Security Researchers Wary of Wassenaar Rules 34
msm1267 writes: The Commerce Department's Bureau of Industry and Security today made public its proposal to implement the controversial Wassenaar Arrangement, and computer security specialists are wary of its language and vagaries. For starters, its definition of "intrusion software" that originally was meant to stem the effect of spying software such as FinFisher and Hacking Team, has also apparently snared many penetration testing tools. Also, despite the Commerce Department's insistence that vulnerability research does not fall under Wassenaar, researchers say that's up for interpretation.
Eh? (Score:4, Informative)
How does that first sentence read again? I think someone left out a verb.
Re: Eh? (Score:1)
I think the missing word is 'forgot' or is that a reflection on the reading comprehension of the /. editor? I really cannot tell - I'm still trying to re-read the first sentence and decide...
I think mrs. reagan got this one (Score:1)
Re: (Score:1)
For starters, its definition of "intrusion software" that originally was meant to stem the effect of spying software such as FinFisher and Hacking Team, has also apparently snared many penetration testing tools. Also, despite the Commerce Department's insistence that vulnerability research does not fall under Wassenaar, researchers say that's up for interpretation.
Because nobody wants to piss off military force, that being the NSA because they will be put out of business and they know it. Already to many s
Re: (Score:1)
Surrender them? Why bother. The FBI prefers to just erase them. Take your clubbing and hope you still remember your name. Maybe plan ahead and write down your name and where you are going on a sheet of paper before they helpfully wipe your memories.
Do as we say not as we do. (Score:1)
They can develop and weaponize exploits which means of course how DARE you expose this bullshit illegal activity or harm the reputation of a business by showing that they are FALSE ADVERTISING when saying a product is "secure".
So let me get this straight....
1. They launched actual weapons and were caught (stuxnet, flame, etc)
2. Security researchers have not done this, or they'd be in jail already....
3. A law is written that bans the security researcher from doing his job or sharing his tools, while legalizi
Re:Do as we say not as we do. (Score:4, Interesting)
I don't think that's particularly odd.
Try operating a private military and see how long you get away with that.
Spying and hacking is basically the same: considered to be weaponized and therefore the state monopoly of force applies.
Note, I am not passing a judgement on whether the state monopoly on force is a good thing, only that it is generally accepted.
Re: (Score:1)
Note, I am not passing a judgment on whether the state monopoly on force is a good thing, only that it is generally accepted.
Guns and software are both subject to bugs, operating errors, and bad or wrong usage. However, software by itself can never kill. Thus, the argument of lowering casualties by restricting weapon traffic does not apply to software. All the arguments that inspired the second amendment, instead, do apply. The right to bear software —any software— deserves to be recognized as an auxiliary to the long-established natural right of thinking and watching, auxiliary to the natural and legally defensib
Re: (Score:2)
Obviously, software, even weapons software, does not deliver lead or steel to an opponent directly.
What I think everyone is having trouble with is the fact that software can often make less effective weapons much more effective, or even weaponize information itself.
It would be interesting to have a Second Amendment like set of rights for encryption and hacking. I don't know that I would oppose that, although I'd like someone to do some serious thinking about the consequences of such. Like the actual Secon
How do we submit comments? (Score:2)
Re: (Score:2, Funny)
I believe you should submit comments here : http://www.regulations.gov/?_e... [regulations.gov]
I know I did.
Re: (Score:2)
Interpretation is the point (Score:2)
researchers say that's up for interpretation
What good is a law if it cannot let the government arrest Sandor silence anyone arbitrarily based on the prevailing political winds?
The government says.... (Score:5, Insightful)
The .gov says it won't be used against researchers.... until it is.
Re: (Score:1)
The .gov says it won't be used against researchers.... until it is.
They wont. They will only use it against cyber-terrorists.
If you have pen testing tools and they come after you, you are a cyber-terrorist. If they don't, you are a researcher.
Stupid (Score:4, Insightful)
This means if your laptop has nmap, burp suite, metasploit, or Ida pro etc. and you visit China with it .. you could be arrested when you come back. How freaking stupid is that? Also, a lot of times it's hard to draw the line between debugging tools and penetration testing tools.
Re: (Score:3)
“Vulnerability research is not controlled nor would the technology related to choosing, finding, targeting, studying and testing a vulnerability be controlled,” said Randy Wheeler, director of the BIS, today during a conference call. “The development, testing, evaluating and productizing of an exploit or intrusion software, or of course the development of zero-day exploits for sale, is controlled.”
After reading that several times, I'm still not sure what is allowed and what is not.
Re: (Score:2)
This means if your laptop has nmap, burp suite, metasploit, or Ida pro etc. and you visit China with it .. you could be arrested when you come back. How freaking stupid is that?
Visiting China with such tools on your laptop? Pretty stupid, unless you're going there to spend a lot of money.
Re: (Score:2)
You probably can't even list the apps installed on your laptop, let alone want to uninstall and reinstall them later. You're not 'pretty stupid' for that, its normal.
Uh, what? I most certainly can list the apps installed on my laptop, in a variety of ways. What kind of moron are you that you can't?
In Practice (Score:2)
Dual use nature of sticks and stones (Score:3)
This document appears to be a comprehensive list of all the technology in the world worth using.