3 ms·

Am curious if it is legal to fund security research to find flaws in a competitors product. If so then going forward this might become a tool used by hardware /

by dman 9y ago

Am curious if it is legal to fund security research to find flaws in a competitors product. If so then going forward this might become a tool used by hardware / software companies to go after their competition.

AdamWoods 9y ago
I can't think of a reason why it wouldn't be completely legal? Unless there's some sort of ToS violation, however it'd be interesting to see how that would stand up to legal scrutiny. There are however clear ethical considerations surrounding disclosure which is really interesting in this case.
dsacco 9y ago
> Am curious if it is legal to fund security research to find flaws in a competitors product. It’s legal. I’ve been hired to do it before.
- dman 9y ago
  Any restrictions at the time of disclosure?
  - dsacco 9y ago
    I’m not sure how you mean; in general, I was tasked with finding vulnerabilities that could be used for reverse engineering purposes and which woukdn’t be disclosed.
    - dman 9y ago
      Ah I meant the legality of funding efforts to find glaring bugs in competitors products and then releasing them publicly as a 0-day.
jlgaddis 9y ago
Google (Project Zero) has found and published plenty of vulnerabilities in Microsoft products.
- ksec 9y ago
  There is a difference in helping and destroying competition.
  - cthalupa 9y ago
    If it's factually correct it wouldn't be libel. I wouldn't be surprised if it's illegal somewhere in the world, but in the US, publishing factual information you have not signed away the right to publish via an NDA or similar contract is usually legal. I don't know that motive is ever involved as part of the test of determining whether or not you are allowed to write something. I'm not a lawyer, this isn't legal advice.
- sangnoir 9y ago
  (Part of) HN got real salty after Google auto-published after the 90-day disclosure deadline expired,but before MS had a patch out. I wonder what the reaction would be if Project Zero adopted a 24-hour disclosure...
  - exikyut 9y ago
    What was this on?
    - sangnoir 9y ago
      I believe it was for this remotely exploitable IE/Edge[1] bug. 1. https://arstechnica.com/information-technology/2017/02/high-severity-vulnerability-in-edgeie-is-third-unpatched-msft-bug-this-month/ https://arstechnica.com/information-technology/2017/02/high-...

by dman 9y ago

AdamWoods 9y ago

I can't think of a reason why it wouldn't be completely legal? Unless there's some sort of ToS violation, however it'd be interesting to see how that would stand up to legal scrutiny. There are however clear ethical considerations surrounding disclosure which is really interesting in this case.

dsacco 9y ago

> Am curious if it is legal to fund security research to find flaws in a competitors product. It’s legal. I’ve been hired to do it before.

dman 9y ago
Any restrictions at the time of disclosure?
- dsacco 9y ago
  I’m not sure how you mean; in general, I was tasked with finding vulnerabilities that could be used for reverse engineering purposes and which woukdn’t be disclosed.
  - dman 9y ago
    Ah I meant the legality of funding efforts to find glaring bugs in competitors products and then releasing them publicly as a 0-day.

jlgaddis 9y ago

Google (Project Zero) has found and published plenty of vulnerabilities in Microsoft products.

ksec 9y ago
There is a difference in helping and destroying competition.
- cthalupa 9y ago
  If it's factually correct it wouldn't be libel. I wouldn't be surprised if it's illegal somewhere in the world, but in the US, publishing factual information you have not signed away the right to publish via an NDA or similar contract is usually legal. I don't know that motive is ever involved as part of the test of determining whether or not you are allowed to write something. I'm not a lawyer, this isn't legal advice.
sangnoir 9y ago
(Part of) HN got real salty after Google auto-published after the 90-day disclosure deadline expired,but before MS had a patch out. I wonder what the reaction would be if Project Zero adopted a 24-hour disclosure...
- exikyut 9y ago
  What was this on?
  - sangnoir 9y ago
    I believe it was for this remotely exploitable IE/Edge[1] bug. 1. https://arstechnica.com/information-technology/2017/02/high-severity-vulnerability-in-edgeie-is-third-unpatched-msft-bug-this-month/ https://arstechnica.com/information-technology/2017/02/high-...