3 ms·
Still, if the researcher releases IP together with the vulnerability, it seems legitimate for the IP owner to defend itself.
by kiliancs 11y ago
Still, if the researcher releases IP together with the vulnerability, it seems legitimate for the IP owner to defend itself.
- david_shaw 11y agoYeah, I agree with you -- and that's where the conflicting messages seem to start. FireEye claims that they don't take issue with the vulnerability disclosure, just the IP publication; meanwhile, ERNW claims that they promised not to release any IP without FireEye approval, and that they never intended to release anything that would relate to IP. It's a weird situation.
- hga 11y agoDepends on whether the IP claims are valid. ERNW isn't saying anything about being provided IP by FireEye, which also sounds unlikely. And what IP could it be? Going from US law, none of trademark (they aren't pretending to be FireEye), trade secret (if FireEye revealed any without NDAs etc. they no longer are), or patents (publicly disclosed, their reason for existence in the US at least) would seem to apply. If they got source code, this would be going rather differently. Maybe reverse engineering law is different in Germany? Or ... well, let me just say I wouldn't be inclined to buy anything from the company after looking at that picture of the CEO, I've seen and interacted with that type way too many times.