News for hackers. Stuff that matters.

A comment on Google Researcher Publishes Windows 10 Zero-Day Security Vulnerability. Parent comment

Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by lawnchair_larry on Thursday June 13, 2019 @11:06AM (#20175574)
How could a bug report be illegal?

If you merely say that you observed a crash in someone else’s software when a certain argument is passed, and that makes you liable for their bug, we are all in big trouble.

[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by leereeves on Thursday June 13, 2019 @12:31PM (#20176435)
This isn't just a bug report; this is more like lockpicking instructions.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by AnaniasAnanas on Thursday June 13, 2019 @09:04PM (#20179874)
Pretty sure that lockpicking instructions are legal. You can find a lot of lockpicking channels on youtube.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Operyl on Thursday June 13, 2019 @02:58PM (#20177656)
I’m sorry, but this isn’t an RCE. It’s a low priority issue.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by lawnchair_larry on Thursday June 13, 2019 @08:57PM (#20179846)
Which could also not possibly be illegal.
[ Parent | on HN ]
Re:Google Researcher Publishes Windows 10 Zero-Day Security ... by Aloraman on Thursday June 13, 2019 @12:41PM (#20176520)
Well, there is a difference. First, that certain argument (malformed certificate) was not randomly encountered, it was specifically constructed to trigger the vulnerability (Was reverse-engineering involved? I don't know). Second, this bug report not only discloses the fact that the vulnerability exists, but also provides a working example for any script-kiddie to use as an exploit. Third, the bug was not privately disclosed to software vendor, but was released to the public. From https://security.stackexchange.com/questions/22973/if-i-find... it seems that would be criminal in UK or Germany, no idea what could've happen in US. On one hand, you have First Amendment, on other hand, there is an EULA.
[ Parent | on HN ]