4 ms·

Again, I'm not disagreeing that the current state of affairs might be good enough for people to work in this field with some degree of confidence they won't sud

Again, I'm not disagreeing that the current state of affairs might be good enough for people to work in this field with some degree of confidence they won't suddenly be facing crippling consequences for work that everyone generally agrees is important. I'm simply pointing out that a handshake agreement that companies won't sue or press charges against researchers is a far cry from the legal protection that the EFF and ALCU hope to gain. Imagine a scenario where some vindictive CEO/Founder (I can think of a few) takes offense to a researcher publicizing vuln/flaws in a new flagship product that embarrasses them or the company. Imagine that CEO decides to make a point by violating the "understanding" researchers and companies have so far enjoyed, and files suit or even worse presses charges. Currently that researcher has no protection. Even if that's a rare and unlikely occurrence, that researcher probably isn't going to care when facing ruinous legal fees, fines, or even jail time. And those are the consequences.

tptacek 8y ago
What handshake agreement are you referring to? There's usually no agreements with them at all. A lot of the companies in that list are notoriously litigious. If this was such a risk, why is nobody getting C&D'd? I helped manage one of the larger software security firms in the country, staffed with people using their bench time to do independent assessments of random things that interested them. I can count on zero fingers the number of people who were ever threatened with a suit. What's the evidence that this is a real problem? To me, the evidence loudly suggests that it is not. There are people who have legit legal issues with the research that they're doing. They fall generally into two buckets: * The rapidly shrinking bucket of people doing content protection security research for vendors that don't want copy protection stuff broken (and related stuff, like jailbreaking consoles). * People who are testing other people's computers, not their own. Most of the legal drama you see in our field comes from that second group. I fully agree: it is legally dangerous to test software running on a stranger's computer without authorization. But most important vuln research doesn't set off that particular tripwire.
- leereeves 8y ago
  Often, the drama involves unauthorized testing of websites. Hard to test those on your own computer.
  - tptacek 8y ago
    There was a thread a couple months back from a story where a tech reporter went out of his way to find (and solicit) stories of legal threats to vulnerability researchers. He ran his best examples in the story, and they were all flimsy. Here's a comment I wrote for the thread: https://news.ycombinator.com/item?id=16642155 https://news.ycombinator.com/item?id=16642155 (This is about the Zack Whittaker story referenced on the thread, not about Dropbox's VDP, which is the ostensible subject of the thread). Again: these are the good examples. In the 5 months since, I haven't see more legal drama for vuln research (again, despite multiple huge conferences with people dropping zero-day on litigious vendors on stage). Where is the evidence that this is a real problem?
    - leereeves 8y ago
      What are your thoughts on the prosecution of Eric McCarty?
      - tptacek 8y ago
        I don't have any; that case is 12 years old. I'd have to log into PACER to get the indictment and read it. (I couldn't help it, I got nerdsniped, but the case is also under seal and none of the documents available are interesting).
        deleted 8y ago
        [deleted]
        leereeves 8y ago
        Has the law changed since then? As far as I know, it hasn't. I think you're right that companies and prosecutors are generally tolerant of security researchers doing their thing. But I also think the EFF is right that dangerous tools exist that can be misused by overzealous or malicious prosecutors.

tptacek 8y ago

What handshake agreement are you referring to? There's usually no agreements with them at all. A lot of the companies in that list are notoriously litigious. If this was such a risk, why is nobody getting C&D'd? I helped manage one of the larger software security firms in the country, staffed with people using their bench time to do independent assessments of random things that interested them. I can count on zero fingers the number of people who were ever threatened with a suit. What's the evidence that this is a real problem? To me, the evidence loudly suggests that it is not. There are people who have legit legal issues with the research that they're doing. They fall generally into two buckets: * The rapidly shrinking bucket of people doing content protection security research for vendors that don't want copy protection stuff broken (and related stuff, like jailbreaking consoles). * People who are testing other people's computers, not their own. Most of the legal drama you see in our field comes from that second group. I fully agree: it is legally dangerous to test software running on a stranger's computer without authorization. But most important vuln research doesn't set off that particular tripwire.

leereeves 8y ago
Often, the drama involves unauthorized testing of websites. Hard to test those on your own computer.
- tptacek 8y ago
  There was a thread a couple months back from a story where a tech reporter went out of his way to find (and solicit) stories of legal threats to vulnerability researchers. He ran his best examples in the story, and they were all flimsy. Here's a comment I wrote for the thread: https://news.ycombinator.com/item?id=16642155 https://news.ycombinator.com/item?id=16642155 (This is about the Zack Whittaker story referenced on the thread, not about Dropbox's VDP, which is the ostensible subject of the thread). Again: these are the good examples. In the 5 months since, I haven't see more legal drama for vuln research (again, despite multiple huge conferences with people dropping zero-day on litigious vendors on stage). Where is the evidence that this is a real problem?
  - leereeves 8y ago
    What are your thoughts on the prosecution of Eric McCarty?
    - tptacek 8y ago
      I don't have any; that case is 12 years old. I'd have to log into PACER to get the indictment and read it. (I couldn't help it, I got nerdsniped, but the case is also under seal and none of the documents available are interesting).
      - deleted 8y ago
        [deleted]
      - leereeves 8y ago
        Has the law changed since then? As far as I know, it hasn't. I think you're right that companies and prosecutors are generally tolerant of security researchers doing their thing. But I also think the EFF is right that dangerous tools exist that can be misused by overzealous or malicious prosecutors.