Hacker News Reader

Couldn't one collect logs of all things, under the auspices of collecting logs that (may) contain "recon activity" and "exploits"? It seems on a surface reading that one could collect all those under the umbrella of collecting Indicators, and then also use it also for things like selling-to-advertisers or other business-related things.

Of course, our terms of use on most sites already say they can collect + monetize such things, so maybe this is moot.

View on HN

I'm not sure I see the part of CISA that allows you to sell your logs to advertisers. I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.

Sounds like a loophole.

What specific part of the bill reads like a loophole that would allow Facebook to sell its security logs to advertisers?

I was just responding to what you'd said above:

> I do see lots of places in the bill that allow sharing to other private entities or to the USG for cybersecurity purposes.

"For cybersecurity purposes".

It's a short bill. Read it again! These terms are defined, reasonably well.

Reply on news.ycombinator.com