Hacker News Reader

To my knowledge, it is illegal to sell exploit kits to actors that you know are going to use the kits to commit crimes (e.g. if someone sends you an email saying "I'm looking for an exploit kit so that I can attack company X and steal their IP", you cannot legally sell to them). It is otherwise legal to sell, rent, or give away exploits to the general public or to resellers like Zerodium as long as they are not marketed as criminal tools.

View on HN

For sure, but in practical terms these types of dealings often have middle men and the end buyer is often not known (by design). Everything I know is from podcasts and books, so I'm not an authority on the subject - though I would point out that the enormous amount of red tape in the west tends to be something that westerners seem to project onto the rest of the world. In much of the world, things are just far more loose.

Reply on news.ycombinator.com