Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Symantec Buys SecurityFocus, among others....
From: full-disclosure () lists netsys com (Blue Boar)
Date: Thu, 18 Jul 2002 17:02:25 -0700

Jay D. Dyson wrote:
      The idea cannot be copyrighted[1], but the code (which includes
the exploit methodology) can be copyrighted with all the cursory terms
and conditions for use.

You can't copyright an algorithm, only an implementation.  You need a 
patent to protect an algorithm.  Good luck patenting buffer overflows.

You can decline to let someone mirror your exploit or advisory verbatim,
but there's nothing you can do to keep someone from reporting about a
vulnerability. 
      Sure you can...especially under the auspices of the DMCA.  Hell,
when you get down to it, all we need is one wild-eyed lawyer[2] on our
side who'll toss a flurry of lawsuits and we'll pretty much have the
corporate security firms by the short-and-curlies.

You think you can stop a news agency from reporting that there is a 
vulnerability in product X, that works like Y and Z?  I think you'll find 
you're mistaken.  I'd love to see it play out, though.

1.  Ideas, names and phrases can be trademarked, however.

Not ideas.  Names, yes.. but that just means someone has to call their 
version of the exploit something different.  And trademarks are expensive 
to obtain and defend.


2.  Maybe one with experience via the Church of Scientology, or the one
    who brought us McDonald's coffee cups that now read "Allow to cool
    before applying to genitals"...

Many people can be intimidated with a lawsuit.  Seems like the groups in 
particular you are concerned about aren't the ones to try threatening with 
lawyers, though.

                                                        BB




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]