full-disclosure - AW: Computer Sabotage by Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <DF79BE12AF8DD344B107D0D03621E5750EDA17@kermit.corp.hansenet.com>
From: vogt at hansenet.com (vogt@...senet.com)
Subject: AW: Computer Sabotage by Microsoft

> However, I do think that you CAN sell me a car that only turns left on
> Sundays IF I am stupid enough to READ the contract and SIGN the same -

You sure?

I don't know much about the US legal system, except that from the outside
it looks like you confused mental institution and courthouse, but this
was about Europe anyway, so -

There is a lot of case law for implicit assumptions. When I go to the
supermarket and buy something that for all intends and purposes looks like
something to eat, and there is tiny fine print on the rear that says it's
actually rat poison, you can be sure that the manufacturer is going to
lose the case.

If I buy a car, and somewhere in the manual on p. 78 left bottom corner
it says that the R on the transmission isn't actually for Reverse as in
all other cars, but for Racing, the manufacturer is likewise in a pretty
tight spot.

The thing is that normal people doing normal stuff can (and should be able
to!) rely on normal assumptions.

That, incidently, is why I think the xbox case would be lost. Updates have
become fairly common, and that includes remote updates without confirmation
dialogs. Most current network games do it that way.
I'm not passing judgement on whether that's a good or a bad thing. The
court would probably not do that, either. But it's a _common_ thing, so
it stands to be expected.

You probably would have a much better case with their disabling of boxes
because they think they got hacked. It's clearly denial of service and
there aren't any precedents that I can think of.

Tom