3 ms·

That may be considered black-mail by some courts.

by jonny_eh 6y ago

Itsdijital 6y ago
I guess that's true. Whats the end state if Apple refuses to pay?
- eyelidlessness 6y ago
  “It would be a shame if someone used this vulnerability”
- albntomat0 6y ago
  Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.
ClumsyPilot 6y ago
I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour
- young_unixer 6y ago
  I think they're talking about the implication that if Apple don't pay, then the vulnerability is published. I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.
  - ClumsyPilot 6y ago
    I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind". In this case you aren't just a vigilante targetting apple, there is established practice stretching decades. There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.
- mdpopescu 6y ago
  All blackmail involves exposing something that someone doesn't want exposed - usually because the "something" is illegal. And yet, blackmail itself is illegal. Most countries have a culture against whistleblowers, starting from childhood ("don't be a tattletale", "don't be a rat").
  - ClumsyPilot 6y ago
    And that anti-whistleblower culture enables fraud like theranos to be undiscovered for years
lovelyviking 6y ago
Can you explain it more? What can make it a black-mail and why? If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail? So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will be public it's a black-mail too? Or the payment request makes it different? And if person doesn't threat to publish the bug then it's ok?
- IncRnd 6y ago
  Definition: Blackmail involves a threat to do something that would cause a person to suffer embarrassment or financial loss, unless that person meets certain demands. [0] [0] https://www.justia.com/criminal/offenses/white-collar-crimes/blackmail https://www.justia.com/criminal/offenses/white-collar-crimes...
- fouc 6y ago
  The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.
- fractionalhare 6y ago
  Yes, it's the payment request.
asdfasgasdgasdg 6y ago
It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.
- j4yav 6y ago
  In the US at least I don’t believe the act has to be illegal.
- treis 6y ago
  No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.
  - asdfasgasdgasdg 6y ago
    Ok, you got me. But there must be more to the definition of blackmail than simply, pay me or else. If that were the definition, then everyone would be a blackmailer by virtue of "pay me for this or else I'll sell it to someone else," which is a "threat" we all implicitly make every day.
downandout 6y ago
In the US, blackmail has a very specific meaning: it is a threat to inform law enforcement of a violation of federal law under demand of a thing of value. This would actually be extortion, which is defined in 18 USC 875(d): Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both. https://uscode.house.gov/view.xhtml?path=/prelim@title18/part1/chapter41&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim@title18/par...

That may be considered black-mail by some courts.

Itsdijital 6y ago

I guess that's true. Whats the end state if Apple refuses to pay?

eyelidlessness 6y ago
“It would be a shame if someone used this vulnerability”
albntomat0 6y ago
Then Apple gets a reputation for refusing to pay, less folks look for and responsibly disclose vulns in Apple products, and their security posture as as whole suffers.

ClumsyPilot 6y ago

I dont think apple is entitled to that information on any basis, and i dont think its a legitimate threat to expose actual ill behaviour

young_unixer 6y ago
I think they're talking about the implication that if Apple don't pay, then the vulnerability is published. I agree with you on a moral basis: what difference does it make if I get payed not to publish it vs. If I just publish it without even asking to get paid. But I'm not sure the law would agree with us.
- ClumsyPilot 6y ago
  I think, like in many legal matters, precedent and intent is key. Without ill intent there is no 'mens rea', or "guilty mind". In this case you aren't just a vigilante targetting apple, there is established practice stretching decades. There is also a duty on you as a security proffeshional, and there is a significant public interest in knowing about the vulnerability. So , most likely, it will be you doing your job.
mdpopescu 6y ago
All blackmail involves exposing something that someone doesn't want exposed - usually because the "something" is illegal. And yet, blackmail itself is illegal. Most countries have a culture against whistleblowers, starting from childhood ("don't be a tattletale", "don't be a rat").
- ClumsyPilot 6y ago
  And that anti-whistleblower culture enables fraud like theranos to be undiscovered for years

lovelyviking 6y ago

Can you explain it more? What can make it a black-mail and why? If there is no intent to abuse the bug when not paied then there is no additional threat there from simply notifying the company that some threat is already present. How it can become a black-mail? So every report about discovered bug can be considered as black-mail? If one discovers a bug, reports it to the company and says that after 3 months it will be public it's a black-mail too? Or the payment request makes it different? And if person doesn't threat to publish the bug then it's ok?

IncRnd 6y ago
Definition: Blackmail involves a threat to do something that would cause a person to suffer embarrassment or financial loss, unless that person meets certain demands. [0] [0] https://www.justia.com/criminal/offenses/white-collar-crimes/blackmail https://www.justia.com/criminal/offenses/white-collar-crimes...
fouc 6y ago
The longer a bug goes without being reported, the greater the potential impact. So not reporting a bug could be considered a form of abusing the bug. There's probably a moral obligation to report bugs promptly. Bug bounty programs that companies have are ultimately a reward for being a nice person, as opposed to being a payment for services rendered.
fractionalhare 6y ago
Yes, it's the payment request.

asdfasgasdgasdg 6y ago

It's only blackmail if the threat is to do something you are not otherwise legally allowed to do. It is legal to, say, announce a zero-day on Twitter. Or to sell the zero-day to the NSA, or some grey hat broker like Zerodium.

j4yav 6y ago
In the US at least I don’t believe the act has to be illegal.
treis 6y ago
No it's not. Pay me $10,000 or I tell everyone you slept with your secretary is blackmail.
- asdfasgasdgasdg 6y ago
  Ok, you got me. But there must be more to the definition of blackmail than simply, pay me or else. If that were the definition, then everyone would be a blackmailer by virtue of "pay me for this or else I'll sell it to someone else," which is a "threat" we all implicitly make every day.

downandout 6y ago

In the US, blackmail has a very specific meaning: it is a threat to inform law enforcement of a violation of federal law under demand of a thing of value. This would actually be extortion, which is defined in 18 USC 875(d): Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both. https://uscode.house.gov/view.xhtml?path=/prelim@title18/part1/chapter41&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim@title18/par...