Security research doesn't really have anything to do with Apple's complaint of copyright infringement.

Apple lawyers clearly think it does.

Part of their legal argument is that the tool doesn't have valid uses.

Apple lawyers are expensive and know what they are doing. They think that bringing this up will increase their chances of winning the lawsuit.

Therefore it's perfectly valid to point out that their argument is BS.

> Part of their legal argument is that the tool doesn't have valid uses.

The tool has many valid uses. You’re not going to hear about them from Apple, though.

I think it is entirely naive and optimistic to think that Apple's lawyers aren't perfectly capable of framing things in the best light, even when their goals (or even a subset of them) may be less favorable.

I highly doubt that is there concern, I think it's to paint them as evil. If the case was on should Corellium emulate Apple's hardware that will be simple, but to tack on that Corellium also indirectly enables the bad guys in this age of constant hacks and privacy invasion is an additional burden that Corellium has to bear.

> Why doesn't Apple simply outbid whomever is outbidding them?

It’s quite hard to outbid the black market.

Lol what? Apple is the second richest company in the world by market cap.

For the same reason a host is entitled to prior disclosure of its unfixed vulnerabilities.

Selling vulnerabilities on an open market should be outlawed. Either disclose them publicly for free, or participate in a bounty program by the software owner. People selling undisclosed vulnerabilities should be considered accomplice of people who then use it to break into systems.

We went through this multiple times. The CSS algorithm for DVD encryption was famously litigated and found to be free speech when someone printed it on a t-shirt.

I think there's this weird schism at times where people perform all sorts of convoluted hoop-jumping to decide whether hacking is bad or good depending on their perspective, the target, and a host of other variables that really do not much more than inject subjectivity into debates.

Witness the Apple fans who will have a certain glee at another vendors vulnerabilities and then bemoan attempts to find vulnerabilities in the Apple ecosystem. And, to be quite clear, "Apple" can be replaced with many major ecosystems.

Just the other week people were bemoaning Google's Project Zero for calling out vulnerabilities in iOS. "Not fair, I bet they don't do that for Android, Chrome, they're doing it for market advantage!" - except that Project Zero absolutely _does_ feature Android and Chrome vulnerabilities.

I don't think it is convoluted: either you disclose the vulnerability to the constructor so that they can fix it or you publish it publicly. Selling it without disclosure to someone whose goal is just to exploit it is criminal.

The convolution is in somehow shoehorning the notion of selling a secret into the notion of free speech.

> Google's Project Zero

Do you understand that the projects that aim at improving security are fundamentally different than the ones aiming at exploiting flaws?

The problem is the legal equation isn't that simple, and is subjective by merit of the extent to which it is subjected to persistent arbitration. This just leads to muddied waters and attempts to favorably contextualize the discussion in favor of one actor over the other. Black and white reasoning isn't a luxury afforded those who find themselves entangled in these situations. Some examples:

Does it stand to reason that attempting with purpose to discover exploitable flaws in and of itself makes you a bad actor? ( we've sentenced minors, academics and "white hats" using this argument )

What if someone wrote software that had a legitimate use, but made use of an undisclosed flaw that is then sold to many consumers and reverse engineered, revealing the flaw to larger constituents? What if bad actors merely used a tool out of its original context to exploit a side effect? Does this constitute intent? ( this was tried and the individual in question was jailed )

If an open source project collects money from a bad actor unknowingly and then discloses through a PR or official release the existence of a flaw previously unknown, should they be culpable? ( waiting to see this one play out, hasn't yet, but I have no doubt it will. Was kind of expecting it as a result event-stream.js )

This all just speaks to the concept of subjectivity vs objectivity in the litigation of this concept. The point where it is subjective, rather than objective is the point where it becomes an ethical discussion, and is therefor subject to the principle of fallibility and the human uncertainty principle. tl;dr, if you can't strip motive, investment and bias from the argument, it can't be objective by definition.

I think all your examples would work fairly well with my initial proposal: if you are going to disclose a flaw, either do it publicly or reserve it to the actor who may be able to correct it. Only these two courses of actions would provide a legal shield. Revealing a flaw or an exploit to another actor would engage your responsibility if this actor behaved criminally. I don't know the English legal term, facilitator? Accomplice? That's how we charge people who, for instance, provide otherwise legal help to people they know are terrorists or criminals.

"Does it stand to reason that attempting with purpose to discover exploitable flaws in and of itself makes you a bad actor?"

No. I think a lot of past litigation of such case were really misguided.

"What if someone wrote software that had a legitimate use, but made use of an undisclosed flaw that is then sold to many consumers and reverse engineered, revealing the flaw to larger constituents?"

Illegitimate unless the flaw was previously disclosed in a responsible way to the constructor (which basically means give them time to solve the issue).

"What if bad actors merely used a tool out of its original context to exploit a side effect?"

If the tool had an exploit built-in, the author's responsibility is engaged, not otherwise.

"If an open source project collects money from a bad actor unknowingly and then discloses through a PR or official release the existence of a flaw previously unknown, should they be culpable?"

Of course not, but we live in a stupid enough universe for such a thing to be liable.

>Selling vulnerabilities on an open market should be outlawed

You realise that banning “vulnerabilities” being sold is functionally very similar if not identical to outlawing certain kinds of free speech, right?

No, I don't realize that at all. It may make sense in a country where money is free speech and where companies are people, but outside the US, it makes little sense to say that selling a secret is protected by free speech.

Disclosing one, yes. Selling it secretly do that it can result in exploits, certainly not. Responsible disclosure is a thing. I doubt that people selling credit card numbers and fake identities are protected by free speech.

>outside the US, it makes little sense to say that selling a secret is protected by free speech.

I’m British and I’m fairly sure disclosing a security bug is permitted in the UK.

Also, the court case in question was filed in the USA, so it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.

Disclosing, yes. We are talking about selling.

> it’s reasonable to assume the law in question would be USA law, not, say, the law in Greece.

Yep. And it is totally legitimate to have little sympathy for the case, or to criticize the law that allows this kind of things.

>Disclosing, yes. We are talking about selling.

Journalists and newspaper editors also do not work for free. More importantly, speech in a newspaper is still protected, even if a copy of the newspaper costs money.

What is the functional difference between selling a copy of a newspaper costing a lot of money per issue detailing the exploit and selling the exploit some other way?

Really your arguments make no sense. First security flaws are not secrets. If I put a number in a box in my house and you break in and take it, that is 'stealing' a secret (aka credit card number). But if I make a million boxes with the same number in it and sell them there is no expectation that you will not look inside the box.

Moreso selling "information that you would rather not be public but is not considered a secret legally" is completely legal in the US. There are lots of books published and sold containing information that some company or person would rather keep secret.

>Responsible disclosure is a thing.

Not a legal requirement. More of a gentleman's agreement after companies sent the law after security researchers so researchers sold or released anonymous zero days.

Why? I use market prices for vulns to figure out which platform to use for my personal data. Very useful.

I doubt someone is going waste millions dollar vulns to get access to my lame personal life.

U.S. has very strong free speech protections, codified as First Amendment in the Constitution.

As such it's unlikely that such restrictions would survive a constitutional challenge.

The 1A is about freedom to express any idea or opinion, not about literally publishing or saying whatever you want. Purposeful lying, for instance, is not covered under 1A. Finding bugs for the purpose of selling them to people with malicious intent is malicious itself, and is very likely not covered under 1A. All rights imply a commensurate duty. You don't have freedom of speech for the purposes of harming others.

> Purposeful lying, for instance, is not covered under 1A.

Yes, it is. The restrictions to the first amendment are very tight and very narrow.

> You don't have freedom of speech for the purposes of harming others.

So, that's complicated. You can't incite violence, but you're more than allowed to disparage groups of people.

You can legally sell security bugs, as the NSA buys them all the time.

However, running a platform for the explicit goal of breaking security? Are you copying copyrighted code to achieve this goal? You're on shaky ground there.

Corellium uses its own bootloader IIRC.

> Why is Apple entitled to security research at anything less than the current market rate?

This is not only about Apple. This is also about their customers. You are essentially advocating that people should sell exploits in the black market, legal disclosure be damned.

That is what freedom of speech implies, yes.

There's a strong difference between being in favor of the _right_ of freedom of speech but against specific instances of speech. They are completely different. I'm in favor of their right to go to the black market, but I'm completely against them actually going to the black market.

This reminds me of the “DeCSS” case, where claims were made that a specific number was not allowed to be spoken or transmitted or otherwise shared. ( https://en.m.wikipedia.org/wiki/DeCSS )

Obviously the DeCSS people lost that argument.

Banning someone from saying “by doing X you can bypass security feature Y” is going to be a difficult one to get past the Supreme Court, at least in the USA.

So if they have a right to go to the black market, then Apple has no case. Or rather Corellium might have a case against Apple for tortious interference.

Total freedom of speech would imply that you're allowed to make movies about cartoon mice and publish information about military designs. No country has total freedom.

Substitute “exploit” for “speech about security” and you will see that doing so is explicitly protected under US law.