
put
in
on
the
code,
because
it
would
cause
too
many
organizations
to
stop
looking
at
the
code
because
of
the
license
agreement
they'd
be
concerned,
so
you
raise
a
good
point
pragmatically
I.
Don't
think
it's
implementable.
Do
you
have
any
advice
on
how
to
mitigate
this
concern
because
I
think
it's
a
real
one.
A
So
I
thought
about
this
a
lot.
Yes,
you
can't
stop
people
right.
There
is
no
way
to
stop
governments
or
more
hackers
or
whatever
they're
going
to
use
it
if
you
want
but
I
think,
especially
in
the
case
of
governments,
if
you
are
incredibly
specific
in
your
license
constraints,
you
can't
allow
for
good
things
to
happen
within
the
government
like
you're
talking
about
and
also
keep
the
bad
things
out.
You
can
also
always
approach
those
people
and
talk
to
them
and
say
well.
What
are
you
doing
with
that
right
and
understand
that?