6 ms·

I am wondering how can you dodge this if you are a security researcher in the US.

smoyer 11y ago
Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable). I think it's interesting that the lawyer focused on the fact that they depackaged the chip when the (in my mind) bigger vulnerabilities don't require that. I think it would be interesting to sue a company like CyberLock for false advertising ... "impossible to clone keys" is clearly false.
- ceejayoz 11y ago
  > Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable). Chances are that just changes the lawsuits to defamation ones.
  - gameshot911 11y ago
    Truth is an absolute defense to defamation.
    - ceejayoz 11y ago
      Expensive lawyers and extended litigation are a non-absolute but often effective defense to truth.
      - dmix 11y ago
        Indeed, if you do so you must word your blog post very carefully not to make any claims you can't fully back-up with a PoC. Such as being very specific about what versions/configurations are vulnerable.
  - smoyer 11y ago
    Which might just force you to show how you cloned the key in court ... if you can actually clone the key it's not defamation.
    - ceejayoz 11y ago
      It'll force you to hire expensive lawyers for all the pre-court maneuvering, which tends to be a good deterrent to any small agency or freelance consultant.
  - rayiner 11y ago
    Defamation suits are rare in the U.S. because they're so hard to win.
    - ceejayoz 11y ago
      You don't have to win it to bankrupt the target with pre-court maneuverings.
      - rayiner 11y ago
        And what "pre-court maneuverings" would that be?
        hluska 11y ago
        Here is a good starting point: https://www.law.cornell.edu/rules/frcp https://www.law.cornell.edu/rules/frcp
        ceejayoz 11y ago
        http://en.wikipedia.org/wiki/Lawsuit#Pre-trial http://en.wikipedia.org/wiki/Lawsuit#Pre-trial See http://en.wikipedia.org/wiki/Strategic_lawsuit_against_public_participation#United_States_2 http://en.wikipedia.org/wiki/Strategic_lawsuit_against_publi... for a variety of examples of such suits.
        rayiner 11y ago
        That procedure starts with the pleadings, which aren't "pre-court." They are the first step in a court proceeding.
poizan42 11y ago
Depending on you purpose you could publish it anonymously - just make damn sure it can't be traced back to you. It won't help you much if your goal is to built reputation or you want to be able to talk about it.

Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable). I think it's interesting that the lawyer focused on the fact that they depackaged the chip when the (in my mind) bigger vulnerabilities don't require that. I think it would be interesting to sue a company like CyberLock for false advertising ... "impossible to clone keys" is clearly false.

ceejayoz 11y ago
> Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable). Chances are that just changes the lawsuits to defamation ones.
- gameshot911 11y ago
  Truth is an absolute defense to defamation.
  - ceejayoz 11y ago
    Expensive lawyers and extended litigation are a non-absolute but often effective defense to truth.
    - dmix 11y ago
      Indeed, if you do so you must word your blog post very carefully not to make any claims you can't fully back-up with a PoC. Such as being very specific about what versions/configurations are vulnerable.
- smoyer 11y ago
  Which might just force you to show how you cloned the key in court ... if you can actually clone the key it's not defamation.
  - ceejayoz 11y ago
    It'll force you to hire expensive lawyers for all the pre-court maneuvering, which tends to be a good deterrent to any small agency or freelance consultant.
- rayiner 11y ago
  Defamation suits are rare in the U.S. because they're so hard to win.
  - ceejayoz 11y ago
    You don't have to win it to bankrupt the target with pre-court maneuverings.
    - rayiner 11y ago
      And what "pre-court maneuverings" would that be?
      - hluska 11y ago
        Here is a good starting point: https://www.law.cornell.edu/rules/frcp https://www.law.cornell.edu/rules/frcp
      - ceejayoz 11y ago
        http://en.wikipedia.org/wiki/Lawsuit#Pre-trial http://en.wikipedia.org/wiki/Lawsuit#Pre-trial See http://en.wikipedia.org/wiki/Strategic_lawsuit_against_public_participation#United_States_2 http://en.wikipedia.org/wiki/Strategic_lawsuit_against_publi... for a variety of examples of such suits.
        rayiner 11y ago
        That procedure starts with the pleadings, which aren't "pre-court." They are the first step in a court proceeding.

poizan42 11y ago

Depending on you purpose you could publish it anonymously - just make damn sure it can't be traced back to you. It won't help you much if your goal is to built reputation or you want to be able to talk about it.