5 ms·

> the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than th

by icc97 8y ago

> the field of vulnerability research has never been healthier, and there have never been more companies explicitly authorizing testing of their servers than there are now. > in fact, there are virtually no such prosecutions > Telling the truth about defects in technology isn't illegal. These statements don't seem to add up. If it's legal to tell about defects, then all of EFF's work (on this case) is a waste of time and they're spreading misinformation. If it's legal to do what they're doing then there should be zero prosecutions. Companies wouldn't need to authorize anyone because what they are doing is legal. Edit: added some clarification

tptacek 8y ago
I kind of love this comment. "This doesn't add up... if what you're saying is true, EFF is misleading people". Yes. I think EFF often does mislead people. They do some important work, and some less well-intentioned advocacy stuff. I supported my argument with evidence. To wit: if what researchers do is "illegal", consider this year's Black Hat schedule, and ask why none of these presentations generated so much as a C&D, let alone a threatened criminal prosecution: MDM attacks, attacks on self-driving cars (including Tesla’s ECU), breaks in “16 desktop applications, 29 websites, and 34 mobile applications” in the fintech space, attacks on ATMs, industrial control gateways, VPNs, ICS firewall products, antivirus software, “Akamai, Varnish Cache, Squid Proxy, Fastly, IBM WebSphere, Oracle WebLogic, F5”, a smartphone baseband, every macOS firewall product, mobile point of sales systems including “Square, SumUp, iZettle, and Paypal”, SAML SSO’s, SATCOM, WinVote voting machines, LTE base stations, z/OS for Christ's sake, streaming video watermarking schemes, “a cross-section of smart city devices currently in use today", Toshiba FlashAir SD cards, warning siren systems from ATI Systems, celllular devices manufactured by Sierra Wireless and many others, implanted medical devices, text-to-speech systems, and a hardware backdoor in an x86 clone. What prosecutions would you put on the other side of this scale to balance it out? It sounds like the best argument the thread has seen so far is Aurenheimer, who dumped a database and bragged to the media about his "theft". I don't support that prosecution and didn't at the time, but if that's the best evidence you've got, I'm not going to be up nights worrying about this. I work in this field. Cory Doctorow's relation to it is that of a gadfly. I'm saying outright: I think this article is misleading. You'll have no trouble finding vulnerability researchers to take the other side of my argument, that we're all a threatened species ready to be pushed underground at any moment by overzealous prosecutors. We've been saying that for literally decades, and I think it has more to do with us wanting to feel exceptional and daring than it does with any real risks we face.
- dcole2929 8y ago
  Companies giving researchers permission to do something is inherently different from it being legal to do something. In one case you are able to operate only at the whims of the companies you're researching. The companies can for any reason, and at any time, withdraw their consent and take legal action against a researcher. Yo can debate the likelihood of that ad nauseuam, however it would seem to still be a potential risk. In the other case, your are free to operate as you see fit because you have every legal right to investigate and go about your business. As far as I can tell, you're arguing that the former circumstances are good enough, whereas the author and apparently the EFF and ALCU are trying to obtain the former.
  - tptacek 8y ago
    Almost none of those were vendors giving permission; I left out dozens of talks where it was clear permission had been given (for instance: no Apple or Microsoft talks on that list).
    - dcole2929 8y ago
      Again, I'm not disagreeing that the current state of affairs might be good enough for people to work in this field with some degree of confidence they won't suddenly be facing crippling consequences for work that everyone generally agrees is important. I'm simply pointing out that a handshake agreement that companies won't sue or press charges against researchers is a far cry from the legal protection that the EFF and ALCU hope to gain. Imagine a scenario where some vindictive CEO/Founder (I can think of a few) takes offense to a researcher publicizing vuln/flaws in a new flagship product that embarrasses them or the company. Imagine that CEO decides to make a point by violating the "understanding" researchers and companies have so far enjoyed, and files suit or even worse presses charges. Currently that researcher has no protection. Even if that's a rare and unlikely occurrence, that researcher probably isn't going to care when facing ruinous legal fees, fines, or even jail time. And those are the consequences.
      - tptacek 8y ago

by icc97 8y ago

tptacek 8y ago

I kind of love this comment. "This doesn't add up... if what you're saying is true, EFF is misleading people". Yes. I think EFF often does mislead people. They do some important work, and some less well-intentioned advocacy stuff. I supported my argument with evidence. To wit: if what researchers do is "illegal", consider this year's Black Hat schedule, and ask why none of these presentations generated so much as a C&D, let alone a threatened criminal prosecution: MDM attacks, attacks on self-driving cars (including Tesla’s ECU), breaks in “16 desktop applications, 29 websites, and 34 mobile applications” in the fintech space, attacks on ATMs, industrial control gateways, VPNs, ICS firewall products, antivirus software, “Akamai, Varnish Cache, Squid Proxy, Fastly, IBM WebSphere, Oracle WebLogic, F5”, a smartphone baseband, every macOS firewall product, mobile point of sales systems including “Square, SumUp, iZettle, and Paypal”, SAML SSO’s, SATCOM, WinVote voting machines, LTE base stations, z/OS for Christ's sake, streaming video watermarking schemes, “a cross-section of smart city devices currently in use today", Toshiba FlashAir SD cards, warning siren systems from ATI Systems, celllular devices manufactured by Sierra Wireless and many others, implanted medical devices, text-to-speech systems, and a hardware backdoor in an x86 clone. What prosecutions would you put on the other side of this scale to balance it out? It sounds like the best argument the thread has seen so far is Aurenheimer, who dumped a database and bragged to the media about his "theft". I don't support that prosecution and didn't at the time, but if that's the best evidence you've got, I'm not going to be up nights worrying about this. I work in this field. Cory Doctorow's relation to it is that of a gadfly. I'm saying outright: I think this article is misleading. You'll have no trouble finding vulnerability researchers to take the other side of my argument, that we're all a threatened species ready to be pushed underground at any moment by overzealous prosecutors. We've been saying that for literally decades, and I think it has more to do with us wanting to feel exceptional and daring than it does with any real risks we face.

dcole2929 8y ago
Companies giving researchers permission to do something is inherently different from it being legal to do something. In one case you are able to operate only at the whims of the companies you're researching. The companies can for any reason, and at any time, withdraw their consent and take legal action against a researcher. Yo can debate the likelihood of that ad nauseuam, however it would seem to still be a potential risk. In the other case, your are free to operate as you see fit because you have every legal right to investigate and go about your business. As far as I can tell, you're arguing that the former circumstances are good enough, whereas the author and apparently the EFF and ALCU are trying to obtain the former.
- tptacek 8y ago
  Almost none of those were vendors giving permission; I left out dozens of talks where it was clear permission had been given (for instance: no Apple or Microsoft talks on that list).
  - dcole2929 8y ago
    Again, I'm not disagreeing that the current state of affairs might be good enough for people to work in this field with some degree of confidence they won't suddenly be facing crippling consequences for work that everyone generally agrees is important. I'm simply pointing out that a handshake agreement that companies won't sue or press charges against researchers is a far cry from the legal protection that the EFF and ALCU hope to gain. Imagine a scenario where some vindictive CEO/Founder (I can think of a few) takes offense to a researcher publicizing vuln/flaws in a new flagship product that embarrasses them or the company. Imagine that CEO decides to make a point by violating the "understanding" researchers and companies have so far enjoyed, and files suit or even worse presses charges. Currently that researcher has no protection. Even if that's a rare and unlikely occurrence, that researcher probably isn't going to care when facing ruinous legal fees, fines, or even jail time. And those are the consequences.
    - tptacek 8y ago