5 ms·

"I wonder, why doesn't Apple (and MS, Google, ...) throw all their weight into the ring and lobby for making selling exploits commerically a crime?" I would be

by rsync 4y ago

"I wonder, why doesn't Apple (and MS, Google, ...) throw all their weight into the ring and lobby for making selling exploits commerically a crime?" I would be strongly, strongly opposed to this. It is a clear-cut free speech / first amendment issue. If you don't believe me, just imagine yourself describing the pseudocode of an exploit to someone over the phone - or sketching out the details of a vulnerability in a short note. I believe we won't get to this place because we have the first amendment but I would really love to not waste ten years fighting about it ...

captainmuon 4y ago
I would actually say morally it is clear cut in the opposite direction. Imagine you hack into a company or a government computer and steal secrets. That is clearly illegal. Now imagine you figure out how to do the hack, do all the preparation, and sell it ready to use to somebody. And they are open about the fact that they are selling it to foreign powers. This should definitely be illegal, too. In the physical world, you also probably shouldn't be able to go around and sell instructions how to break into cars or houses. > If you don't believe me, just imagine yourself describing the pseudocode of an exploit to someone over the phone - or sketching out the details of a vulnerability in a short note. I don't see how any of this would be effected. You could still do hacking, security research, you could get bug bounties, report bugs to the vendor, the government, or even disclose them to the public. You just shouldn't be allowed to sell that kind of information to a third party. There are many laws like that right now. In the case of insider trading, you are not allowed to share certain nonpublic information against some benefit with others.
- Avamander 4y ago
  > Now imagine you figure out how to do the hack, do all the preparation, and sell it ready to use to somebody. Now imagine you notify the vendor that they have a grave security flaw in their product. They could totally turn you in to the police and the PoC is sufficient to consider you guilty. You won't be able to prove yourself innocent without a long, expensive and life-destroying legal battle. It would have a massive chilling effect on everything else instead of what you originally intended.
- spogbiper 4y ago
  One of my favorite youtube channels is Lockpicking Lawyer. He shows how to break into all kinds of things by defeating physical security. The videos are "free" but of course he's making money off ad views, sponsors etc like any youtuber. Should that be illegal?

by rsync 4y ago

captainmuon 4y ago

I would actually say morally it is clear cut in the opposite direction. Imagine you hack into a company or a government computer and steal secrets. That is clearly illegal. Now imagine you figure out how to do the hack, do all the preparation, and sell it ready to use to somebody. And they are open about the fact that they are selling it to foreign powers. This should definitely be illegal, too. In the physical world, you also probably shouldn't be able to go around and sell instructions how to break into cars or houses. > If you don't believe me, just imagine yourself describing the pseudocode of an exploit to someone over the phone - or sketching out the details of a vulnerability in a short note. I don't see how any of this would be effected. You could still do hacking, security research, you could get bug bounties, report bugs to the vendor, the government, or even disclose them to the public. You just shouldn't be allowed to sell that kind of information to a third party. There are many laws like that right now. In the case of insider trading, you are not allowed to share certain nonpublic information against some benefit with others.

Avamander 4y ago
> Now imagine you figure out how to do the hack, do all the preparation, and sell it ready to use to somebody. Now imagine you notify the vendor that they have a grave security flaw in their product. They could totally turn you in to the police and the PoC is sufficient to consider you guilty. You won't be able to prove yourself innocent without a long, expensive and life-destroying legal battle. It would have a massive chilling effect on everything else instead of what you originally intended.
spogbiper 4y ago
One of my favorite youtube channels is Lockpicking Lawyer. He shows how to break into all kinds of things by defeating physical security. The videos are "free" but of course he's making money off ad views, sponsors etc like any youtuber. Should that be illegal?