Google, the Wassenaar arrangement, and vulnerability research

Post by deciplex » Tue, Jul 21, 2015, 7:54 AM UTC

Zigurd wrote: post #10

mmaunder wrote: post #4

A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz) While infosec is currently a smaller sector in startups than say social, casual gaming, apps, etc, it's growing furiously and Wassenaar and individual country regs will be top-of-mind for much of the YC community in the years to follow because many of you will be in this space. I'd like to emphasize one of Google's points: "Global companies sh…

Hacking Team was in the business of selling zero-days to government for the purpose of enabling surveillance. That's what people find objectionable. It's the difference between culturing a microbe to make a vaccine or make a bioweapon. The latter should get your ass droned.

Post by benmmurphy » Tue, Jul 21, 2015, 8:55 AM UTC

caf wrote: post #28

coldcode wrote: post #6

Are these governments completely insane? Not allowing security research or even reporting bugs without getting a license is the stupidest thing I've heard in my lifetime. The internet cannot be regulated in this fashion without destroying it completely. The world is not a collection of islands we are all in this together and letting any government stand in the way of safety and security is insane.

I don't believe this was intentional. Wassenaar is an arms control agreement - the intention was probably to regulate the sales of weaponised exploits, not basic research. It's an overreach.

Post by xmodem » Tue, Jul 21, 2015, 9:15 AM UTC

AnthonyMouse wrote: post #16

comex wrote: post #9

Earlier quoted context omitted.

Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is ins…

There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to…

Post by LunaSea » Tue, Jul 21, 2015, 10:39 AM UTC

mmaunder wrote: post #15

click170 wrote: post #14

Earlier quoted context omitted.

> "Global companies should be able to share information globally." This is an interesting point, and to me it seems to be pitting global companies against individual countries. This makes me feel uneasy because I feel there's a better chance my government is looking out for my best interests than many global companies are. Am I just being paranoid and naive?

That's a really big debate: small vs big government, Keynesian vs Hayekian economics, public vs private sector and so on. I'd say from my side that government and private sector have a role in protecting you. Government tends to excel at things like air traffic control and lighthouses where there isn't much scope for competition and where competition may harm. Private sector tends to do things more efficiently when c…

Post by hga » Tue, Jul 21, 2015, 1:23 PM UTC

comex wrote: post #9

MichaelGG wrote: post #7

>You should never need a license when you report a bug to get it fixed That hampers people that wish to publicly disclose or sell vulnerability information. This is massively biased in favour of software companies (to some extent, like Google). You should never need a license to disclose vulnerability information, full stop. >Global companies should be able to share information globally Why should this be limited to…

Public disclosure apparently won't require a license anyway: > Third, export controls do not apply to any technology or software that is "published" or otherwise made publicly available. http://bis.doc.gov/index.php/policy-guidance/faqs#subcat200 (The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is ins…