Comment by comex | Hacker News Reader

Comment by comex | Hacker News Reader

Parent Full thread

Public disclosure apparently won't require a license anyway:

> Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available.

http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200

(The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.)

I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec.

In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even think in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.

There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be.

It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys.

The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.

As much as I would like the government to make such bids, I don't agree regulation is useless. Sure, no policy can completely prevent zero days from being sold - in fact, this particular policy doesn't even try; it just limits who you can sell them to. But if that means that organizations and individuals who wish to remain respectable and avoid any trouble with the law, however unlikely it is to be enforceable in practice, limit their trade to quite nefarious actors rather than extremely nefarious ones... it's better than nothing.

edit: that is, it's better than nothing if it avoids harming the good guys too much, and as I said, I am skeptical of many of the critical comments that have been made, though, buying Google's, I hope the rule will be amended. Argh, I'm too tired to express myself properly.

> that is, it's better than nothing if it avoids harming the good guys too much

In theory there is an ideal rule with ideal enforcement that will cause less trouble than it prevents. But as Yogi Berra once said, in theory there is no difference between theory and practice; in practice there is.

Here's a example of a serious problem this actually causes. Suppose Nefaristan is on the list of places nobody can sell to. The evil government of Nefaristan will just send an operative to Jordan or Saudi Arabia or whatever nominally less nefarious place didn't make the list, and buy their exploits there. So either way the evil government of Nefaristan will have embargoed exploits to use against against their domestic dissidents. The dissidents need the embargoed patch right away or they'll be found out and executed. But now the stupid law prohibits anyone from giving it to them because they're in Nefaristan.

It's difficult to imagine how a law could fail harder than "helps bad guys send good guys to death camps" -- but here we are.

Causing serious harm is not better than doing nothing.

Having read the definitions of what is controlled in the proposed rule, I'm pretty confident a patch wouldn't come close. And in any case, since the rules don't apply to public software, that only matters in the case of private patches, which aren't really a thing, and would be a pretty big moral hazard if they were.

Most patches inherently reveal the vulnerability they fix. Patches not being controlled would be a loophole big enough to fit a whole planet through.

And private patches are a thing. Vendors often distribute an early version of the patch to major customers for validation testing.

Or if you like, substitute "patch" for vulnerability information that enables a workaround. You can defeat Heartbleed by turning off TLS heartbeat support but that information is enough to quickly reverse engineer the vulnerability.

Out of curiosity, have you read the actual proposal?

The actual proposal is dozens of pages of legalese that would take a team of lawyers a week to decipher. I have no idea what it says because it is totally incomprehensible.

That's half the problem. If you're AT&T or Google you can hire said team of lawyers to tell you what it says, but what is an individual graduate student or security consultant supposed to do?

The other half of the problem is that what it says doesn't change the outcome, because the insolubility of the issue comes from economics rather than policy. There is no policy that will keep vulnerability information out of the hands of the bad guys only, because there is no practical way for most people to even identify who the bad guys are.

> There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high.

The cost of entry is not low though. To find a bug is one thing, to build a functioning exploit and associated payloads to weaponise it takes a team of engineers.

At the very least, we can prevent the likes of hacking team and gamma group from operating legally in western countries.

> The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.

We can only dream.

> The cost of entry is not low though. To find a bug is one thing, to build a functioning exploit and associated payloads to weaponise it takes a team of engineers.

"Team of engineers" is a bit of an overstatement. It's well within the capacity of an individual engineer. And the payload doesn't really change based on the exploit anyway; different RCE vulnerabilities are essentially fungible.

> At the very least, we can prevent the likes of hacking team and gamma group from operating legally in western countries.

How is that even useful? If it's going to happen anyway then you want it to happen in the open so you at least know what is happening. Push it underground or into places like Russia where you have limited visibility and it only makes it harder to catch the real bad guys.

> We can only dream.

I don't understand why they aren't already doing that. It's essentially a publicly-funded bug bounty program. The only disadvantage at all is that it costs money, and that's a pretty dumb excuse if this is half the problem they're making it out to be.

It could, though. Right now, we in the US pro-gun camp are fighting some newly proposed ITAR regulations which, while probably aimed at the 3D/80% AR-15 receiver camps, would criminalize unlicensed disclosure of the sorts of basic data about weapons that's been freely published since forever.

See e.g. this http://weaponsman.com/?p=23824 Note the relatively innocuous data discussed (inner and outer machine gun barrel heating), and then skip to the bottom "A Note To Our Readers", these guys have consulted their lawyer on the matter. And the NRA (lobby for gun owners) take on it, which seems to be accurate: https://www.nraila.org/articles/20150605/stop-obamas-planned...

I find the idea that I can write a weapon on my computer laughable and I can't see how the hacker community can justify attacks on freedom of speech. This is pre-emptive censorship and as such self evidently entirely morally wrong.

In fact, this is a point I am curious about. IANAL, but the case of Bernstein v. United States, while mooted before it could come to a true conclusion, seems to demonstrate that there is legal plausibility to the argument that publishing source code of "dangerous" systems is protected by the First Amendment. While cryptography is less immediately harmful than some of the things prohibited in this case, the circumstances still seem pretty similar to me; and if these rules were overturned on such grounds, I cannot say I would be all that upset, as such a decision would likely also imply protection for a lot of stuff I like more than this.

That said, when you consider things like Stuxnet, which physically destroyed industrial facilities, I'd say the idea that malware can be a weapon is harder to dismiss these days than in teh past. Admittedly, most zero-day exploits do not have so close an analogy, but in the wrong hands they can certainly help put people in physical danger.

In any case, surveillance is hardly something the 'hacker community' is thrilled about - as per the zeitgeist in this forum, at least...

But Stuxnet harmed nobody and nothing until it was hooked into physical hardware. This is my main point - I can't actually change anything in the real world, unless I am controlling some hardware, but then the situation is the same as if I was operating it directly.

I agree with you that surveillance is unpopular among hackers, but I am old enough to remember when censorship was considered at least as bad I would like it to stay that way.

Yes, we need a war on warez to go with our wars on terror and drugs, which have been rousing successive, having driven both of those social ills to extinction.

The war is on and we are losing. Yesterday a 56 year old bricky from Watford called my in panic. His old XP laptop was literally taken as hostage asking to call some paid phone number to unlock computer back again.

My point, since you missed it, is the instrumenting a "war on warez" in the style of "war on drugs" or "war on terror" is a joke, and should be disregarded as just the talking point of someone with a different idea trying to sell you something.

Reply on news.ycombinator.com