Re: [NSE] oracle-brute

[Fyodor <fyodor () insecure org>]

On Mon, Sep 05, 2011 at 07:59:20PM +0200, Patrik Karlsson wrote:
> I actually ran these hashes through John the ripper, so I'm not sure
> where that leaves us.

It is sort of a gray area, but I think this is OK from a copyright
perspective.  We're just using a small list of usernames, which are
basically a database of facts.  According to [1], "In order for a
database to qualify for copyright protection, the author has to make
choices about the selection, coordination, or arrangement of the facts
or data, and those choices must be at least a little bit creative."
For example, it was found that a standard phone books (white pages)
isn't subject to copyright protection.

This probablies applies in the case of Pete Finnigan's database too,
but I think we should respect his wishes out of politeness.
Similarly, we might remove the dfltpass-generated list if Oracle
objects.

So thanks for creating this file.  I think it solves our problem
nicely.

As far as removing entries like CARRIECONYERS/CARRIECONYERS and
DAVIDMORGAN/DAVIDMORGAN, that is more of a technical decision and I
don't really know enough about how these databases are used to opine
on whether and how we should do that.

Cheers,
Fyodor

[1] http://www.lib.umich.edu/copyright/facts-and-dataI think it's OK from a copyright perspective.  
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/