3 ms·

No, I don't realize that at all. It may make sense in a country where money is free speech and where companies are people, but outside the US, it makes little s

by Iv 7y ago

No, I don't realize that at all. It may make sense in a country where money is free speech and where companies are people, but outside the US, it makes little sense to say that selling a secret is protected by free speech. Disclosing one, yes. Selling it secretly do that it can result in exploits, certainly not. Responsible disclosure is a thing. I doubt that people selling credit card numbers and fake identities are protected by free speech.

alasdair_ 7y ago
>outside the US, it makes little sense to say that selling a secret is protected by free speech. I’m British and I’m fairly sure disclosing a security bug is permitted in the UK. Also, the court case in question was filed in the USA, so it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.
- Iv 7y ago
  Disclosing, yes. We are talking about selling. > it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece. Yep. And it is totally legitimate to have little sympathy for the case, or to criticize the law that allows this kind of things.
  - alasdair_ 7y ago
    >Disclosing, yes. We are talking about selling. Journalists and newspaper editors also do not work for free. More importantly, speech in a newspaper is still protected, even if a copy of the newspaper costs money. What is the functional difference between selling a copy of a newspaper costing a lot of money per issue detailing the exploit and selling the exploit some other way?
pixl97 7y ago
Really your arguments make no sense. First security flaws are not secrets. If I put a number in a box in my house and you break in and take it, that is 'stealing' a secret (aka credit card number). But if I make a million boxes with the same number in it and sell them there is no expectation that you will not look inside the box. Moreso selling "information that you would rather not be public but is not considered a secret legally" is completely legal in the US. There are lots of books published and sold containing information that some company or person would rather keep secret. >Responsible disclosure is a thing. Not a legal requirement. More of a gentleman's agreement after companies sent the law after security researchers so researchers sold or released anonymous zero days.

by Iv 7y ago

alasdair_ 7y ago

>outside the US, it makes little sense to say that selling a secret is protected by free speech. I’m British and I’m fairly sure disclosing a security bug is permitted in the UK. Also, the court case in question was filed in the USA, so it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.

Iv 7y ago
Disclosing, yes. We are talking about selling. > it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece. Yep. And it is totally legitimate to have little sympathy for the case, or to criticize the law that allows this kind of things.
- alasdair_ 7y ago
  >Disclosing, yes. We are talking about selling. Journalists and newspaper editors also do not work for free. More importantly, speech in a newspaper is still protected, even if a copy of the newspaper costs money. What is the functional difference between selling a copy of a newspaper costing a lot of money per issue detailing the exploit and selling the exploit some other way?

pixl97 7y ago

Really your arguments make no sense. First security flaws are not secrets. If I put a number in a box in my house and you break in and take it, that is 'stealing' a secret (aka credit card number). But if I make a million boxes with the same number in it and sell them there is no expectation that you will not look inside the box. Moreso selling "information that you would rather not be public but is not considered a secret legally" is completely legal in the US. There are lots of books published and sold containing information that some company or person would rather keep secret. >Responsible disclosure is a thing. Not a legal requirement. More of a gentleman's agreement after companies sent the law after security researchers so researchers sold or released anonymous zero days.