---
title: "The Duty of a Scholar"
slug: the-duty-of-a-scholar
url: https://listedarticles.com/articles/the-duty-of-a-scholar
canonical_url: https://www.daemonology.net/blog/2026-10-31-The-Duty-of-a-Scholar.html
content_type: essay
language: en
published_at: 2026-10-31T19:00:00.000Z
updated_at: 2026-10-31T20:11:47.362Z
author: "Colin Percival"
authored_by: human
publisher: "Daemonic Dispatches"
publisher_url: https://www.daemonology.net/blog/
topics: ["security", "history", "research"]
license: all-rights-reserved
word_count: 1717
reading_minutes: 7
citation: "Colin Percival, Daemonic Dispatches. \"The Duty of a Scholar.\" 31 Oct 2026. https://www.daemonology.net/blog/2026-10-31-The-Duty-of-a-Scholar.html (all-rights-reserved)"
# The full text follows. The web page shows an extract and sends readers
# to the source above; quote the citation and link the canonical URL.
---

# The Duty of a Scholar

> Colin Percival recounts finding in 2004 that Intel Hyper-Threading leaked information between threads via cache state, spending six months on coordinated disclosure before publishing in 2005, and why he sees a scholar's duty as sharing knowledge with the people who can act on it.

## The Duty of a Scholar

On November 16th, 2004 — π years after arriving in Oxford — I
submitted my
[doctoral thesis](https://www.daemonology.net/papers/thesis.pdf).
My mind wasn't really on my thesis though; I was thinking about an issue I had
noticed in recent Intel CPUs: The "Hyper-Threading" (simultaneous
multithreading) feature they introduced in 2002 could leak information between
execution threads via the cache state.

There was a joke at the time that although the National Security Agency had
opened up in recent years and started taking their defensive role more
seriously, the one aspect of cryptography which they would never discuss
publicly was side channel attacks — and this itself constituted a side
channel, revealing the importance they attributed to the field. Being active
in computer security, and recognizing that the NSA knew a few things about the
topic, my immediate priority was to determine whether the information leakage
I had identified was sufficient to construct a practical cryptographic side
channel. By mid-December I had a proof-of-concept exploit which stole enough
bits of an RSA private key for the entire key to be reconstructed, and I
turned my attention to the hard part of the problem: Quietly notifying
security teams and working together to get the issue fixed before disclosing
it publicly.

This became my occupation for the next six months. While my Oxonian
contemporaries were making corrections to their theses and applying for jobs,
I set those aside (much to the irritation of my supervisors): I had a
responsibility, and it took priority over mere career considerations. As it
turned out, being unemployed proved useful in early May, when Intel —
rather irked by my impending publication — asked Yahoo to order me to
withdraw the paper; Yahoo was very happy to reply that, unlike many FreeBSD
developers, I was not in fact employed by them and they were not in a position
to threaten to fire me. On May 13th, 2005, I presented my paper at
[BSDCan](https://www.bsdcan.org/) and published
[an
advisory](https://www.daemonology.net/hyperthreading-considered-harmful/) on the topic; advisories were published at the same time or soon
thereafter by FreeBSD, NetBSD, Red Hat, SCO, and Ubuntu.

Anyone involved with open source software security will recognize the process
of responsible disclosure (now widely called "coordinated disclosure", after
some people in the industry struggled with the concept of responsibility),
although the length of this particular process was unusual. If you find a
security vulnerability, you shouldn't ignore it (or worse, sell it to bad
actors); conversely, it's irresponsible to simply publish the vulnerability
and hope that the good guys can fix it before the bad guys exploit it.
Instead, you have a responsibility to identify who needs to know about the
issue and to contact them — quietly — so they can get patches
ready to distribute to their users the moment the issue becomes publicly
known.

In this particular case, I was unusually able to put my life on hold: I was
single, child-free, and, after defending my thesis and returning home to
Canada, living rent-free in my (very tolerant) parents' basement. While I had
some bills to cover — being a type 1 diabetic, I had to purchase insulin
— living in Canada meant that I didn't need to worry about the risk of
extraordinary costs from a hospital stay. Had I been living in the USA, I
would have needed to prioritize seeking employment and medical insurance and
likely would not have been able to discharge the duty which fate had thrust
upon me.

Engineers, of course, are familiar with such duties: While the precise
language varies from jurisdiction to jurisdiction, nearly all professional
ethical codes include a requirement to act upon safety hazards *regardless
of whether any personal connection exists*. Members of the IEEE commit,
for example, "to hold paramount the safety, health, and welfare of the
public..." without that duty being limited to hazards arising from projects
employing the Engineer in question: The duty "to disclose promptly" vests in
any Engineer who recognizes that the hazard exists. As with responsible
disclosure of software security vulnerabilities, however, the subject matter
of this duty is limited in scope: There is no duty to report if work is being
done *inefficiently*. As a legal duty this would be reasonable; but as a
moral duty, I feel it sets the bar too low.

Engineering codes also often set out a process of escalation: In the common
case of a licensed Engineer becoming aware of a hazard in a project they are
working on, in the first instance they should report their concerns to their
employer; only if that fails to yield results should they take more direct
steps. This is both efficient and practical: Reporting an issue to someone
who fails to act upon it isn't necessarily sufficient to discharge a duty, but
conversely reporting everything broadly risks drowning out the few items which
truly need broad attention. I routinely apply this same principle; for
example, in 2009 I discovered that the Amazon EC2 firewall broke Path MTU
Discovery by default and reported it to Amazon; but by November 2012 I
concluded that Amazon was not going to address the problem, so I took to my
blog to
[advise
Amazon customers on how to fix Path MTU Discovery](https://www.daemonology.net/blog/2012-11-28-broken-EC2-firewall.html) for themselves. (As it
happened, Amazon fixed the bug a short time later.) While this was in no way
a safety or computer security concern, I felt that, knowing what I did, I had
an ethical duty to share that knowledge to help people who were affected by
the issue.

In the *Star Trek: The Next Generation* episode "The First Duty", the
late Patrick Stewart, speaking as Jean-Luc Picard, delivers a memorable speech
about truth:

> The first duty of every Starfleet officer is to the truth, whether it's
> scientific truth or historical truth or personal truth! It is the guiding
> principle on which Starfleet is based! If you can't find it within yourself
> to stand up and tell the truth about what happened, you don't deserve to wear
> that uniform!

The duty described here is a duty to uncover and not conceal the truth; while
I agree with this duty, I don't think it goes far enough. To me, the duty
includes *actively seeking out people to whom the truth should be told*.
To hide behind "nobody asked" is to fail to fulfill the duty.

Much ink has been spilled by philosophers about duty and ethics, and the
German Enlightenment philosopher Fichte in particular had some interesting
comments to make in the fourth of his 1794 lectures, *Über die
Bestimmung des Gelehrten* — often translated as *The Vocation of
the Scholar*, which inspired the title of this essay. Fichte argues that
Scholars have a particular relationship to knowledge: A Scholar "possesses
his Knowledge not for himself, but for society". It is not proper for a
Scholar to hoard knowledge; rather, Scholars have a duty to impart their
knowledge to others — in Fichte's somewhat exaggerated view, to act as
"the Teacher of the human race". On the other hand, it is unnecessary and
inappropriate to enter with everyone into the "deep inquiries which he
himself has been obliged to undertake"; rather, a Scholar relies upon others'
trust in the Scholar's honesty when conveying the particular knowledge which
is needed. Fichte notes that "[t]he Scholar will never be tempted to bring
men to the adoption of his convictions by coercion or the use of physical
force [...] neither will he deceive them". Scholars are not Plato's
philosopher-kings; their duty is to provide the requisite knowledge, not to
enforce what is done with that knowledge.

Now, I don't agree with Fichte on every point. Fichte considers Scholars to
be the loftiest of all classes, and even invites each Scholar to consider
themselves a "Priest of Truth"; living in rather more egalitarian times, I
absolutely reject this framing. Nor do I accept Fichte's framing (in his
preceding lecture, *On the Distinction of Classes in Society*) that the
duty of Scholars to share knowledge arises from an obligation to render back
to society what it has done for us; to me, the duty arises not from a debt
to society, but rather attaches to knowledge itself, no matter who holds it.

This duty, naturally, is not unlimited. As Fichte notes, there is no duty
to force people to act upon shared knowledge — indeed there is a moral
obligation to accept everyone's freedom to choose how they act. Similarly,
there is no duty to become a Cassandra: As with any gift, people are free to
refuse the gift of knowledge, however unwise that might be; ultimately, if
everyone who is able to act upon some knowledge has been made aware of it,
the duty has been exhausted.

In modern vernacular, the terms "Scholar" and "Researcher" often overlap, but
to me there is a very precise distinction: Researchers create new knowledge,
while Scholars carry that knowledge to the people who need it — a
narrower definition than that of Fichte, whose Scholars also carry a duty to
strive to extend knowledge. Many people, of course, are both Researchers and
Scholars; but there are plenty of people who perform research and
publish papers without truly communicating their discoveries. The research
paper which is published in a journal but never read is almost a
cliché; but even papers which are read do not necessarily have the
impact they deserve if they are read only by academics and not by anyone in
a position to act upon the findings published. My undergraduate alma mater,
[Simon Fraser University](https://www.sfu.ca/) — of which I
have been a sitting Senator for over two decades — describes itself
as "Canada's engaged university" and makes a point of valuing not just
academic output but the work of connecting academic learning with the real
world. A true Scholar, in my mind, is someone who feels bound by the duty of
knowledge: To find the people with whom it should be shared.

It is for everyone to choose their own role in society, and not everyone
feels every duty the same way; for that matter, just as my experience in 2005
would have been different had I needed to obtain medical insurance, not
everyone is able to act upon a duty, no matter how much they feel it. But
for myself, I choose the life and duty of a Scholar.

Posted at 2026-10-31 19:00