Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: how to sell and get a fair price
From: Valdis.Kletnieks () vt edu
Date: Fri, 18 Jan 2013 15:42:13 -0500

On Wed, 16 Jan 2013 10:18:36 +0400, gremlin () gremlin ru said:
On 15-Jan-2013 16:45:30 -0500, Valdis.Kletnieks () vt edu wrote:

Also, what stops a person to file it under a company name if
that's easier? I admit I'm not into this area, so I might be
missing something fundamental...

If you publish an exploit as "BitWizard97", and somebody scarfs
it up and starts selling it,

Starts selling what? Already published exploit? Bwahahaha...

You'd be amazed how many people try that sort of thing.  Consider
that over on the GPL side of the fence, there's more than enough
companies that try to play fast-n-loose with the GPL requirements
that www.gpl-violations.org stays in business.

(Also, keep in mind that there *are* a large number of exploits that
are in limited circulation.  Hacker X releases it to 10 or 15 of
his friends, and then one of his friends turns around and cashes it
in at some corporate, and then said corporate starts selling it as
part of their cyber-defense product.  At that point, Hacker X wants
to get paid (money, fame, credit, whatever)).

filing the suit to enjoin them from selling it without your
permission under a company name doesn't make it any easier
to prove that you, or the company, have any legal standing
to represent BitWizard97.

Digital signatures may help. Actually, you don't need to prove
that you are the BitWizard97 - you only need to prove that you
can act on his behalf (that means: read encrypted messages and
sign the replies with his key).

I believe I mentioned PGP way back at the start of the thread.  Also
helps if you actually PGP-signed your release.

Bonus points for figuring out how to explain digital signatures
to a jury, stripping it down to "up-goer-five" level needed for
the people who can't figure out how to avoid serving on a jury
(see  http://www.xkcd.com/1133/ for the details on that).

It's especially problematic if the local law enforcement
authorities want to have a little chat with BitWizard97
regarding some other activities...

They should want to ask those questions to another person -
say, BitBreaker12, who may be suspected in something illegal.

And why should they ask that other person instead?  You think
if the LEO is interested in a particular person's activities, that
person gets a free pass just because they're involved in an unrelated
court case?  That the cops are just going to say "Wow, he's busy in
court today, let's go hassle somebody who's name hasn't even come up
in this context"?

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]