7 ms·

I generally think it's crazy to hold someone responsible for the software they wrote, even if it has no theoretical "good use". The person using the software sh

by kriro 10y ago

I generally think it's crazy to hold someone responsible for the software they wrote, even if it has no theoretical "good use". The person using the software should be responsible. That being said it's even crazier if there is a legitimate use (network monitor etc.) which seems to be the case here. Where exactly do you draw the line? If an attacker uses Windows or Linux...is that evil software. If they phish with some mail-tool is that evil software etc. etc.

BanzaiTokyo 10y ago
borderline industries such as drug and gun production are heavily licensed and controlled by the state. I believe this case should fall into a similar category. >Where exactly do you draw the line? You can kill with a hammer too, but noone will hold hammer maker complicit.
- deleted 10y ago
  [deleted]
- E6300 10y ago
  How could that possibly work? Gun manufacture requires machinery and resources, and drug production requires specific knowledge that's not widely disseminated. Anyone can learn how to write software.
  - chillingeffect 10y ago
    Sales would be the point of control. Gun manufacturing equipment is not prohibitive. Zip guns and 3-d printers facilitate it. Drug production for cocaine, heroin, cannabis and others is as simple as a garden. Not that I agree the kid should be arrested. I simply perceive the feasibility of software prohibition via government license to be as effective as it is for guns and drugs.
    - E6300 10y ago
      > Sales would be the point of control. Do you mean sales of the software itself? There's no way that could work. Secretly transferring a bitstring is one of the easiest things to do. At best you could catch the money laundering. > Drug production for cocaine, heroin, cannabis and others is as simple as a garden. I was thinking of drugs in general. Including for example antibiotics and cancer drugs. AFAIK, practically no one knows how to make stuff like that.
      - inlined 10y ago
        > Do you mean sales of the software itself? There's no way that could work. Loaning a gun is even easier, but it seems regulated too. I've seen a friend verbally say in front of others that he was transferring full ownership a gun when a friend asked to borrow one for the range because that's what the laws of his state required (WA). He then informed his friend that he would certainly appreciate the gun being transferred back in a week but he had no recourse if not.
        cmdrfred 10y ago
        >Loaning a gun is even easier, Really? You're going to make that claim? Prove it: Just encrypt a gun with my public key and send it to me over email.
        E6300 10y ago
        I mean, are we talking about just regulating or about actually enforcing regulations?
    - 15charlimit 10y ago
      >I simply perceive the feasibility of software prohibition via government license to be as effective as it is for guns and drugs. In other words, not effective at all against the people you're attempting to target (criminals) and only negatively affecting the people who don't deserve or need to be targeted (law abiding citizens)? Yeah, that'll work great. /s
  - M_Grey 10y ago
    Realistically more people could learn to run a CNC milling AR-15 parts, than could learn to write code of similar efficacy.
    - E6300 10y ago
      Well, I've heard of quite a few malware pieces. I've never heard of hand-crafted black market AR-15s.
      - abeyer 10y ago
        https://ghostgunner.net/ https://ghostgunner.net/ "As shipped, Ghost Gunner manufactures mil-spec AR-15 and AR-308 lower receivers to completion. With simple tools and point and click software, the machine automatically finds and aligns to your 80% lower to get to work. No prior CNC knowledge or experience is required to manufacture from design files. Legally manufacture unserialized AR rifles in the comfort and privacy of your home."
        E6300 10y ago
        That's just another level of indirection. "I'm not selling guns, I'm selling machines that automatically make guns." "I'm not selling malware. I'm selling random bitstrings. Here's the email of someone who sells a different kind of random bitstrings, and here's a URL where you can download an AES implementation." You still need someone with the technical know-how to make that machinery, and the commercialization of such machinery is very easy to regulate because pretty much only industries use CNC machines. Computers, on the other hand, are everywhere.
- tantalor 10y ago
  No, they are controlled by lobbyists working on behalf of the industry to limit entry into the market. It's about profit, not safety.
  - BanzaiTokyo 10y ago
    "No" what? Could you explain what do you mean by that. Just to be clear, I didn't make any statements about control.
    - tantalor 10y ago
      You say the e.g. gun industry is "controlled by the state". This is wrong; the industry regulates itself by means of lobbying.
dhimes 10y ago
Totally agree. It's a freedom of speech issue. Just like you can't hold the Beatles responsible for the Manson murders, you can't hold someone expressing themselves in code responsible for malicious use. See: NRA lobby white papers.
- smrtinsert 10y ago
  Absolutely agree. I hope he has attempted to contact the EFF over this for counsel. As I understand it, what under similar policies, they could arrest a mapping product programmer for some nefarious third parties who plan terrorist attacks.
  - khedoros1 10y ago
    > they could arrest a mapping product programmer for some nefarious third parties who plan terrorist attacks. What if the programmer distributed and supported the product on a terrorism planning site, and worked to ban anyone who mentioned using the mapping product for terrorism? And who knew of a plugin for his software designed to calculate bomb shrapnel distribution? The guy sells his software through a hacking site, provides a plugin API, but states that it shouldn't be used for hacking. The situation seems similar to ROM sites that say "only download if you own the original game", smoking stores that sell bongs "for use with tobacco products only", etc. He'd have a better defense if he sold the software through a forum for Windows enthusiasts, or something.
- mtgx 10y ago
  Let's hope they don't throw 50 years of prison or plea deal at him, as they tend to do, and that he doesn't take the plea deal. Since software has already been defined as free speech, I think there's a very good chance he should win this.
- rhino369 10y ago
  It isn't a freedom of speech issue. Free speech doesn't cover using words to commit a crime. Saying "handover the cash or I'll slit your throat" is still robbery. The law handles this fairly well in theory. You are only responsible for aiding a crime if you acted to assist the crime with the required mental state. The required mental state for most crimes is recklessness. So you can sell someone a gun but you can't sell someone a gun if they say "I'm going to murder my wife." Doing something totally legal to assist a crime is a crime if you were acting intentionally to assist the crime. You can be charged for giving the Gettysburg Address if the point was to get people in one place to bomb it. Here the FBI is wrong. As of now, there is no evidence he intended to assist in these crimes. But if you created some software designed to hack a company you hated and then released it widely hoping that someone would use it? That is a crime.
soverance 10y ago
I mean, there is such a thing as ethics. A programmer writing software with malicious intent or with the explicit purpose to defraud, undermine, or otherwise harm another person and/or their property should absolutely be held responsible for the code they write.
- woah 10y ago
  You think security research should be illegal?
- clavalle 10y ago
  The code or the actions? I'm all for holding people accountable for bad actions but I don't think that writing code is enough of to show intent to harm.
  - emodendroket 10y ago
    I don't know if it's that simple -- if I print out fake dollar bills it'll probably be treated differently if I sell them as movie props than if I sell them as counterfeit money you could pass off as real.
    - kahrkunne 10y ago
      If the printed money is identical? No, you'd be treated the same for both. If you're talking about different bills then your analogy obviously doesn't apply.
      - emodendroket 10y ago
        Are you sure about that? http://www.omaha.com/townnews/crime/prop-money-used-in-movies-among-counterfeit-bills-passed-around/article_aa328426-e1c7-11e6-a011-7fa4f1f37370.html http://www.omaha.com/townnews/crime/prop-money-used-in-movie... > Owning prop money in itself is not a crime. But it's a crime if people try to pass the prop bills off as real money, said Capt. Jim Duering of the Grand Island Police Department. Seems like the same principle would apply if you were selling it for the purpose of enabling fraud.
emodendroket 10y ago
It seems like the Feds' case depends pretty heavily on the fact that he initially advertised the software on a forum that was devoted to malicious computer hacking.
M_Grey 10y ago
At the very least, if we're holding people responsible for their software, we should be holding car manufacturers responsible for crashes and firearms makers responsible for murders. "Oh, you were drunk and crashed your Prius? Put the engineering team in jail!"
- qb45 10y ago
  Well, some actually try. Don't give them ideas.
  - M_Grey 10y ago
    I know, I know. I'm in the uncomfortable position of being both pro gun, and pro gun-control, so I get the worst of both worlds. On one side people think you should be free to transfer a gun without a scrap of record keeping, and the other thinks that if you beat someone to death with a cell phone, you should sue Samsung. The total systemic paralysis is real.
jmcdiesel 10y ago
If smith & wesson promoted their guns in a forum known for plotting murders, do you think they wouldn't be held accountable? If ford promoted the f150 as being able to drive though 50 people without slowing down, would they not be accountable? The software isnt the problem, the software has legitimate use... however, it has nefarious use as well, and he promotes that side of it..
Cacti 10y ago
The issue is that this person wrote the software and then profited and advertised it specifically for malicious uses. That implies intent, and intent matters.
- SolarNet 10y ago
  Except there is opposing intent of him disabling the software of people implying they use it for illegal purposes. And there is an explanation that moves his advertisement there from intent to negligence.
wfo 10y ago
Agreed, but selling software you wrote to a person while knowing they intend to commit a crime with it on the other hand... Not sure that happened here but I don't have a problem with that being illegal.
e12e 10y ago
And the educational factor of "it can be done" is essentially all the justification needed to supply PoC with bug reports. I mean, take: http://seclists.org/oss-sec/2017/q1/675 http://seclists.org/oss-sec/2017/q1/675 "I am able to crash a RHEL7'ish system with the above PoC quickly." So, someone takes down some critical system running RHEL7 with this (even if it is just a crash) - and the author is on the hook because the only use for the code was educational and "crashing a system"?

by kriro 10y ago

BanzaiTokyo 10y ago

borderline industries such as drug and gun production are heavily licensed and controlled by the state. I believe this case should fall into a similar category. >Where exactly do you draw the line? You can kill with a hammer too, but noone will hold hammer maker complicit.

deleted 10y ago
[deleted]
E6300 10y ago
How could that possibly work? Gun manufacture requires machinery and resources, and drug production requires specific knowledge that's not widely disseminated. Anyone can learn how to write software.
- chillingeffect 10y ago
  Sales would be the point of control. Gun manufacturing equipment is not prohibitive. Zip guns and 3-d printers facilitate it. Drug production for cocaine, heroin, cannabis and others is as simple as a garden. Not that I agree the kid should be arrested. I simply perceive the feasibility of software prohibition via government license to be as effective as it is for guns and drugs.
  - E6300 10y ago
    > Sales would be the point of control. Do you mean sales of the software itself? There's no way that could work. Secretly transferring a bitstring is one of the easiest things to do. At best you could catch the money laundering. > Drug production for cocaine, heroin, cannabis and others is as simple as a garden. I was thinking of drugs in general. Including for example antibiotics and cancer drugs. AFAIK, practically no one knows how to make stuff like that.
    - inlined 10y ago
      > Do you mean sales of the software itself? There's no way that could work. Loaning a gun is even easier, but it seems regulated too. I've seen a friend verbally say in front of others that he was transferring full ownership a gun when a friend asked to borrow one for the range because that's what the laws of his state required (WA). He then informed his friend that he would certainly appreciate the gun being transferred back in a week but he had no recourse if not.
      - cmdrfred 10y ago
        >Loaning a gun is even easier, Really? You're going to make that claim? Prove it: Just encrypt a gun with my public key and send it to me over email.
      - E6300 10y ago
        I mean, are we talking about just regulating or about actually enforcing regulations?
  - 15charlimit 10y ago
    >I simply perceive the feasibility of software prohibition via government license to be as effective as it is for guns and drugs. In other words, not effective at all against the people you're attempting to target (criminals) and only negatively affecting the people who don't deserve or need to be targeted (law abiding citizens)? Yeah, that'll work great. /s
- M_Grey 10y ago
  Realistically more people could learn to run a CNC milling AR-15 parts, than could learn to write code of similar efficacy.
  - E6300 10y ago
    Well, I've heard of quite a few malware pieces. I've never heard of hand-crafted black market AR-15s.
    - abeyer 10y ago
      https://ghostgunner.net/ https://ghostgunner.net/ "As shipped, Ghost Gunner manufactures mil-spec AR-15 and AR-308 lower receivers to completion. With simple tools and point and click software, the machine automatically finds and aligns to your 80% lower to get to work. No prior CNC knowledge or experience is required to manufacture from design files. Legally manufacture unserialized AR rifles in the comfort and privacy of your home."
      - E6300 10y ago
        That's just another level of indirection. "I'm not selling guns, I'm selling machines that automatically make guns." "I'm not selling malware. I'm selling random bitstrings. Here's the email of someone who sells a different kind of random bitstrings, and here's a URL where you can download an AES implementation." You still need someone with the technical know-how to make that machinery, and the commercialization of such machinery is very easy to regulate because pretty much only industries use CNC machines. Computers, on the other hand, are everywhere.
tantalor 10y ago
No, they are controlled by lobbyists working on behalf of the industry to limit entry into the market. It's about profit, not safety.
- BanzaiTokyo 10y ago
  "No" what? Could you explain what do you mean by that. Just to be clear, I didn't make any statements about control.
  - tantalor 10y ago
    You say the e.g. gun industry is "controlled by the state". This is wrong; the industry regulates itself by means of lobbying.

dhimes 10y ago

Totally agree. It's a freedom of speech issue. Just like you can't hold the Beatles responsible for the Manson murders, you can't hold someone expressing themselves in code responsible for malicious use. See: NRA lobby white papers.

smrtinsert 10y ago
Absolutely agree. I hope he has attempted to contact the EFF over this for counsel. As I understand it, what under similar policies, they could arrest a mapping product programmer for some nefarious third parties who plan terrorist attacks.
- khedoros1 10y ago
  > they could arrest a mapping product programmer for some nefarious third parties who plan terrorist attacks. What if the programmer distributed and supported the product on a terrorism planning site, and worked to ban anyone who mentioned using the mapping product for terrorism? And who knew of a plugin for his software designed to calculate bomb shrapnel distribution? The guy sells his software through a hacking site, provides a plugin API, but states that it shouldn't be used for hacking. The situation seems similar to ROM sites that say "only download if you own the original game", smoking stores that sell bongs "for use with tobacco products only", etc. He'd have a better defense if he sold the software through a forum for Windows enthusiasts, or something.
mtgx 10y ago
Let's hope they don't throw 50 years of prison or plea deal at him, as they tend to do, and that he doesn't take the plea deal. Since software has already been defined as free speech, I think there's a very good chance he should win this.
rhino369 10y ago
It isn't a freedom of speech issue. Free speech doesn't cover using words to commit a crime. Saying "handover the cash or I'll slit your throat" is still robbery. The law handles this fairly well in theory. You are only responsible for aiding a crime if you acted to assist the crime with the required mental state. The required mental state for most crimes is recklessness. So you can sell someone a gun but you can't sell someone a gun if they say "I'm going to murder my wife." Doing something totally legal to assist a crime is a crime if you were acting intentionally to assist the crime. You can be charged for giving the Gettysburg Address if the point was to get people in one place to bomb it. Here the FBI is wrong. As of now, there is no evidence he intended to assist in these crimes. But if you created some software designed to hack a company you hated and then released it widely hoping that someone would use it? That is a crime.

soverance 10y ago

I mean, there is such a thing as ethics. A programmer writing software with malicious intent or with the explicit purpose to defraud, undermine, or otherwise harm another person and/or their property should absolutely be held responsible for the code they write.

woah 10y ago
You think security research should be illegal?
clavalle 10y ago
The code or the actions? I'm all for holding people accountable for bad actions but I don't think that writing code is enough of to show intent to harm.
- emodendroket 10y ago
  I don't know if it's that simple -- if I print out fake dollar bills it'll probably be treated differently if I sell them as movie props than if I sell them as counterfeit money you could pass off as real.
  - kahrkunne 10y ago
    If the printed money is identical? No, you'd be treated the same for both. If you're talking about different bills then your analogy obviously doesn't apply.
    - emodendroket 10y ago
      Are you sure about that? http://www.omaha.com/townnews/crime/prop-money-used-in-movies-among-counterfeit-bills-passed-around/article_aa328426-e1c7-11e6-a011-7fa4f1f37370.html http://www.omaha.com/townnews/crime/prop-money-used-in-movie... > Owning prop money in itself is not a crime. But it's a crime if people try to pass the prop bills off as real money, said Capt. Jim Duering of the Grand Island Police Department. Seems like the same principle would apply if you were selling it for the purpose of enabling fraud.

emodendroket 10y ago

It seems like the Feds' case depends pretty heavily on the fact that he initially advertised the software on a forum that was devoted to malicious computer hacking.

M_Grey 10y ago

At the very least, if we're holding people responsible for their software, we should be holding car manufacturers responsible for crashes and firearms makers responsible for murders. "Oh, you were drunk and crashed your Prius? Put the engineering team in jail!"

qb45 10y ago
Well, some actually try. Don't give them ideas.
- M_Grey 10y ago
  I know, I know. I'm in the uncomfortable position of being both pro gun, and pro gun-control, so I get the worst of both worlds. On one side people think you should be free to transfer a gun without a scrap of record keeping, and the other thinks that if you beat someone to death with a cell phone, you should sue Samsung. The total systemic paralysis is real.

jmcdiesel 10y ago

If smith & wesson promoted their guns in a forum known for plotting murders, do you think they wouldn't be held accountable? If ford promoted the f150 as being able to drive though 50 people without slowing down, would they not be accountable? The software isnt the problem, the software has legitimate use... however, it has nefarious use as well, and he promotes that side of it..

Cacti 10y ago

The issue is that this person wrote the software and then profited and advertised it specifically for malicious uses. That implies intent, and intent matters.

SolarNet 10y ago
Except there is opposing intent of him disabling the software of people implying they use it for illegal purposes. And there is an explanation that moves his advertisement there from intent to negligence.

wfo 10y ago

Agreed, but selling software you wrote to a person while knowing they intend to commit a crime with it on the other hand... Not sure that happened here but I don't have a problem with that being illegal.

e12e 10y ago

And the educational factor of "it can be done" is essentially all the justification needed to supply PoC with bug reports. I mean, take: http://seclists.org/oss-sec/2017/q1/675 http://seclists.org/oss-sec/2017/q1/675 "I am able to crash a RHEL7'ish system with the above PoC quickly." So, someone takes down some critical system running RHEL7 with this (even if it is just a crash) - and the author is on the hook because the only use for the code was educational and "crashing a system"?