4 ms·

Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.

by hueving 11y ago

wcummings 11y ago
Treating "hacking tools" like weapons is a terrible idea. This is the flawed thinking behind the Waasenaar Agreement.
- hueving 11y ago
  If hacking tools didn't facilitate access to industrial control systems, personal health and financial information, private communications and photos, then I would probably agree. A vulnerability in a criminals hands leads to very real life damages.
  - cmdrfred 11y ago
    The issue is with the software the has a vulnerability not the software that exploits it. It would be fine to sell gangs guns if we could patch that pesky 'bullets kill humans' bug.
- justratsinacoat 11y ago
  It seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.
  - derefr 11y ago
    Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
    - wvh 11y ago
      [...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
      - hueving 11y ago
        This discussion is about vulnerabilities, not tools like nmap, etc that can be used for other constructive purposes. Please explain how you think having an undisclosed vulnerability is useful to build something.
    - AnthonyMouse 11y ago
      > enriched vein of uranium FWIW "enrich" in the context of uranium is the thing done by centrifuges. You don't get enriched uranium out of the ground. And Napalm is basically styrofoam and gasoline. You don't need much in the way of chemistry equipment to make it. > It really seems like the law doesn't know what to do about that category of things, generally. The main problem with the concept is that it doesn't end. A person with malicious intent can cause quite a lot of destruction with only the stuff everybody already has. There is no point in restricting chemistry equipment when people already have gasoline (or olive oil or lard or alcohol or ...) The only way to separate a person from the means to cause trouble is to eject them naked into the vacuum of space, and even then it's mostly because you can expect that to kill them.
  - wcummings 11y ago
    There's little difference between knowledge of a vulnerability and a tool to exploit it.
profeta 11y ago
Code is not a weapon. bad analogy. Also, LA gangs used EV cars for modern drive-by's. Should EV cars now have a "gun tax"?
- droopybuns 11y ago
  Wassenaar would not exist if you were correct. https://en.wikipedia.org/wiki/Wassenaar_Arrangement https://en.wikipedia.org/wiki/Wassenaar_Arrangement
- hueving 11y ago
  What destroyed the enrichment devices in Iran then?
  - 98216381 11y ago
    The incompetence of the operators of the devices.
  - calgoo 11y ago
    Hackers and state actors. Whatever tools the used where just that. If someone uses a wrench destroy the enrichment devices, did the wrench destroy the device or the person using it?
    - hueving 11y ago
      If they used a bomb to destroy it, we'd still classify the bomb as a weapon regardless of whether you say the bomb destroyed it or the bomber.
      - Dylan16807 11y ago
        But if they had started flipping the power switch rapidly we wouldn't call the power switch a weapon. You can destroy a lot of devices that way.
        hueving 11y ago
bcook 11y ago
Define "value".
roel_v 11y ago
So you're advocating a permit system for, say, having a copy of nmap? Don't tell me we need to go back to that discussion again?
- hueving 11y ago
  No, 'nmap' is not a vulnerability. I'm advocating to hold people responsible that sell vulnerabilities to the highest bidder under the full knowledge that the bidder will not tell the manufacturer and will use it for nefarious purposes. It's nearly impossible to enforce something like this because of anonymous markets and crypto currencies, but we should at least shame people that advocate for it or admit to doing it.
  - dogma1138 11y ago
    Nmap has modules that can detect and exploit basic and often old vulnerabilities.
  - roel_v 11y ago
    What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).
pjc50 11y ago
It does if you're the FBI: https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal
rlpb 11y ago
Selling arms solely to law enforcement, however, sounds reasonable.

Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.

by hueving 11y ago

Weapons are also valuable, that doesn't give you a free pass to sell arms to gangs.

wcummings 11y ago

Treating "hacking tools" like weapons is a terrible idea. This is the flawed thinking behind the Waasenaar Agreement.

hueving 11y ago
If hacking tools didn't facilitate access to industrial control systems, personal health and financial information, private communications and photos, then I would probably agree. A vulnerability in a criminals hands leads to very real life damages.
- cmdrfred 11y ago
  The issue is with the software the has a vulnerability not the software that exploits it. It would be fine to sell gangs guns if we could patch that pesky 'bullets kill humans' bug.
justratsinacoat 11y ago
It seemed clear to me that the analogical "weapons" aren't the _tools_, they're the exploit that the hacker group discovered.
- derefr 11y ago
  Other similar analogies: • mining equipment: not dangerous :: enriched vein of uranium discovered using mining equipment : dangerous • chemistry equipment : not dangerous :: nerve gas, napalm, etc. : dangerous It's a strange situation where the equipment has a set of very legitimate uses, but once you allow it into people's hands, they now have complete unmonitored autonomy in how they use it, and might very well use it to bring about something dangerous with no-one the wiser. This is unlike most experience we have with dangerous tools. Cars, for example, can easily be used as weapons—but that danger only applies in public where others can observe you using the car, and your driver's license can be revoked. Similarly, a HAM operator could, on a whim, pollute the RF spectrum around them with noise—but that's also an action that by its very nature is observable, and so their broadcast device could be tracked down and shut down, and their operator certification revoked. But nobody sees you when you decide to mine for uranium, or produce chemical weapons, or develop software exploits. These aren't the tool being used as a weapon, being used to attack; these are instead cases of a tool being used to create a weapon, to create the potential for future violence, violence that—until it ever comes to pass—has no observable effects out on the world that will hint that this person is acting with malicious intent. It really seems like the law doesn't know what to do about that category of things, generally.
  - wvh 11y ago
    [...] they now have complete unmonitored autonomy in how they use it [...] It really seems like the law doesn't know what to do about that category of things, generally. You can use a hammer to construct something, or to bash someone's skull. That's human nature, and freedom. To not have that choice would mean we have lost a lot more than we'd have gained. This moral ambivalence makes it (luckily) nearly impossible for any form of authority to make a definite statement or prevent usage. It ensures freedom. And sometimes bashing someone's skull might be the "positive" action, and using a hammer to construct a building the "negative" result, as when the building is used predominantly to harm people. One could use hacking tools to get around totalitarian governments or locked-down operating systems, or even to get into a former lover's device but at the same time prevent that exploit to be used anywhere else because of the bug's exposure. Even the "criminal" might be the good guy in the long run – morality is highly complex. IT security really ends up most often in ambivalent, shades of grey territory, and not in the clear black/white contrast preferred by many people and especially law- and policy-makers.
    - hueving 11y ago
      This discussion is about vulnerabilities, not tools like nmap, etc that can be used for other constructive purposes. Please explain how you think having an undisclosed vulnerability is useful to build something.
  - AnthonyMouse 11y ago
    > enriched vein of uranium FWIW "enrich" in the context of uranium is the thing done by centrifuges. You don't get enriched uranium out of the ground. And Napalm is basically styrofoam and gasoline. You don't need much in the way of chemistry equipment to make it. > It really seems like the law doesn't know what to do about that category of things, generally. The main problem with the concept is that it doesn't end. A person with malicious intent can cause quite a lot of destruction with only the stuff everybody already has. There is no point in restricting chemistry equipment when people already have gasoline (or olive oil or lard or alcohol or ...) The only way to separate a person from the means to cause trouble is to eject them naked into the vacuum of space, and even then it's mostly because you can expect that to kill them.
- wcummings 11y ago
  There's little difference between knowledge of a vulnerability and a tool to exploit it.

profeta 11y ago

Code is not a weapon. bad analogy. Also, LA gangs used EV cars for modern drive-by's. Should EV cars now have a "gun tax"?

droopybuns 11y ago
Wassenaar would not exist if you were correct. https://en.wikipedia.org/wiki/Wassenaar_Arrangement https://en.wikipedia.org/wiki/Wassenaar_Arrangement
hueving 11y ago
What destroyed the enrichment devices in Iran then?
- 98216381 11y ago
  The incompetence of the operators of the devices.
- calgoo 11y ago
  Hackers and state actors. Whatever tools the used where just that. If someone uses a wrench destroy the enrichment devices, did the wrench destroy the device or the person using it?
  - hueving 11y ago
    If they used a bomb to destroy it, we'd still classify the bomb as a weapon regardless of whether you say the bomb destroyed it or the bomber.
    - Dylan16807 11y ago
      But if they had started flipping the power switch rapidly we wouldn't call the power switch a weapon. You can destroy a lot of devices that way.
      - hueving 11y ago

bcook 11y ago

Define "value".

roel_v 11y ago

So you're advocating a permit system for, say, having a copy of nmap? Don't tell me we need to go back to that discussion again?

hueving 11y ago
No, 'nmap' is not a vulnerability. I'm advocating to hold people responsible that sell vulnerabilities to the highest bidder under the full knowledge that the bidder will not tell the manufacturer and will use it for nefarious purposes. It's nearly impossible to enforce something like this because of anonymous markets and crypto currencies, but we should at least shame people that advocate for it or admit to doing it.
- dogma1138 11y ago
  Nmap has modules that can detect and exploit basic and often old vulnerabilities.
- roel_v 11y ago
  What we need is to destroy the idea that somehow vendors can expect others to do their security work for them. Full disclosure all the way, and put the pain with those who are the root cause: customers who don't want to pay what it costs to develop secure software, or what it costs to implement secure processes (i.e., airgapped infrastructure).

pjc50 11y ago

It does if you're the FBI: https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal https://en.m.wikipedia.org/wiki/ATF_gunwalking_scandal

rlpb 11y ago

Selling arms solely to law enforcement, however, sounds reasonable.