bugtraq - RE: Symantec wants to criminalize security info sharing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 11 Sep 2003 12:00:51 -0700
From: "Thor Larholm" <thor@...x.com>
To: "BUGTRAQ@...URITYFOCUS. COM" <BUGTRAQ@...urityfocus.com>
Cc: "Richard M. Smith" <rms@...puterbytesman.com>
Subject: RE: Symantec wants to criminalize security info sharing

I sincerely hope this is a gross misquote.

You can't have any kind of research, whether it's security research
online or academic research offline of any kind, without the very likely
potential of bad guys having access to the same information and papers
you release. Following through on this would be equal to outlawing any
kind of university research that could be used by 'bad guys', whatever
form those might currently be - in effect, shutting down any kind of
research.

It's a slippery slope leading to chaos, and I doubt John Schwarz realize
the implications of his suggestion. This would effectively outlaw the
entire private security industry and leave it in the buraucratically
impaired hands of the exempted government to secure any kind of american
software.

I guess a few of the big players, such as Symantec, could be gradually
incorporated in those governmental efforts, at the sacrifize of
independent research.

This would undermine and endanger software security more than any effort
displayed so far by the 'bad guys'. On the positive side, it would at
least weaken the monopoly of Microsoft severely by forcing the rest of
the world to no longer use american software due to its inherent
insecurities caused by a lack of independent security research.

I doubt most of us realize he implications already caused by having
those suggestions raised at a House Committee, not too many steps away
from becoming part of new proposals.

You should never let your fear outconquer your logic, it will only
produce well intended but damaging results.

Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher

-----Original Message-----
From: Richard M. Smith [mailto:rms@...puterbytesman.com] 
Sent: Thursday, September 11, 2003 6:47 AM
To: BUGTRAQ@...URITYFOCUS. COM
Subject: Symantec wants to criminalize security info sharing

Hi,

Here's an interesting quote from John Schwarz, the COO of Symantec, in a
Wired.com article from today:

   Just Say No to Viruses and Worms
   http://www.wired.com/news/infostructure/0,1377,60391,00.html

   "But perhaps the most controversial suggestion came 
   from John Schwarz, president and COO of antivirus 
   firm Symantec, who called for legislation to criminalize 
   the sharing of information and tools online that can be 
   used by malicious hackers and virus writers." 

As we all know, when it comes to discussing information about computer
security vulnerabilities, it is difficult to separate security uses of
this information and hacking uses of the same information.

For example, if Symantec were to get this law passed, are they prepared
to see their employees who work on the Bugtraq email list go to jail?
;-)

Richard M. Smith
http://www.ComputerBytesMan.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html