On Wed, 16 Jan 2013 10:18:36 +0400, gremlin@xxxxxxxxxx said: > On 15-Jan-2013 16:45:30 -0500, Valdis.Kletnieks@xxxxxx wrote: > > > Also, what stops a person to file it under a company name if > > > that's easier? I admit I'm not into this area, so I might be > > > missing something fundamental... > > If you publish an exploit as "BitWizard97", and somebody scarfs > > it up and starts selling it, > Starts selling what? Already published exploit? Bwahahaha... You'd be amazed how many people try that sort of thing. Consider that over on the GPL side of the fence, there's more than enough companies that try to play fast-n-loose with the GPL requirements that www.gpl-violations.org stays in business. (Also, keep in mind that there *are* a large number of exploits that are in limited circulation. Hacker X releases it to 10 or 15 of his friends, and then one of his friends turns around and cashes it in at some corporate, and then said corporate starts selling it as part of their cyber-defense product. At that point, Hacker X wants to get paid (money, fame, credit, whatever)). > > filing the suit to enjoin them from selling it without your > > permission under a company name doesn't make it any easier > > to prove that you, or the company, have any legal standing > > to represent BitWizard97. > Digital signatures may help. Actually, you don't need to prove > that you are the BitWizard97 - you only need to prove that you > can act on his behalf (that means: read encrypted messages and > sign the replies with his key). I believe I mentioned PGP way back at the start of the thread. Also helps if you actually PGP-signed your release. Bonus points for figuring out how to explain digital signatures to a jury, stripping it down to "up-goer-five" level needed for the people who can't figure out how to avoid serving on a jury (see http://www.xkcd.com/1133/ for the details on that). > > It's especially problematic if the local law enforcement > > authorities want to have a little chat with BitWizard97 > > regarding some other activities... > They should want to ask those questions to another person - > say, BitBreaker12, who may be suspected in something illegal. And why should they ask that other person instead? You think if the LEO is interested in a particular person's activities, that person gets a free pass just because they're involved in an unrelated court case? That the cops are just going to say "Wow, he's busy in court today, let's go hassle somebody who's name hasn't even come up in this context"?
Attachment:
pgpC8ymUstsZc.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/