full-disclosure

Open Source and information security mailing list archives

Message-ID: <5341C542.6040400@xorfork.com>
Date: Mon, 07 Apr 2014 00:21:06 +0300
From: Toni Korpela <admin@...fork.com>
To: noloader@...il.com, Henri Salo <henri@...v.fi>
Cc: Full Disclosure List <fulldisclosure@...lists.org>
Subject: Re: [FD] Legality of Open Source Tools

On 04/06/2014 11:54 AM, Jeffrey Walton wrote:
> On Sun, Apr 6, 2014 at 4:24 AM, Henri Salo <henri@...v.fi> wrote:
>> Basic examples, which I have personally encountered:
>>
>> 1) Not allowed to port scan. Some ISPs are already monitoring and warning users
>> in case they do port scanning, but the reason for alerting might only be that
>> they monitor and try to get rid of malware in their networks.
>> 2) Not allowed to list vulnerable systems. I can't for example list all
>> non-updated WordPress installations with their version numbers even this
>> information is available to anyone.
> Item 2 is kind of interesting. Can you cite a reference?
>
> I ask because the US's DMCA has provisions for Security Testing &
> Evaluation and Reverse Engineering. So we are allowed to "test" the
> system (some hand waiving), but its unclear [to me] what can be done
> after the testing.
>
> The ST&E exemption is in Section 1205 (i) SECURITY TESTING. The RE
> exemption is in Section 1205 (f) REVERSE ENGINEERING.
>
> Sorry to wander off-topic...

I did not mention this on my earlier post because it is offtopic,
but as you asked for reference here it is:

The Finnish Criminal Code sections 9 a and 9 b do contain
passwords, access codes or other corresponding information
which can be used to endanger or harm information and
communication systems.

http://www.finlex.fi/fi/laki/kaannokset/1889/en18890039.pdf

The sections are in the translated document on pages 143 and 144.

-Toni

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives