4 ms·

I mean, not forgetting that possession of nmap is technically a crime in Germany.. Which also makes any cybersec company operating in Germany also illegal. Al

I mean, not forgetting that possession of nmap is technically a crime in Germany.. Which also makes any cybersec company operating in Germany also illegal. Although, no one has been prosecuted for this, it makes getting insurance impossible… https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/germany https://iclg.com/practice-areas/cybersecurity-laws-and-regul...

formerly_proven 5y ago
It's a dumb law but not how it works.
- cyberpunk 5y ago
  How does it work then? I was stonewalled by various banks investors and insurers over this in berlin…
  - mandelbrotwurst 5y ago
    How did that happen, did they ask you for a complete list of all software that you run?
  - orangeoxidation 5y ago
    That shouldn't have happened. The law is super problematic and they can, for example (try to) hit you for finding (or even stumbling over) and responsibly disclosing security vulns, if you were not hired to do so. But the part about hacker-tools applys only for tools that cannot be used legally (basically none) or are explicitly and knowingly made or acquired to be used illegally (as in you explicitly stated you are downloading this tool in order to get into a computer you do not have permission to get into). They have to prove you are not intending to use it legally (like checking your own network or one you were hired to check).
Sukera 5y ago
Which part of that long list of things specifically rules out possession of nmap, a tool used by sysadmins all over the world to help ensure that their own systems are more secure, by ensuring that only specific ports are open for communication? Mapping a network is not an activity exclusive to criminals.
- cyberpunk 5y ago
  Dual use tools are not exempt. If it can be used for nefarious haxxoring then you’re out of luck. Let alone having something like msf on your box…
  - jimktrains2 5y ago
    Everything can be dual use for "haxxoring".
    - wizzwizz4 5y ago
      Cyber laws are not known for being reasonable. Though, this particular interpretation does make Google Chrome illegal; it has dev tools that can be used for manually sending HTTPS POST requests with forged headers. (It also has XMLHttpRequest, which can be instructed to do what nmap does with relative ease.)
melff 5y ago
Yeah, that's pretty much a "Karteileiche" though, nobody takes that law seriously. This has less to do with germany being overly restrictive in that domain and more with incompetence: The law says something like "possessing hardware/software suitable for hacking is illegal" those who have written this law probably barely knew what software even is. They wanted to make sure they can get those evil "hackers" convicted but misunderstood the nature of what they are dealing with.
- account42 5y ago
  The law not being enforced makes this worse, not better as that means there is no motivation to remove it and it remains available to use to coerce/punish in the future.
  - melff 5y ago
    good point

formerly_proven 5y ago

It's a dumb law but not how it works.

cyberpunk 5y ago
How does it work then? I was stonewalled by various banks investors and insurers over this in berlin…
- mandelbrotwurst 5y ago
  How did that happen, did they ask you for a complete list of all software that you run?
- orangeoxidation 5y ago
  That shouldn't have happened. The law is super problematic and they can, for example (try to) hit you for finding (or even stumbling over) and responsibly disclosing security vulns, if you were not hired to do so. But the part about hacker-tools applys only for tools that cannot be used legally (basically none) or are explicitly and knowingly made or acquired to be used illegally (as in you explicitly stated you are downloading this tool in order to get into a computer you do not have permission to get into). They have to prove you are not intending to use it legally (like checking your own network or one you were hired to check).

Sukera 5y ago

Which part of that long list of things specifically rules out possession of nmap, a tool used by sysadmins all over the world to help ensure that their own systems are more secure, by ensuring that only specific ports are open for communication? Mapping a network is not an activity exclusive to criminals.

cyberpunk 5y ago
Dual use tools are not exempt. If it can be used for nefarious haxxoring then you’re out of luck. Let alone having something like msf on your box…
- jimktrains2 5y ago
  Everything can be dual use for "haxxoring".
  - wizzwizz4 5y ago
    Cyber laws are not known for being reasonable. Though, this particular interpretation does make Google Chrome illegal; it has dev tools that can be used for manually sending HTTPS POST requests with forged headers. (It also has XMLHttpRequest, which can be instructed to do what nmap does with relative ease.)

melff 5y ago

Yeah, that's pretty much a "Karteileiche" though, nobody takes that law seriously. This has less to do with germany being overly restrictive in that domain and more with incompetence: The law says something like "possessing hardware/software suitable for hacking is illegal" those who have written this law probably barely knew what software even is. They wanted to make sure they can get those evil "hackers" convicted but misunderstood the nature of what they are dealing with.

account42 5y ago
The law not being enforced makes this worse, not better as that means there is no motivation to remove it and it remains available to use to coerce/punish in the future.
- melff 5y ago
  good point