There is one definition of "hacker" that has been circulating for thirty years and is substantially false: "someone who gets into other people's systems without authorisation".
Not because it is false as a description of a behaviour. Because it describes something that has nothing to do with the word, and this distinction is not an academic detail: it is the reason the profession exists and the reason hacker culture spent twenty years being accused of being criminal when it was not.
This article tries to put the words back in their place. The most uncomfortable part is precisely the one about the terms that divide, because the words that divide are almost always the ones used to exclude someone.
"Hacker": the definition that survived
The most quoted version is the one in the Jargon File, the compendium of computer jargon compiled and curated by the community itself starting in the Eighties. Its first definition, dating back to the 1981 edition, is:
HACKER [originally, one who makes furniture with an axe] 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to the majority of users who prefer to learn the minimum necessary.
The parenthesis about the axe is an ethnography of the term, and it serves to show that in English to hack means "to cut, to slash, to cheat": the vocabulary is that of someone who bores a hole through a wall instead of going through the door. Not that of someone who breaks in.
The same idea is taken up, and made official, by RFC 1392 (*Internet Users' Glossary*):
A person who enjoys having an intimate understanding of the internal workings of a system, particularly computers and computer networks.
Three elements, and all three are necessary: intimate understanding, enjoyment, and system. There is no crime anywhere. There is not even an obligation to break in: the definition holds for whoever writes the code of a driver, for whoever reverse-engineers a protocol, for whoever reads the code of an operating system to understand why it does what it does.
The Jargon File definition, however, has one sentence that needs to be read carefully, because it is the point where the term starts covering the uncomfortable cases too:
A malicious meddler who tries to discover sensitive information by poking around.
So in the same entry there is both the hacker who studies and the one who eavesdrops. This is an uncomfortable detail, and one that is often omitted: the sharp distinction between "hacker" and "criminal" never existed in the source. What exists is the distinction between hacker and cracker, which is another thing entirely.
"Cracker": a pathology, not just a technical difference
The alternative label is cracker, with a C. It is the one the hacker community proposed because "hacker" was by then being used by the media in the wrong sense.
The operative definition is banal and lies in the name: a cracker breaks. He does not explore, he forces his way in. He does not want to understand how it works, he wants it to open.
This needs saying too, because it is the point almost everyone gets wrong: there is no technological difference between hacker and cracker. The techniques are identical. The same primitives, the same tools, the same knowledge. The difference lies entirely in intent and in the authorised perimeter, and is therefore an ethical and legal difference, not a technical one.
One point that almost nobody writes, because it is uncomfortable: the distinction is also a pathology. Cracker in English is a racial slur, used historically against people of colour, and for that reason it disappeared from ordinary usage in the English language, replaced by specific terms like software cracker or password cracker.
That is why the term appears in the heading above, but in the body we call it "the one who breaks" and we do not use it for people. Those who still use it rarely, in the sense the hacker culture intended, are defending an Eighties tradition instead of doing security. The rest of the world uses it in a neutral sense, as in "the cracker of that password", and that usage has nothing to do with the tradition.
It is worth adding one fact, because it says a lot about how the profession evolves. In 1981 Ian Murphy, alias Captain Zap, was the first person to be convicted for a computer-related offence: he altered the internal clocks at AT&T so that people calling during the day would be charged the night-time rates. He was not convicted for a computer crime, which in 1981 did not exist: he was convicted for receiving stolen goods, the law that was there. He ended up with 1000 hours of community service and later became a security consultant, as well as a consultant on the 1992 film Sneakers.
A year before the computer crime law existed, and it ended with him as a consultant. It is the first case in history, and it says more than many essays.
"Lamer": the most interesting insult of the three
Lamer is the third term, and it is the only one of the three that was born from within hacker culture. It is not an outside insult, it is not a piece of media nonsense: it is a technical judgement, and in this case a precise one.
The current definition is: someone who uses other people's tools and techniques without understanding them. The script kiddie is the archetype: he downloads a tool, changes two parameters, and does not know what happens underneath. He runs the same exploits as the professionals and is unable to say why they work or what happens if the target is patched.
The difference between a lamer and someone who does not know anything is awareness. The lamer knows he does not know, and uses it anyway. That is what makes him diagnostic: it is the exact description of a learning phase, and almost everyone has been through it.
That is why the term, in its original sense, is not an insult but a diagnosis. It is what the culture says to someone who is starting out and is in a hurry: the path exists, but the part that makes you useful is the one you have not done yet.
The reason the term has a different reputation today is that it was stolen from the outside and used as a spectacle. Lame, l33t, h4x0r, sk1ddie became a costume, and the costume has one advantage the culture does not: you can put it on and take it off. Hacker culture cannot: it has to be demonstrated.
The three philosophies, and why the question is not settled
Part of the question asks whether distinct philosophies exist. They do, and there are three, but they are not three technical styles: they are three different answers to the same question, which is "who does the ability to understand how a system works belong to".
The technician: understanding the system
The oldest and simplest position: the hacker is the one who understands. The value lies in understanding, and the ability to understand is a good in itself, independent of where it is applied.
It is the philosophy of the MIT model railroad club, of Thompson and Ritchie with Unix, of Kildall with CP/M. None of these attacked anything: they built better. The measure of merit is what you can explain.
The limit of this position is real, and its own supporters recognise it: on its own it says nothing about what to do with what you know.
The ideal: code is public
Stallman and the GNU Manifesto: software should not be proprietary, and the reason is not competition. The problem is that an infrastructure you depend on and cannot read is not yours.
This is the only one of the three philosophies that produced a movement, and the full discussion — the four freedoms, copyleft, the split between free and open source — is in Open source: why it suits paid software.
The lasting contribution is not a licence, it is the discovery that information can be shared at zero cost and that this changes the economic calculus of an entire industry.
The activist: the system is a target
The third current, hacktivism, starts from an opposite assumption: the problem is not software freedom, it is what software does. Proprietary code is an accident; proprietary code that censors is a weapon.
Here the internal division is real and is not a nuance: the same label covers everything from responsible disclosure — you find a flaw, you warn whoever should be warned, and only after the agreed time do you publish — to destructive attacks on civilian infrastructure. The two things have nothing in common beyond the name, and using the same word for both is the reason the public can no longer tell anything apart.
The uncomfortable part: the division serves to exclude
Up to here the three philosophies look like three legitimate ways of being a hacker. But the most useful question is another one: who benefits from "hacker" and "cracker" being different words?
The honest answer is that the distinction has always had two functions in real time, and one is technical and one is not.
The technical one is real: under the labels there are different behaviours, and a security department has to be able to say "I found a vulnerability" and "I had unauthorised access" because they are two things with different legal consequences. On this the separation is useful and should be kept.
The non-technical one is something else: hacker culture has always used words as a status tool. Saying "look, don't touch" serves two things at once — it signals that the one who looks is at the higher level, and it signals that the one who touches should be excluded from the group.
The result is that a great many competent people excluded themselves because they did not accept the jargon, or were excluded for not being of the right category. A very large number of people who today work in security professionally did so without ever calling themselves hackers. It is an absurdly large loss of talent, and it stems from a question of labels.
It is worth saying the reverse too: the division does not protect the culture, it empties it. Words that serve to distinguish useful skills from useless ones age badly. Cracker is already dead for linguistic reasons, as we have seen.
The rule we use
The distinction we keep, and that is useful on the job, is not the one about hats but this question: do I have the ability to understand this system or not?
From there everything else follows without needing any definitions:
if I do not understand what I am doing, I am a lamer, and the right thing to do is learn to read it;
if I understand it and I have authorisation, I am what the client paid for, and it does not matter what I call myself;
if I understand it and I do not have authorisation, I am a cracker, and there is no useful version of that sentence.
The three philosophies from earlier are a different question, and they are all legitimate as long as none of them becomes a criterion for judging people. The technician is not superior to the activist, the activist is not superior to the technician, and neither of them is superior to someone who simply wrote code to earn a living.
A label serves two: the one who puts it on and the one who receives it. In hacker culture, for a long time, it served above all the one who put it on.
If you remember one thing
The shortest and most accurate definition I know, and one that cannot be replaced, is the one from the 1981 Jargon File: a hacker is someone who enjoys exploring the details of a system and of how to stretch its capabilities.
In the definition there is no crime, there is no victim, and there is not even advanced competence. There is only technical curiosity. Everything else is a label, and labels change with time and the market; curiosity does not.