full-disclosure - FrSIRT Puts Exploits up for Sale

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200603171644.k2HGiDfe011727@turing-police.cc.vt.edu>
Date: Fri Mar 17 16:44:35 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: FrSIRT Puts Exploits up for Sale 

On Fri, 17 Mar 2006 08:44:10 +0100, Michal Zalewski said:
> On Fri, 17 Mar 2006 rembrandt@...erlin.de wrote:
> 
> > If you puplish something without a license it is OPEN DOMAIN
> > That means people can use it, modify it, sell it...
> 
> That's nonsense. If I publish a book or a photo or a newspaper article
> without a lengthy license attached, you can copy it at will, too? The
> requirement of a license or a copyright notice is a long-running myth - it
> is good to have these, but they are not a legal requirement.

In most countries that have copyright laws aligned with the Bern Convention,
all works are automatically copyrighted at the time of creation (in the US,
this applies to works created after 1978 - for pre-78, contact a good copyright
lawyer).  However, under US law, failing to attach a proper copyright notice,
and more importantly registering the work with the US Copyright Office, means
that the copyright holder is unable to claim certain damages (basically, you
can't get money from the offender, but you can still get them to stop
infringing).

For the US, the gory details are all in the US Code, Title 17.

However, Michal is correct in that barring an explicit agreement (such as
code that's GPL, or a Creative Commons license, or other such), in most of the
civilized world, anything found online should be assumed to be copyrighted, and
you better hope some variant of "fair use" covers your use of the material.

This is a big legal quagmire that nobody wants to create a test case for - in
fact, in the US, I don't believe any court has yet decisively ruled whether
the act of downloading a webpage from a server (thus creating a locally cached
copy) is covered under "fair use".  17 USC 117 (a)(1) discusses the copy of
a program that's created when loading it into RAM, but it's pretty specific
to "the owner of a computer program" (incidentally, this is problematic in
US states that signed UCITA, as software is considered leased, not sold, so
you're not the owner of the software).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060317/23dcda7e/attachment.bin