Full Disclosure mailing list archives
Re: how to sell and get a fair price
From: Valdis.Kletnieks () vt edu
Date: Fri, 18 Jan 2013 15:42:13 -0500
On Wed, 16 Jan 2013 10:18:36 +0400, gremlin () gremlin ru said:
On 15-Jan-2013 16:45:30 -0500, Valdis.Kletnieks () vt edu wrote:
Also, what stops a person to file it under a company name if that's easier? I admit I'm not into this area, so I might be missing something fundamental...
If you publish an exploit as "BitWizard97", and somebody scarfs it up and starts selling it,
Starts selling what? Already published exploit? Bwahahaha...
You'd be amazed how many people try that sort of thing. Consider that over on the GPL side of the fence, there's more than enough companies that try to play fast-n-loose with the GPL requirements that www.gpl-violations.org stays in business. (Also, keep in mind that there *are* a large number of exploits that are in limited circulation. Hacker X releases it to 10 or 15 of his friends, and then one of his friends turns around and cashes it in at some corporate, and then said corporate starts selling it as part of their cyber-defense product. At that point, Hacker X wants to get paid (money, fame, credit, whatever)).
filing the suit to enjoin them from selling it without your permission under a company name doesn't make it any easier to prove that you, or the company, have any legal standing to represent BitWizard97.
Digital signatures may help. Actually, you don't need to prove that you are the BitWizard97 - you only need to prove that you can act on his behalf (that means: read encrypted messages and sign the replies with his key).
I believe I mentioned PGP way back at the start of the thread. Also helps if you actually PGP-signed your release. Bonus points for figuring out how to explain digital signatures to a jury, stripping it down to "up-goer-five" level needed for the people who can't figure out how to avoid serving on a jury (see http://www.xkcd.com/1133/ for the details on that).
It's especially problematic if the local law enforcement authorities want to have a little chat with BitWizard97 regarding some other activities...
They should want to ask those questions to another person - say, BitBreaker12, who may be suspected in something illegal.
And why should they ask that other person instead? You think if the LEO is interested in a particular person's activities, that person gets a free pass just because they're involved in an unrelated court case? That the cops are just going to say "Wow, he's busy in court today, let's go hassle somebody who's name hasn't even come up in this context"?
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- how to sell and get a fair price Mikhail A. Utin (Jan 10)
- Re: how to sell and get a fair price coderman (Jan 10)
- Re: how to sell and get a fair price Źmicier Januszkiewicz (Jan 12)
- Re: how to sell and get a fair price Valdis . Kletnieks (Jan 14)
- Re: how to sell and get a fair price Christian Sciberras (Jan 14)
- Re: how to sell and get a fair price Valdis . Kletnieks (Jan 14)
- Re: how to sell and get a fair price Christian Sciberras (Jan 14)
- Re: how to sell and get a fair price Valdis . Kletnieks (Jan 15)
- Re: how to sell and get a fair price gremlin (Jan 16)
- Re: how to sell and get a fair price Valdis . Kletnieks (Jan 18)
- Re: how to sell and get a fair price Christian Sciberras (Jan 14)
- Re: how to sell and get a fair price Mikhail A. Utin (Jan 15)
- Re: how to sell and get a fair price Jeffrey Walton (Jan 15)
- Re: how to sell and get a fair price Nick FitzGerald (Jan 15)
- Re: how to sell and get a fair price Jeffrey Walton (Jan 15)
- Re: how to sell and get a fair price Jeffrey Walton (Jan 15)
- Re: how to sell and get a fair price gremlin (Jan 16)
- Re: how to sell and get a fair price Jeffrey Walton (Jan 16)