5 ms·

> why you wouldn't just sell this off Wouldn't it be immoral if not straight up illegal?

NeutronStar 6y ago
Are lock picking tools illegal?
judge2020 6y ago
Illegal, including the logistics of selling it to shady/nation state actors. You can't just put a craigslist ad out for "selling google docs exploit" and expect them to reach out to you, if you don't already have contacts in the game you're probably not going to find a place to sell it (and then you might have issues receiving the money if you're US-based). The only grey area where you could really sell an exploit is something like zerodium https://zerodium.com/program.html https://zerodium.com/program.html
- whimsicalism 6y ago
  You could definitely find a place to sell it as no trust is necessary: it would be trivial to prove you have the exploit without revealing the details.
  - thaumasiotes 6y ago
    Your parent comment isn't talking about the difficulty of closing the transaction, but initiating it.
    - whimsicalism 6y ago
      You really don't have to look hard to find forums where people are selling exploits for $10k and up, though I imagine for multi-million transactions there are different forums.
      - mkr-hn 6y ago
        You can find people who claim all kinds of things on the internet. That doesn't mean they're credible.
        cutemonster 6y ago
        If they were offering to buy for $10k and up, maybe that'd be different? (more likely to be serious? Or a honeypot somehow?)
Someone1234 6y ago
Specifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (depending on buyer). Should it be illegal? Yeah, potentially. Is it? Unclear.
- rtsil 6y ago
  At least accessory to crime if the exploit is used in a criminal activity, I presume?
  - MeinBlutIstBlau 6y ago
    If you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.
- ufmace 6y ago
  I'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices? Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet. We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.
  - Arainach 6y ago
    There's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.
ta988 6y ago
What should be made illegal is selling and use of exploits. That would put a lot of those shady "security" companies in trouble...

Are lock picking tools illegal?

judge2020 6y ago

Illegal, including the logistics of selling it to shady/nation state actors. You can't just put a craigslist ad out for "selling google docs exploit" and expect them to reach out to you, if you don't already have contacts in the game you're probably not going to find a place to sell it (and then you might have issues receiving the money if you're US-based). The only grey area where you could really sell an exploit is something like zerodium https://zerodium.com/program.html https://zerodium.com/program.html

whimsicalism 6y ago
You could definitely find a place to sell it as no trust is necessary: it would be trivial to prove you have the exploit without revealing the details.
- thaumasiotes 6y ago
  Your parent comment isn't talking about the difficulty of closing the transaction, but initiating it.
  - whimsicalism 6y ago
    You really don't have to look hard to find forums where people are selling exploits for $10k and up, though I imagine for multi-million transactions there are different forums.
    - mkr-hn 6y ago
      You can find people who claim all kinds of things on the internet. That doesn't mean they're credible.
      - cutemonster 6y ago
        If they were offering to buy for $10k and up, maybe that'd be different? (more likely to be serious? Or a honeypot somehow?)

Someone1234 6y ago

Specifically which law do people believe selling exploits violates? Off the top of my head I've only got "conspiracy"-like laws and international embargoes (depending on buyer). Should it be illegal? Yeah, potentially. Is it? Unclear.

rtsil 6y ago
At least accessory to crime if the exploit is used in a criminal activity, I presume?
- MeinBlutIstBlau 6y ago
  If you traded it off tor with a burner computer at a cafe or something, there is absolutely no way anybody could trace it back to you. It took the FBI to catch the silk road guy several years and iirc they pinned him on buying a hitmans services, not drug trafficking.
ufmace 6y ago
I'm extremely wary of a law that would potentially criminalize that. It would almost certainly have to be very vague and prone to being abused by malicious prosecutors. How would you set it up such that it's illegal to sell an exploit to a supposedly malicious actor, but not illegal to sell or negotiate prices with the company maintaining the software or some other company that they deem to be their agent for managing security reports, per current White Hat practices? Conspiracy convictions usually require proof that the suspect had created a plan to commit a serious crime and has taken active steps towards the execution of that plan, even if they haven't committed the actual crime yet. We're already perilously close to US Federal Prosecutors being able to lock up anybody they don't like indefinitely. It's so exorbitantly expensive to fight Federal charges that hardly anybody really does, much less does successfully. The last thing we need is more vague Federal criminal laws with poorly thought out evidence and mens rea requirements.
- Arainach 6y ago
  There's no selling/negotiation in the current model. If you go to Google and say "I found this bug, I'll tell you what I did for $50K", that's extortion. If you disagree with their classification or payout, you can contest that classification in the system - but you are not arguing on the price of the exploit, you are arguing on what the exploit is.

ta988 6y ago

What should be made illegal is selling and use of exploits. That would put a lot of those shady "security" companies in trouble...