8 ms·

I don't like what the FBI has done, but I'll say what I always say when "responsible" disclosure comes up, for consistency. Responsible disclosure is a courtes

I don't like what the FBI has done, but I'll say what I always say when "responsible" disclosure comes up, for consistency. Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has.

hueving 11y ago
Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.
- wcummings 11y ago
  Treating "hacking tools" like weapons is a terrible idea. This is the flawed thinking behind the Waasenaar Agreement.
  - hueving 11y ago
    If hacking tools didn't facilitate access to industrial control systems, personal health and financial information, private communications and photos, then I would probably agree. A vulnerability in a criminals hands leads to very real life damages.
    - cmdrfred 11y ago
      The issue is with the software the has a vulnerability not the software that exploits it. It would be fine to sell gangs guns if we could patch that pesky 'bullets kill humans' bug.
  - justratsinacoat 11y ago
    It seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.
    - derefr 11y ago
      Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
      - wvh 11y ago
        [...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
- profeta 11y ago
  Code is not a weapon. bad analogy. Also, LA gangs used EV cars for modern drive-by's. Should EV cars now have a "gun tax"?
  - droopybuns 11y ago
    Wassenaar would not exist if you were correct. https://en.wikipedia.org/wiki/Wassenaar_Arrangement https://en.wikipedia.org/wiki/Wassenaar_Arrangement
  - hueving 11y ago
    What destroyed the enrichment devices in Iran then?
    - 98216381 11y ago
      The incompetence of the operators of the devices.
    - calgoo 11y ago
      Hackers and state actors. Whatever tools the used where just that. If someone uses a wrench destroy the enrichment devices, did the wrench destroy the device or the person using it?
      - hueving 11y ago
        If they used a bomb to destroy it, we'd still classify the bomb as a weapon regardless of whether you say the bomb destroyed it or the bomber.
        Dylan16807 11y ago
        But if they had started flipping the power switch rapidly we wouldn't call the power switch a weapon. You can destroy a lot of devices that way.
        hueving 11y ago
- bcook 11y ago
  Define "value".
- roel_v 11y ago
  So you're advocating a permit system for, say, having a copy of nmap? Don't tell me we need to go back to that discussion again?
  - hueving 11y ago
    No, 'nmap' is not a vulnerability. I'm advocating to hold people responsible that sell vulnerabilities to the highest bidder under the full knowledge that the bidder will not tell the manufacturer and will use it for nefarious purposes. It's nearly impossible to enforce something like this because of anonymous markets and crypto currencies, but we should at least shame people that advocate for it or admit to doing it.
    - dogma1138 11y ago
      Nmap has modules that can detect and exploit basic and often old vulnerabilities.
    - roel_v 11y ago
      What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).
- pjc50 11y ago
  It does if you're the FBI: https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal
- rlpb 11y ago
  Selling arms solely to law enforcement, however, sounds reasonable.
AnthonyMouse 11y ago
> Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has. This seems a lot like saying, if someone pays you to do a structural analysis of a parking garage because they want to know if they can profit by shorting the company that owns it, and you discover that the garage is likely to collapse, you don't have any obligation to disclose the vulnerability.
- ikeboy 11y ago
  The garage will hurt people when it collapses.
  - jarcane 11y ago
    Are you implying that compromised security is harmless?
    - ikeboy 11y ago
      It doesn't represent imminent physical danger, so the analogy fails.
      - heartsucker 11y ago
        What about the hackers who remotely stopped a Jeep on the freeway? I'm pretty sure that's "imminent physical danger."
        ikeboy 11y ago
        And the reaction on HN at the time was very critical. Iirc they disclosed it to the company soon enough, but I would certainly be upset if they auctioned it to the highest bidder.
      - pdkl95 11y ago
        What magic are you using to predict that this communication tool is never be used by someone in "imminent physical danger"? Depending on how this exploit works, a simple denial of service when someone needs to call for emergency services may indeed represent an "imminent physical danger". People rely heavily on their phones, both for connectivity and to store important information. As this reliance increases in the future, the probability of a phone being part of a life threatening situation will approach one.

hueving 11y ago

Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.

wcummings 11y ago
Treating "hacking tools" like weapons is a terrible idea. This is the flawed thinking behind the Waasenaar Agreement.
- hueving 11y ago
  If hacking tools didn't facilitate access to industrial control systems, personal health and financial information, private communications and photos, then I would probably agree. A vulnerability in a criminals hands leads to very real life damages.
  - cmdrfred 11y ago
    The issue is with the software the has a vulnerability not the software that exploits it. It would be fine to sell gangs guns if we could patch that pesky 'bullets kill humans' bug.
- justratsinacoat 11y ago
  It seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.
  - derefr 11y ago
    Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
    - wvh 11y ago
      [...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
profeta 11y ago
Code is not a weapon. bad analogy. Also, LA gangs used EV cars for modern drive-by's. Should EV cars now have a "gun tax"?
- droopybuns 11y ago
  Wassenaar would not exist if you were correct. https://en.wikipedia.org/wiki/Wassenaar_Arrangement https://en.wikipedia.org/wiki/Wassenaar_Arrangement
- hueving 11y ago
  What destroyed the enrichment devices in Iran then?
  - 98216381 11y ago
    The incompetence of the operators of the devices.
  - calgoo 11y ago
    Hackers and state actors. Whatever tools the used where just that. If someone uses a wrench destroy the enrichment devices, did the wrench destroy the device or the person using it?
    - hueving 11y ago
      If they used a bomb to destroy it, we'd still classify the bomb as a weapon regardless of whether you say the bomb destroyed it or the bomber.
      - Dylan16807 11y ago
        But if they had started flipping the power switch rapidly we wouldn't call the power switch a weapon. You can destroy a lot of devices that way.
        hueving 11y ago
bcook 11y ago
Define "value".
roel_v 11y ago
So you're advocating a permit system for, say, having a copy of nmap? Don't tell me we need to go back to that discussion again?
- hueving 11y ago
  No, 'nmap' is not a vulnerability. I'm advocating to hold people responsible that sell vulnerabilities to the highest bidder under the full knowledge that the bidder will not tell the manufacturer and will use it for nefarious purposes. It's nearly impossible to enforce something like this because of anonymous markets and crypto currencies, but we should at least shame people that advocate for it or admit to doing it.
  - dogma1138 11y ago
    Nmap has modules that can detect and exploit basic and often old vulnerabilities.
  - roel_v 11y ago
    What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).
pjc50 11y ago
It does if you're the FBI: https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal
rlpb 11y ago
Selling arms solely to law enforcement, however, sounds reasonable.

AnthonyMouse 11y ago

> Responsible disclosure is a courtesy. Exploits are valuable. Information asymmetry is the name of the game. Apple is not entitled to free labor. If they don't like it they should hire researchers, as the FBI has. This seems a lot like saying, if someone pays you to do a structural analysis of a parking garage because they want to know if they can profit by shorting the company that owns it, and you discover that the garage is likely to collapse, you don't have any obligation to disclose the vulnerability.

ikeboy 11y ago
The garage will hurt people when it collapses.
- jarcane 11y ago
  Are you implying that compromised security is harmless?
  - ikeboy 11y ago
    It doesn't represent imminent physical danger, so the analogy fails.
    - heartsucker 11y ago
      What about the hackers who remotely stopped a Jeep on the freeway? I'm pretty sure that's "imminent physical danger."
      - ikeboy 11y ago
        And the reaction on HN at the time was very critical. Iirc they disclosed it to the company soon enough, but I would certainly be upset if they auctioned it to the highest bidder.
    - pdkl95 11y ago
      What magic are you using to predict that this communication tool is never be used by someone in "imminent physical danger"? Depending on how this exploit works, a simple denial of service when someone needs to call for emergency services may indeed represent an "imminent physical danger". People rely heavily on their phones, both for connectivity and to store important information. As this reliance increases in the future, the probability of a phone being part of a life threatening situation will approach one.