FireEye Scolded for Injunction to Stop Security Researcher Revealing Source Code
forbes.com
forbes.com
The common best practice for security researchers is, when a vulnerability is discovered, to contact the organization with the vulnerable product, give them a set amount of time to fix/patch the issue (usually 60 or 90 days), and then release the vulnerability to the public after that amount of time has passed. Many people feel that this system holds organizations accountable, and makes it so that they can't simply ignore the issue -- without being punitive to the product and its users.
While people can certainly have different opinions on how FireEye is perceived, it's absolutely a major player in the security industry. For an organization such as that to stifle researchers is very surprising to many people in the community.
FireEye claims that they don't take issue with the vulnerability disclosure, just the IP publication; meanwhile, ERNW claims that they promised not to release any IP without FireEye approval, and that they never intended to release anything that would relate to IP.
It's a weird situation.
And what IP could it be? Going from US law, none of trademark (they aren't pretending to be FireEye), trade secret (if FireEye revealed any without NDAs etc. they no longer are), or patents (publicly disclosed, their reason for existence in the US at least) would seem to apply. If they got source code, this would be going rather differently.
Maybe reverse engineering law is different in Germany? Or ... well, let me just say I wouldn't be inclined to buy anything from the company after looking at that picture of the CEO, I've seen and interacted with that type way too many times.