3 ms·
This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course. The o
by wuest 14y ago
This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course.
The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.
- xyzzy123 14y agoThese are open questions which have never been resolved since section 251 was introduced in 2003. Note that this is NZ law only and I am not sure of the situation internationally. Some relevant quotes: ----- http://www.giac.org/paper/gsec/4001/zealand-information-technology-security-legislation/106400 http://www.giac.org/paper/gsec/4001/zealand-information-tech... "Although most cases of legitimate have been covered, not all have. Section 251 does potentially raise some interesting issues around concepts that many security professionals are supportive of, the sharing of information and full disclosure..." http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBeware.asp http://www.bellgully.co.nz/newsletters/03CTM/03CTM_HackersBe... "On the face of it, such criticisms may be justified. Whether or not the Amendment Act will actually have this effect will only become clear through the passage of time. In this regard, “good” users of such information may have to rely (tentatively) on the police's discretion whether or not to prosecute a particular case."