5 ms·

A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz) While infosec is currently a smaller sector in startups than say social, casual gami

A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz) While infosec is currently a smaller sector in startups than say social, casual gaming, apps, etc, it's growing furiously and Wassenaar and individual country regs will be top-of-mind for much of the YC community in the years to follow because many of you will be in this space. I'd like to emphasize one of Google's points: "Global companies should be able to share information globally." With existing laws we are already running into limits on where we can hire and what our own internal staff can send us. So it really is critical for any small or large global org that internal comms are not squashed by this. BIS's comment period ends today, so if you want to take action, now is the time. As in, before COB today. One last thing: The Hacking Team compromise and stolen data (including the zero-days they were hoarding) couldn't come at a worse time. It is fuel for the argument that zero-days, vulnerabilities, vectors etc should be tightly regulated and it's really thrown some weight behind the argument to close borders (WRT info exchange) rather than open them. So your help is really needed on this if you think you should be able to have open conversations about technical infosec issues with your colleagues in other countries. ~mark

Zigurd 11y ago
Hacking Team was in the business of selling zero-days to government for the purpose of enabling surveillance. That's what people find objectionable. It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned.
- deciplex 11y ago
  > It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned. As a last resort. Ideally, it would get your ass arrested, your lab destroyed, and a speedy trial.
  - ommunist 11y ago
    Welcome to the real world, Neo. If you dig deeper, you will probably find shady Bahamas funds backing companies like that, and one may get an enlightenment, that government of one unspecified country feeds the company in question with zero-days to make a careful provocation to become able to receive public mandate on building tighter regulations for some future markets. Uhh...
click170 11y ago
> "Global companies should be able to share information globally." This is an interesting point, and to me it seems to be pitting global companies against individual countries. This makes me feel uneasy because I feel there's a better chance my government is looking out for my best interests than many global companies are. Am I just being paranoid and naive?
- mmaunder 11y ago
  That's a really big debate: small vs big government, Keynesian vs Hayekian economics, public vs private sector and so on. I'd say from my side that government and private sector have a role in protecting you. Government tends to excel at things like air traffic control and lighthouses where there isn't much scope for competition and where competition may harm. Private sector tends to do things more efficiently when competition is feasible. So both have a role and the role of private sector is an important one. If we pass laws that restrict innovation, the risk is that things that would normally be in private sector will become government roles and won't be done as efficiently or as effectively as they could be. I'd say at the rate we're seeing attacks escalate, providing the most effective protection we can in infospace is very important. I'm completely ignoring issues like investment opportunities, job creation and so on because I think the core problem we're all trying to solve is to protect individuals and businesses. We need to get that right first and move from there.
  - LunaSea 11y ago
    I'm sorry but I don't see how a private company "protects" you in any way.
    - lmm 11y ago
      It doesn't have to be about protection. Just about serving your interests. When my country privatized the phone system, the time to get a phone line installed dropped from 3 months to 5 days (because suddenly they were motivated to get it installed as soon as possible so they could start making money).
    - 11y ago
benmmurphy 11y ago
i'm not sure the hacking team incident is the worst thing possible. hacking team was following the rules. they had export licenses. it just shows that the rules don't hurt bad players.
ommunist 11y ago
Also decriminalisation of software security research public image must happen and it needs some serous PR effort backed by a solid industry association or stakeholder. Otherwise big fish will PR-down all the small fish into regulation network woven by itself.

Zigurd 11y ago

Hacking Team was in the business of selling zero-days to government for the purpose of enabling surveillance. That's what people find objectionable. It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned.

deciplex 11y ago
> It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned. As a last resort. Ideally, it would get your ass arrested, your lab destroyed, and a speedy trial.
- ommunist 11y ago
  Welcome to the real world, Neo. If you dig deeper, you will probably find shady Bahamas funds backing companies like that, and one may get an enlightenment, that government of one unspecified country feeds the company in question with zero-days to make a careful provocation to become able to receive public mandate on building tighter regulations for some future markets. Uhh...

click170 11y ago

> "Global companies should be able to share information globally." This is an interesting point, and to me it seems to be pitting global companies against individual countries. This makes me feel uneasy because I feel there's a better chance my government is looking out for my best interests than many global companies are. Am I just being paranoid and naive?

mmaunder 11y ago
That's a really big debate: small vs big government, Keynesian vs Hayekian economics, public vs private sector and so on. I'd say from my side that government and private sector have a role in protecting you. Government tends to excel at things like air traffic control and lighthouses where there isn't much scope for competition and where competition may harm. Private sector tends to do things more efficiently when competition is feasible. So both have a role and the role of private sector is an important one. If we pass laws that restrict innovation, the risk is that things that would normally be in private sector will become government roles and won't be done as efficiently or as effectively as they could be. I'd say at the rate we're seeing attacks escalate, providing the most effective protection we can in infospace is very important. I'm completely ignoring issues like investment opportunities, job creation and so on because I think the core problem we're all trying to solve is to protect individuals and businesses. We need to get that right first and move from there.
- LunaSea 11y ago
  I'm sorry but I don't see how a private company "protects" you in any way.
  - lmm 11y ago
    It doesn't have to be about protection. Just about serving your interests. When my country privatized the phone system, the time to get a phone line installed dropped from 3 months to 5 days (because suddenly they were motivated to get it installed as soon as possible so they could start making money).
  - 11y ago

benmmurphy 11y ago

i'm not sure the hacking team incident is the worst thing possible. hacking team was following the rules. they had export licenses. it just shows that the rules don't hurt bad players.

ommunist 11y ago

Also decriminalisation of software security research public image must happen and it needs some serous PR effort backed by a solid industry association or stakeholder. Otherwise big fish will PR-down all the small fish into regulation network woven by itself.