full-disclosure - Re: new law proposal on EU against hacking tools and practices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F832F57.3090801@propergander.org.uk>
Date: Mon, 09 Apr 2012 19:49:59 +0100
From: Dave <mrx@...pergander.org.uk>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: new law proposal on EU against hacking tools
 and practices

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/04/2012 17:43, Valdis.Kletnieks@...edu wrote:
> On Mon, 09 Apr 2012 12:06:24 -0400, Travis Biehn said:
> 
>> 'Clear purpose for committing any of the offenses' is usually easy to prove.
> 
> Say I'm heading to Munich for a pen-testing gig, complete with a signed contract
> and rules of engagement and a get-out-of-jail-free from their CISO.
> 
> How do you "usually easy to prove" that I have Metasploit "for the clear purpose
> of committing any of the offenses"?  You got evidence of me using Metasploit
> on machines not covered by my contract?  You got e-mails or IM logs or anything
> like that saying I intend to do it?
> 
> (Compare and contrast this to at least one previous draft, where they didn't
> have to show "clear purpose" - mere possession was sufficient.  Consider
> that distinction as it applies to a professional pen-tester....)

Or noobs like me who are not professional pentesters and only hit our own machines/VM's/network devices in the course of self training.

Like having a tool kit in my car doesn't mean I am going prepared to commit burglary.

Innocent until proven guilty has worked quite well in the past.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEVAwUBT4MvV7Ivn8UFHWSmAQKWGQf/Z7NO8mU29NVi5U5Rx0Aixb+ZVv90oAXd
sz9mgbysKKztc/hTGSOAPdEdSML//YMzcIUALBKnDZjsqUWfJQzUoJG0ZAvO+H+k
ck7rpnLB6veFPqVmPKofjD/zf9tPlvveRbX/hBW9uMB/yrxEmd1/8gYonZOfwlST
DUPVu/ut5MaqIoDHsrBExhWhgW0fX7IUTVRuzyeOww1f9v2Kwtaby5XDEUws480Z
Dhp9Tjk13WOOXCge4SjvZXfJ1FpGzDfwHBtD/iJs2x7vdqgGqfF2Oyc2gVfv85tz
T3vACeMS7L2QnIb4vQnk7vrpt3S5mGLqx0OjzZwsODdRjGzPZpCNkQ==
=QcF9
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/