full-disclosure - Re: security industry software license

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <60654.1224038046@turing-police.cc.vt.edu>
Date: Tue, 14 Oct 2008 22:34:06 -0400
From: Valdis.Kletnieks@...edu
To: full-disclosure@...ts.grok.org.uk
Subject: Re: security industry software license

On Wed, 15 Oct 2008 00:57:45 BST, n3td3v said:
> half the reason is because they don't need to, there are no laws in
> place to say, *you need to do more*

Please explain the *full* cost-benefit analysis of passing such a law,
taking into account the following:

1) The fact that the Internet is multinational (examine what the US required
for ITAR export control on crytography some years ago, what that export control
was supposed to do, and what happened to it).

2) The fact that "the bad guys" is not a well-defined legal term.  You need to
either go with the "convicted felons may not own handguns" style, or "only
locksmiths are allowed to have lock picking tools" style.  Both are fraught
with legal and technical hazards (How do you verify that the person really *is*
a registered locksmith in Belgrade?)

Estimate the cost per year of:

a) governmental programs needed to implement this
b) the costs to the companies to implement
c) the *actual* cost of not implementing it (remember to allow for the fact
that "the bad guys" will in all likelyhood be able to purloin or otherwise
obtain pirated copies *anyhow*).

Why does society care about doing this?

Or is it just that you can't figure out how to use it, so you don't want
others to have access to it?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/