4 ms·

There is a fair use case here. My understanding is that you're allowed to do this sort of thing for purpose of security research. It most definitely is not une

There is a fair use case here. My understanding is that you're allowed to do this sort of thing for purpose of security research. It most definitely is not unethical. Illegal perhaps, but unethical? Please. If they are trying to make money off selling to people doing something other than security research (say, playing games and using apps), than yeah, that'd be unethical.

ikeboy 7y ago
Under what doctrine / case law?
- blazespin 7y ago
  Fair use for purpose of research.
  - jakear 7y ago
    I can’t steal something then sell it to someone else “for research purposes only” and be okay.
- jtbayly 7y ago
  Fair use/research is not what Corelium is doing. They are selling the product to other people. What those other people do is beside the point. Edit: Oops. Meant to reply to blazespin.
gjsman-1000 7y ago
To make copies of iOS (against ToS), run it on non-Apple-branded devices (against ToS), and make profit off it? Like, I could see fair use for an individual security researcher, but a business making profit circumventing Apple's ToS and security in multiple ways, and encouraging others to do the same? I find it unlikely to pass.
- blazespin 7y ago
  I hope it does. Why are researchers doomed to make their own tools from scratch?
  - gjsman-1000 7y ago
    Instead of just Apple though, think of a bigger picture here: Let's say someone ran a service to help you hack AirBNB. Legal? Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal? Etc. It's tough.
    - zenexer 7y ago
      Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...: Before installing, please note: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. Edit: Furthermore: The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms. [1]: https://az792536.vo.msecnd.net/vms/release_notes_license_terms_8_1_15.pdf https://az792536.vo.msecnd.net/vms/release_notes_license_ter... From the license: NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so. Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.
      - mhw 7y ago
        Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee. Microsoft are definitely not 'someone' in the sense OP intended.
gjsman-1000 7y ago
Sorry, meant to write illegal, not unethical.
mlindner 7y ago
Fair use doesn't apply when you're acting for profit and making complete copies. That's like arguing that setting up a book production shop and selling fraudulent copies of the book (for borrowing only) is "fair use". This is _quite_ unethical.
- jakear 7y ago
  “For educational purposes only” would be most similar. Still clearly not ethical.
jahewson 7y ago
Fair use is relevant here but one of the main tests used by the courts is whether or not the use is commercial - this kind of for-profit redistribution is unlikely to pass muster.
rifung 7y ago
> It most definitely is not unethical. Illegal perhaps, but unethical? Please. I would argue it IS unethical. When speaking of ethics, the intention matters. If they were just offering these tools to security researchers at cost or for free, then I could agree, but they aren't. They're intentionally doing something that wasn't allowed to make money.
- fragmede 7y ago
  Unfortunately the service does cost money to run, and it is hard to pay operating costs without some sort of income, so it's hard to fault the service for charging money for a valuable service, especially on HN. This lawsuit (if it goes to court - many cases do not) would decide whether it is, or is not, "allowed". Still, contracts can contain all sorts of clauses, not all of them will be permitted/enforceable by law. Famously, non-compete agreements aren't enforceable in California but that doesn't stop them from appearing in California employment contracts.

ikeboy 7y ago

Under what doctrine / case law?

blazespin 7y ago
Fair use for purpose of research.
- jakear 7y ago
  I can’t steal something then sell it to someone else “for research purposes only” and be okay.
jtbayly 7y ago
Fair use/research is not what Corelium is doing. They are selling the product to other people. What those other people do is beside the point. Edit: Oops. Meant to reply to blazespin.

gjsman-1000 7y ago

To make copies of iOS (against ToS), run it on non-Apple-branded devices (against ToS), and make profit off it? Like, I could see fair use for an individual security researcher, but a business making profit circumventing Apple's ToS and security in multiple ways, and encouraging others to do the same? I find it unlikely to pass.

blazespin 7y ago
I hope it does. Why are researchers doomed to make their own tools from scratch?
- gjsman-1000 7y ago
  Instead of just Apple though, think of a bigger picture here: Let's say someone ran a service to help you hack AirBNB. Legal? Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Let's say someone ran a service which helped you find bugs in anti-cheat software and run those bugs on your PC. Legal? Etc. It's tough.
  - zenexer 7y ago
    Let's say someone ran a service which spun up Windows Virtual Machines, of any model, which were not genuine licenses, for the sake of "security research." Legal? Microsoft outright encourages this. From https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...: Before installing, please note: These virtual machines expire after 90 days. We recommend setting a snapshot when you first install the virtual machine which you can roll back to later. Edit: Furthermore: The Microsoft Software License Terms for the Microsoft Edge and IE VMs are included in the release notes[1] and supersede any conflicting Windows license terms included in the VMs. By downloading and using this software, you agree to these license terms. [1]: https://az792536.vo.msecnd.net/vms/release_notes_license_terms_8_1_15.pdf https://az792536.vo.msecnd.net/vms/release_notes_license_ter... From the license: NO ACTIVATION. To prevent its unlicensed use, the software contains activation enforcement technology. Because the software is licensed for testing use only, you are not licensed to activate the software for any purpose even if it prompts you to do so. Not only are you encouraged to use the software without paying for a license for testing purposes, you're outright forbidden from doing so.
    - mhw 7y ago
      Microsoft are allowed to do so in this case because they are the owners of the software - they can license the software they own under any terms they want. In this case though, I'm sure there will be terms that prevent you from offering the VMs as a service to others for a fee. Microsoft are definitely not 'someone' in the sense OP intended.

gjsman-1000 7y ago

Sorry, meant to write illegal, not unethical.

mlindner 7y ago

Fair use doesn't apply when you're acting for profit and making complete copies. That's like arguing that setting up a book production shop and selling fraudulent copies of the book (for borrowing only) is "fair use". This is _quite_ unethical.

jakear 7y ago
“For educational purposes only” would be most similar. Still clearly not ethical.

jahewson 7y ago

Fair use is relevant here but one of the main tests used by the courts is whether or not the use is commercial - this kind of for-profit redistribution is unlikely to pass muster.

rifung 7y ago

> It most definitely is not unethical. Illegal perhaps, but unethical? Please. I would argue it IS unethical. When speaking of ethics, the intention matters. If they were just offering these tools to security researchers at cost or for free, then I could agree, but they aren't. They're intentionally doing something that wasn't allowed to make money.

fragmede 7y ago
Unfortunately the service does cost money to run, and it is hard to pay operating costs without some sort of income, so it's hard to fault the service for charging money for a valuable service, especially on HN. This lawsuit (if it goes to court - many cases do not) would decide whether it is, or is not, "allowed". Still, contracts can contain all sorts of clauses, not all of them will be permitted/enforceable by law. Famously, non-compete agreements aren't enforceable in California but that doesn't stop them from appearing in California employment contracts.