3 ms·

Often, the drama involves unauthorized testing of websites. Hard to test those on your own computer.

tptacek 8y ago
There was a thread a couple months back from a story where a tech reporter went out of his way to find (and solicit) stories of legal threats to vulnerability researchers. He ran his best examples in the story, and they were all flimsy. Here's a comment I wrote for the thread: https://news.ycombinator.com/item?id=16642155 https://news.ycombinator.com/item?id=16642155 (This is about the Zack Whittaker story referenced on the thread, not about Dropbox's VDP, which is the ostensible subject of the thread). Again: these are the good examples. In the 5 months since, I haven't see more legal drama for vuln research (again, despite multiple huge conferences with people dropping zero-day on litigious vendors on stage). Where is the evidence that this is a real problem?
- leereeves 8y ago
  What are your thoughts on the prosecution of Eric McCarty?
  - tptacek 8y ago
    I don't have any; that case is 12 years old. I'd have to log into PACER to get the indictment and read it. (I couldn't help it, I got nerdsniped, but the case is also under seal and none of the documents available are interesting).
    - deleted 8y ago
      [deleted]
    - leereeves 8y ago
      Has the law changed since then? As far as I know, it hasn't. I think you're right that companies and prosecutors are generally tolerant of security researchers doing their thing. But I also think the EFF is right that dangerous tools exist that can be misused by overzealous or malicious prosecutors.
      - tptacek 8y ago
        That's not my claim. I'm saying that lots of companies aren't tolerant of security research, and, despite their best efforts, still can't do much about it, because as long as you're not reaching out and probing their website, they can't do anything about it.
        leereeves 8y ago
        > as long as you're not reaching out and probing their website I think that's the part the EFF is concerned about. At least the CFAA part. The EFF also discussed the DMCA, but I'm not familiar with any cases of security researchers prosecuted under that law.

There was a thread a couple months back from a story where a tech reporter went out of his way to find (and solicit) stories of legal threats to vulnerability researchers. He ran his best examples in the story, and they were all flimsy. Here's a comment I wrote for the thread: https://news.ycombinator.com/item?id=16642155 https://news.ycombinator.com/item?id=16642155 (This is about the Zack Whittaker story referenced on the thread, not about Dropbox's VDP, which is the ostensible subject of the thread). Again: these are the good examples. In the 5 months since, I haven't see more legal drama for vuln research (again, despite multiple huge conferences with people dropping zero-day on litigious vendors on stage). Where is the evidence that this is a real problem?

leereeves 8y ago
What are your thoughts on the prosecution of Eric McCarty?
- tptacek 8y ago
  I don't have any; that case is 12 years old. I'd have to log into PACER to get the indictment and read it. (I couldn't help it, I got nerdsniped, but the case is also under seal and none of the documents available are interesting).
  - deleted 8y ago
    [deleted]
  - leereeves 8y ago
    Has the law changed since then? As far as I know, it hasn't. I think you're right that companies and prosecutors are generally tolerant of security researchers doing their thing. But I also think the EFF is right that dangerous tools exist that can be misused by overzealous or malicious prosecutors.
    - tptacek 8y ago
      That's not my claim. I'm saying that lots of companies aren't tolerant of security research, and, despite their best efforts, still can't do much about it, because as long as you're not reaching out and probing their website, they can't do anything about it.
      - leereeves 8y ago
        > as long as you're not reaching out and probing their website I think that's the part the EFF is concerned about. At least the CFAA part. The EFF also discussed the DMCA, but I'm not familiar with any cases of security researchers prosecuted under that law.