On November 16th, 2004 — π years after arriving in Oxford — I\nsubmitted my\ndoctoral thesis.\nMy mind wasn't really on my thesis though; I was thinking about an issue I had\nnoticed in recent Intel CPUs: The "Hyper-Threading" (simultaneous\nmultithreading) feature they introduced in 2002 could leak information between\nexecution threads via the cache state.
\nThere was a joke at the time that although the National Security Agency had\nopened up in recent years and started taking their defensive role more\nseriously, the one aspect of cryptography which they would never discuss\npublicly was side channel attacks — and this itself constituted a side\nchannel, revealing the importance they attributed to the field. Being active\nin computer security, and recognizing that the NSA knew a few things about the\ntopic, my immediate priority was to determine whether the information leakage\nI had identified was sufficient to construct a practical cryptographic side\nchannel. By mid-December I had a proof-of-concept exploit which stole enough\nbits of an RSA private key for the entire key to be reconstructed, and I\nturned my attention to the hard part of the problem: Quietly notifying\nsecurity teams and working together to get the issue fixed before disclosing\nit publicly.
\nThis became my occupation for the next six months. While my Oxonian\ncontemporaries were making corrections to their theses and applying for jobs,\nI set those aside (much to the irritation of my supervisors): I had a\nresponsibility, and it took priority over mere career considerations. As it\nturned out, being unemployed proved useful in early May, when Intel —\nrather irked by my impending publication — asked Yahoo to order me to\nwithdraw the paper; Yahoo was very happy to reply that, unlike many FreeBSD\ndevelopers, I was not in fact employed by them and they were not in a position\nto threaten to fire me. On May 13th, 2005, I presented my paper at\nBSDCan and published\nan\nadvisory on the topic; advisories were published at the same time or soon\nthereafter by FreeBSD, NetBSD, Red Hat, SCO, and Ubuntu.
\nAnyone involved with open source software security will recognize the process\nof responsible disclosure (now widely called "coordinated disclosure", after\nsome people in the industry struggled with the concept of responsibility),\nalthough the length of this particular process was unusual. If you find a\nsecurity vulnerability, you shouldn't ignore it (or worse, sell it to bad\nactors); conversely, it's irresponsible to simply publish the vulnerability\nand hope that the good guys can fix it before the bad guys exploit it.\nInstead, you have a responsibility to identify who needs to know about the\nissue and to contact them — quietly — so they can get patches\nready to distribute to their users the moment the issue becomes publicly\nknown.
\nIn this particular case, I was unusually able to put my life on hold: I was\nsingle, child-free, and, after defending my thesis and returning home to\nCanada, living rent-free in my (very tolerant) parents' basement. While I had\nsome bills to cover — being a type 1 diabetic, I had to purchase insulin\n— living in Canada meant that I didn't need to worry about the risk of\nextraordinary costs from a hospital stay. Had I been living in the USA, I\nwould have needed to prioritize seeking employment and medical insurance and\nlikely would not have been able to discharge the duty which fate had thrust\nupon me.
\nEngineers, of course, are familiar with such duties: While the precise\nlanguage varies from jurisdiction to jurisdiction, nearly all professional\nethical codes include a requirement to act upon safety hazards *regardless\nof whether any personal connection exists*. Members of the IEEE commit,\nfor example, "to hold paramount the safety, health, and welfare of the\npublic..." without that duty being limited to hazards arising from projects\nemploying the Engineer in question: The duty "to disclose promptly" vests in\nany Engineer who recognizes that the hazard exists. As with responsible\ndisclosure of software security vulnerabilities, however, the subject matter\nof this duty is limited in scope: There is no duty to report if work is being\ndone inefficiently. As a legal duty this would be reasonable; but as a\nmoral duty, I feel it sets the bar too low.
\nEngineering codes also often set out a process of escalation: In the common\ncase of a licensed Engineer becoming aware of a hazard in a project they are\nworking on, in the first instance they should report their concerns to their\nemployer; only if that fails to yield results should they take more direct\nsteps. This is both efficient and practical: Reporting an issue to someone\nwho fails to act upon it isn't necessarily sufficient to discharge a duty, but\nconversely reporting everything broadly risks drowning out the few items which\ntruly need broad attention. I routinely apply this same principle; for\nexample, in 2009 I discovered that the Amazon EC2 firewall broke Path MTU\nDiscovery by default and reported it to Amazon; but by November 2012 I\nconcluded that Amazon was not going to address the problem, so I took to my\nblog to\nadvise\nAmazon customers on how to fix Path MTU Discovery for themselves. (As it\nhappened, Amazon fixed the bug a short time later.) While this was in no way\na safety or computer security concern, I felt that, knowing what I did, I had\nan ethical duty to share that knowledge to help people who were affected by\nthe issue.
\nIn the Star Trek: The Next Generation episode "The First Duty", the\nlate Patrick Stewart, speaking as Jean-Luc Picard, delivers a memorable speech\nabout truth:
\n\nThe first duty of every Starfleet officer is to the truth, whether it's\nscientific truth or historical truth or personal truth! It is the guiding\nprinciple on which Starfleet is based! If you can't find it within yourself\nto stand up and tell the truth about what happened, you don't deserve to wear\nthat uniform!
The duty described here is a duty to uncover and not conceal the truth; while\nI agree with this duty, I don't think it goes far enough. To me, the duty\nincludes actively seeking out people to whom the truth should be told.\nTo hide behind "nobody asked" is to fail to fulfill the duty.
\nMuch ink has been spilled by philosophers about duty and ethics, and the\nGerman Enlightenment philosopher Fichte in particular had some interesting\ncomments to make in the fourth of his 1794 lectures, *Über die\nBestimmung des Gelehrten* — often translated as *The Vocation of\nthe Scholar*, which inspired the title of this essay. Fichte argues that\nScholars have a particular relationship to knowledge: A Scholar "possesses\nhis Knowledge not for himself, but for society". It is not proper for a\nScholar to hoard knowledge; rather, Scholars have a duty to impart their\nknowledge to others — in Fichte's somewhat exaggerated view, to act as\n"the Teacher of the human race". On the other hand, it is unnecessary and\ninappropriate to enter with everyone into the "deep inquiries which he\nhimself has been obliged to undertake"; rather, a Scholar relies upon others'\ntrust in the Scholar's honesty when conveying the particular knowledge which\nis needed. Fichte notes that "[t]he Scholar will never be tempted to bring\nmen to the adoption of his convictions by coercion or the use of physical\nforce [...] neither will he deceive them". Scholars are not Plato's\nphilosopher-kings; their duty is to provide the requisite knowledge, not to\nenforce what is done with that knowledge.
\nNow, I don't agree with Fichte on every point. Fichte considers Scholars to\nbe the loftiest of all classes, and even invites each Scholar to consider\nthemselves a "Priest of Truth"; living in rather more egalitarian times, I\nabsolutely reject this framing. Nor do I accept Fichte's framing (in his\npreceding lecture, On the Distinction of Classes in Society) that the\nduty of Scholars to share knowledge arises from an obligation to render back\nto society what it has done for us; to me, the duty arises not from a debt\nto society, but rather attaches to knowledge itself, no matter who holds it.
\nThis duty, naturally, is not unlimited. As Fichte notes, there is no duty\nto force people to act upon shared knowledge — indeed there is a moral\nobligation to accept everyone's freedom to choose how they act. Similarly,\nthere is no duty to become a Cassandra: As with any gift, people are free to\nrefuse the gift of knowledge, however unwise that might be; ultimately, if\neveryone who is able to act upon some knowledge has been made aware of it,\nthe duty has been exhausted.
\nIn modern vernacular, the terms "Scholar" and "Researcher" often overlap, but\nto me there is a very precise distinction: Researchers create new knowledge,\nwhile Scholars carry that knowledge to the people who need it — a\nnarrower definition than that of Fichte, whose Scholars also carry a duty to\nstrive to extend knowledge. Many people, of course, are both Researchers and\nScholars; but there are plenty of people who perform research and\npublish papers without truly communicating their discoveries. The research\npaper which is published in a journal but never read is almost a\ncliché; but even papers which are read do not necessarily have the\nimpact they deserve if they are read only by academics and not by anyone in\na position to act upon the findings published. My undergraduate alma mater,\nSimon Fraser University — of which I\nhave been a sitting Senator for over two decades — describes itself\nas "Canada's engaged university" and makes a point of valuing not just\nacademic output but the work of connecting academic learning with the real\nworld. A true Scholar, in my mind, is someone who feels bound by the duty of\nknowledge: To find the people with whom it should be shared.
\nIt is for everyone to choose their own role in society, and not everyone\nfeels every duty the same way; for that matter, just as my experience in 2005\nwould have been different had I needed to obtain medical insurance, not\neveryone is able to act upon a duty, no matter how much they feel it. But\nfor myself, I choose the life and duty of a Scholar.
\nPosted at 2026-10-31 19:00
","headings":[{"level":2,"text":"The Duty of a Scholar","id":"the-duty-of-a-scholar"}]}}