5 ms·
Not so easy to do. As usual, there is a risk that such legislation will be abused to let people who are trying to break in to a system for malicious reasons, cl
by limaoscarjuliet 11y ago
Not so easy to do. As usual, there is a risk that such legislation will be abused to let people who are trying to break in to a system for malicious reasons, claim later it was research. A decent law would require researchers to register with police/whatever before they start researching. Which then excludes researching government/police systems (because they would know up front). etc. Not so easy!
- indrax 11y agoLet's imagine a decent law that would require people to register what kinds of information they are protecting, from what kinds of use. One kind of security researcher we would want to protect is the one who finds out they can get information, but doesn't get everything, or doesn't keep what they get, or doesn't get anything really sensitive. Or who establishes that they can modify a system, but doesn't change anything important. If someone gets my credit card number, and doesn't use it, and points out the problem, I want to thank them. We make the analogy of breaking into houses, but bad information security is more like someone putting up a post-it note that says "This is a lock." Sometimes just looking past the lock violates the letter of the law.