6 ms·

>You should never need a license when you report a bug to get it fixed That hampers people that wish to publicly disclose or sell vulnerability information. Th

>You should never need a license when you report a bug to get it fixed That hampers people that wish to publicly disclose or sell vulnerability information. This is massively biased in favour of software companies (to some extent, like Google). You should never need a license to disclose vulnerability information, full stop. >Global companies should be able to share information globally Why should this be limited to the employees of a company?

comex 11y ago
Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.) I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec. In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even think in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.
- AnthonyMouse 11y ago
  There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be. It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys. The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.
  - comex 11y ago
    As much as I would like the government to make such bids, I don't agree regulation is useless. Sure, no policy can completely prevent zero days from being sold - in fact, this particular policy doesn't even try; it just limits who you can sell them to. But if that means that organizations and individuals who wish to remain respectable and avoid any trouble with the law, however unlikely it is to be enforceable in practice, limit their trade to quite nefarious actors rather than extremely nefarious ones... it's better than nothing. edit: that is, it's better than nothing if it avoids harming the good guys too much, and as I said, I am skeptical of many of the critical comments that have been made, though, buying Google's, I hope the rule will be amended. Argh, I'm too tired to express myself properly.
    - AnthonyMouse 11y ago
      > that is, it's better than nothing if it avoids harming the good guys too much In theory there is an ideal rule with ideal enforcement that will cause less trouble than it prevents. But as Yogi Berra once said, in theory there is no difference between theory and practice; in practice there is. Here's a example of a serious problem this actually causes. Suppose Nefaristan is on the list of places nobody can sell to. The evil government of Nefaristan will just send an operative to Jordan or Saudi Arabia or whatever nominally less nefarious place didn't make the list, and buy their exploits there. So either way the evil government of Nefaristan will have embargoed exploits to use against against their domestic dissidents. The dissidents need the embargoed patch right away or they'll be found out and executed. But now the stupid law prohibits anyone from giving it to them because they're in Nefaristan. It's difficult to imagine how a law could fail harder than "helps bad guys send good guys to death camps" -- but here we are. Causing serious harm is not better than doing nothing.
- ObviousScience 11y ago
  Yes, we need a war on warez to go with our wars on terror and drugs, which have been rousing successive, having driven both of those social ills to extinction.
  - ommunist 11y ago
    The war is on and we are losing. Yesterday a 56 year old bricky from Watford called my in panic. His old XP laptop was literally taken as hostage asking to call some paid phone number to unlock computer back again.
    - ObviousScience 11y ago
      My point, since you missed it, is the instrumenting a "war on warez" in the style of "war on drugs" or "war on terror" is a joke, and should be disregarded as just the talking point of someone with a different idea trying to sell you something.
- tomjen3 11y ago
  I find the idea that I can write a weapon on my computer laughable and I can't see how the hacker community can justify attacks on freedom of speech. This is pre-emptive censorship and as such self evidently entirely morally wrong.
  - comex 11y ago
    In fact, this is a point I am curious about. IANAL, but the case of Bernstein v. United States, while mooted before it could come to a true conclusion, seems to demonstrate that there is legal plausibility to the argument that publishing source code of "dangerous" systems is protected by the First Amendment. While cryptography is less immediately harmful than some of the things prohibited in this case, the circumstances still seem pretty similar to me; and if these rules were overturned on such grounds, I cannot say I would be all that upset, as such a decision would likely also imply protection for a lot of stuff I like more than this. That said, when you consider things like Stuxnet, which physically destroyed industrial facilities, I'd say the idea that malware can be a weapon is harder to dismiss these days than in teh past. Admittedly, most zero-day exploits do not have so close an analogy, but in the wrong hands they can certainly help put people in physical danger. In any case, surveillance is hardly something the 'hacker community' is thrilled about - as per the zeitgeist in this forum, at least...
    - tomjen3 11y ago
      But Stuxnet harmed nobody and nothing until it was hooked into physical hardware. This is my main point - I can't actually change anything in the real world, unless I am controlling some hardware, but then the situation is the same as if I was operating it directly. I agree with you that surveillance is unpopular among hackers, but I am old enough to remember when censorship was considered at least as bad I would like it to stay that way.
- hga 11y ago
  It could, though. Right now, we in the US pro-gun camp are fighting some newly proposed ITAR regulations which, while probably aimed at the 3D/80% AR-15 receiver camps, would criminalize unlicensed disclosure of the sorts of basic data about weapons that's been freely published since forever. See e.g. this http://weaponsman.com/?p=23824 http://weaponsman.com/?p=23824 Note the relatively innocuous data discussed (inner and outer machine gun barrel heating), and then skip to the bottom "A Note To Our Readers", these guys have consulted their lawyer on the matter. And the NRA (lobby for gun owners) take on it, which seems to be accurate: https://www.nraila.org/articles/20150605/stop-obamas-planned-gag-order-on-firearm-related-speech https://www.nraila.org/articles/20150605/stop-obamas-planned...

comex 11y ago

Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.) I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec. In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even think in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.

AnthonyMouse 11y ago
There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be. It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys. The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.
- comex 11y ago
  As much as I would like the government to make such bids, I don't agree regulation is useless. Sure, no policy can completely prevent zero days from being sold - in fact, this particular policy doesn't even try; it just limits who you can sell them to. But if that means that organizations and individuals who wish to remain respectable and avoid any trouble with the law, however unlikely it is to be enforceable in practice, limit their trade to quite nefarious actors rather than extremely nefarious ones... it's better than nothing. edit: that is, it's better than nothing if it avoids harming the good guys too much, and as I said, I am skeptical of many of the critical comments that have been made, though, buying Google's, I hope the rule will be amended. Argh, I'm too tired to express myself properly.
  - AnthonyMouse 11y ago
    > that is, it's better than nothing if it avoids harming the good guys too much In theory there is an ideal rule with ideal enforcement that will cause less trouble than it prevents. But as Yogi Berra once said, in theory there is no difference between theory and practice; in practice there is. Here's a example of a serious problem this actually causes. Suppose Nefaristan is on the list of places nobody can sell to. The evil government of Nefaristan will just send an operative to Jordan or Saudi Arabia or whatever nominally less nefarious place didn't make the list, and buy their exploits there. So either way the evil government of Nefaristan will have embargoed exploits to use against against their domestic dissidents. The dissidents need the embargoed patch right away or they'll be found out and executed. But now the stupid law prohibits anyone from giving it to them because they're in Nefaristan. It's difficult to imagine how a law could fail harder than "helps bad guys send good guys to death camps" -- but here we are. Causing serious harm is not better than doing nothing.
ObviousScience 11y ago
Yes, we need a war on warez to go with our wars on terror and drugs, which have been rousing successive, having driven both of those social ills to extinction.
- ommunist 11y ago
  The war is on and we are losing. Yesterday a 56 year old bricky from Watford called my in panic. His old XP laptop was literally taken as hostage asking to call some paid phone number to unlock computer back again.
  - ObviousScience 11y ago
    My point, since you missed it, is the instrumenting a "war on warez" in the style of "war on drugs" or "war on terror" is a joke, and should be disregarded as just the talking point of someone with a different idea trying to sell you something.
tomjen3 11y ago
I find the idea that I can write a weapon on my computer laughable and I can't see how the hacker community can justify attacks on freedom of speech. This is pre-emptive censorship and as such self evidently entirely morally wrong.
- comex 11y ago
  In fact, this is a point I am curious about. IANAL, but the case of Bernstein v. United States, while mooted before it could come to a true conclusion, seems to demonstrate that there is legal plausibility to the argument that publishing source code of "dangerous" systems is protected by the First Amendment. While cryptography is less immediately harmful than some of the things prohibited in this case, the circumstances still seem pretty similar to me; and if these rules were overturned on such grounds, I cannot say I would be all that upset, as such a decision would likely also imply protection for a lot of stuff I like more than this. That said, when you consider things like Stuxnet, which physically destroyed industrial facilities, I'd say the idea that malware can be a weapon is harder to dismiss these days than in teh past. Admittedly, most zero-day exploits do not have so close an analogy, but in the wrong hands they can certainly help put people in physical danger. In any case, surveillance is hardly something the 'hacker community' is thrilled about - as per the zeitgeist in this forum, at least...
  - tomjen3 11y ago
    But Stuxnet harmed nobody and nothing until it was hooked into physical hardware. This is my main point - I can't actually change anything in the real world, unless I am controlling some hardware, but then the situation is the same as if I was operating it directly. I agree with you that surveillance is unpopular among hackers, but I am old enough to remember when censorship was considered at least as bad I would like it to stay that way.
hga 11y ago
It could, though. Right now, we in the US pro-gun camp are fighting some newly proposed ITAR regulations which, while probably aimed at the 3D/80% AR-15 receiver camps, would criminalize unlicensed disclosure of the sorts of basic data about weapons that's been freely published since forever. See e.g. this http://weaponsman.com/?p=23824 http://weaponsman.com/?p=23824 Note the relatively innocuous data discussed (inner and outer machine gun barrel heating), and then skip to the bottom "A Note To Our Readers", these guys have consulted their lawyer on the matter. And the NRA (lobby for gun owners) take on it, which seems to be accurate: https://www.nraila.org/articles/20150605/stop-obamas-planned-gag-order-on-firearm-related-speech https://www.nraila.org/articles/20150605/stop-obamas-planned...