eidolon @shaderphantom@awoo.space

FBI InfraGard is a CERT-like organization that acts as a liaison between security researchers, vendors and entities which are considered critical infrastructure: banks, utilities, etc. It is a reasonably harmless organization which intends to do well but is controversial for a few reasons.

The main reason it's controversial is due to being incubated by the FBI. The other main reason why it's controversial is because they wrap vulnerability discussions in a series of NDAs. InfraGard-coordinated vulnerabilities do not necessarily see public disclosure.

Personally, I am not really a fan of InfraGard, for both the NDAs and FBI background: friends of mine have been burned by the FBI before when trying to ethically handle vulnerabilities.

But this does not mean that somebody should be faulted for choosing to participate in InfraGard. At worst it just means they believe in something others don't.

You wouldn't defederate someone for drinking chocolate milk out of a wine glass, right? InfraGard membership is, maybe at worst, the infosec equivalent of that type of social faux pas.

When it comes to vulnerability disclosure though, I believe public disclosure is in the public interest. And, well, InfraGard doesn't. And that's the real controversy... they aren't cops or law enforcement of any kind.