Hacker News Reader

Could you explain the dual-use export issue. I read a little about it here [1], but I don't understand. So, if Esser was to contact Apple and provide them with the vulnerability info for free, but with out first registering it as a dual-use export, he could get in trouble? Even if he didn't receive any compensation from Apple? Is that the case?

[1] https://www.justsecurity.org/5703/export-control-arrangement...

View on HN

He could basically be sent to jail for weapon smuggling, receiving any compensation is irrelevant.

Even if Apple is the only place that he can reasonably contact to have the vulnerability fixed, instead of exploited? This law is weird.

That's a really sad state of affairs. Instead of promoting security, which is what the law claims to do, the law is actually promoting insecurity. Which is probably the true end goal of the law any way, if that's the way it's written. Threaten people with jail unless they first register security vulnerabilities with the government, than, when they do so, threaten them with even more jail time if they ever speak again about the said vulnerability, and keep the vulnerability for your self. I guess EU is just pissed that NSA has better toys. Really, truly sad state of affairs.

Reply on news.ycombinator.com