full-disclosure - Re: how to sell and get a fair price

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <27414.1358541733@turing-police.cc.vt.edu>
Date: Fri, 18 Jan 2013 15:42:13 -0500
From: Valdis.Kletnieks@...edu
To: full-disclosure@...ts.grok.org.uk
Subject: Re: how to sell and get a fair price

On Wed, 16 Jan 2013 10:18:36 +0400, gremlin@...mlin.ru said:
> On 15-Jan-2013 16:45:30 -0500, Valdis.Kletnieks@...edu wrote:

> > > Also, what stops a person to file it under a company name if
> > > that's easier? I admit I'm not into this area, so I might be
> > > missing something fundamental...

> > If you publish an exploit as "BitWizard97", and somebody scarfs
> > it up and starts selling it,

> Starts selling what? Already published exploit? Bwahahaha...

You'd be amazed how many people try that sort of thing.  Consider
that over on the GPL side of the fence, there's more than enough
companies that try to play fast-n-loose with the GPL requirements
that www.gpl-violations.org stays in business.

(Also, keep in mind that there *are* a large number of exploits that
are in limited circulation.  Hacker X releases it to 10 or 15 of
his friends, and then one of his friends turns around and cashes it
in at some corporate, and then said corporate starts selling it as
part of their cyber-defense product.  At that point, Hacker X wants
to get paid (money, fame, credit, whatever)).

> > filing the suit to enjoin them from selling it without your
> > permission under a company name doesn't make it any easier
> > to prove that you, or the company, have any legal standing
> > to represent BitWizard97.

> Digital signatures may help. Actually, you don't need to prove
> that you are the BitWizard97 - you only need to prove that you
> can act on his behalf (that means: read encrypted messages and
> sign the replies with his key).

I believe I mentioned PGP way back at the start of the thread.  Also
helps if you actually PGP-signed your release.

Bonus points for figuring out how to explain digital signatures
to a jury, stripping it down to "up-goer-five" level needed for
the people who can't figure out how to avoid serving on a jury
(see  http://www.xkcd.com/1133/ for the details on that).

> > It's especially problematic if the local law enforcement
> > authorities want to have a little chat with BitWizard97
> > regarding some other activities...

> They should want to ask those questions to another person -
> say, BitBreaker12, who may be suspected in something illegal.

And why should they ask that other person instead?  You think
if the LEO is interested in a particular person's activities, that
person gets a free pass just because they're involved in an unrelated
court case?  That the cops are just going to say "Wow, he's busy in
court today, let's go hassle somebody who's name hasn't even come up
in this context"?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/