4 ms·
How could a bug report be illegal? If you merely say that you observed a crash in someone else’s software when a certain argument is passed, and that makes you
by lawnchair_larry 7y ago
How could a bug report be illegal?
If you merely say that you observed a crash in someone else’s software when a certain argument is passed, and that makes you liable for their bug, we are all in big trouble.
- leereeves 7y agoThis isn't just a bug report; this is more like lockpicking instructions.
- Operyl 7y agoI’m sorry, but this isn’t an RCE. It’s a low priority issue.
- lawnchair_larry 7y agoWhich could also not possibly be illegal.
- AnaniasAnanas 7y agoPretty sure that lockpicking instructions are legal. You can find a lot of lockpicking channels on youtube.
- Aloraman 7y agoWell, there is a difference. First, that certain argument (malformed certificate) was not randomly encountered, it was specifically constructed to trigger the vulnerability (Was reverse-engineering involved? I don't know). Second, this bug report not only discloses the fact that the vulnerability exists, but also provides a working example for any script-kiddie to use as an exploit. Third, the bug was not privately disclosed to software vendor, but was released to the public. From https://security.stackexchange.com/questions/22973/if-i-find-or-create-a-0day-exploit-can-i-be-held-liable-for-releasing-out-to-th https://security.stackexchange.com/questions/22973/if-i-find... it seems that would be criminal in UK or Germany, no idea what could've happen in US. On one hand, you have First Amendment, on other hand, there is an EULA.