Analysis Of Symantec's Stance On Censorship

robochan writes "According to this report in the Sydney Morning Herald, Chief Operating Officer of Symantec, John Schwarz, was quoted as 'calling for laws to make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers.' This article takes a look at the negative affects and also a couple of recent examples of "censorship legislation" backed by the COO of Symantec, and what little effect it has had on criminals, while having a substantial affect on responsible citizens."

Comments

It's obviously anti-First Amendment

[Dancin_Santa]

But maybe it's time to rethink this portion of Speech.

Speech is not 100% protected. There are types of speech which have been declared illegal: obscenity, fighting words, etc. Perhaps it is time to take the fight to virus writers.

Re:It's obviously anti-First Amendment

[Leffe]

Isn't it more like this:

You can say whatever you want, but what happens afterwards is another thing.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

yes, it is. so people can release whatever they want but if somebody takes your example exploit code and writes a virus with it that causes damage across the world you should be hunted down and jailed just like the person that turned your code into an active virus.

Re:It's obviously anti-First Amendment

[sweetooth]

The tools and processes of discovering and disclosing exploits shouldn't be illegal. The use of them should, and is. Why should we add regulation on top of that to prevent this type of "speech?" You should be punished for doing something wrong, not for creating something that someone else might use with ill intent?

Re:It's obviously anti-First Amendment

[Frymaster]

no, it's more like this:

the article states that they want to criminalize "shar[ing] information and tools online which could be used by malicious hackers and virus writers".

tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?

this is like that crime in britain: "going equipped to commit arson". ie, having a lighter in yr pocket. it's all about selective enforcement. ie, the law is interpreted by the police officer.

now, extrapolate this situation to something like, say, computing - something that joe average judge-or-cop knows virtually nothing about.

am i the only person who can see this being a bad bad thing?

Re:It's obviously anti-First Amendment

[Free_Meson]

um... no. I could write a full set of instructions detailing how to go from uranium ore to a working plutonium-based fissile nuclear weapon and be within my rights. moreover, if someone takes what I wrote and uses it to blow up Las Vegas, I will not be jailed or prosecuted for anything connected with that crime. I may be liable in a civil court for any actions directly facilitated by my speech, but my actions would be in no way illegal. Why should it be any different with computers?

Re:It's obviously anti-First Amendment

[Anonymous Coward]

ahh! and thats where you miss the point! writing instructions on creating a nuclear weapon isnt the same as example exploit code. example expoit code = giving away the plutonium and that would be illegal.

Re:It's obviously anti-First Amendment

[cujo_1111]

But is it still illegal if you were to build an example nuclear weapon using lead instead of plutonium? Who is to blame if the example is taken and the lead replaced with plutonium?

I see a big fat legal grey line here...

Re:It's obviously anti-First Amendment

[TiggsPanther]

tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?

Or, to take it to an extreme, Notepad/vi/emacs.

After all, the most basic tool required for writing a virus (or any piece of code) is your bog-standard Text Editor.

Re:It's obviously anti-First Amendment

[Free_Meson]

But is it still illegal if you were to build an example nuclear weapon using lead instead of plutonium? Who is to blame if the example is taken and the lead replaced with plutonium?

I see a big fat legal grey line here...

No grey line. If someone steals my gun and kills someone with it, i'm not responsible. If I build a nuclear weapon and use plutonium and whatnot and set it up so that a single button has to be pressed to set it off, and someone steals it, takes it to Las Vegas, and sets it off, then I am guilty of no crime (well, the posession of a fissionable mass of plutonium is illegal, IIRC, but that's another matter entirely). That doesn't mean i can't be sued, but there's nothing illegal there. You may think it SHOULD be otherwise. I disagree with that notion and, for the moment, the law errs widely on the side of personal freedom.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

I don't know what kind of tool you're using to connect to Slashdot right now, but I'm certain that it could be used by hackers and virus writers for ill. The sooner an officer of the law arrests you, the sooner you'll discover what an absolutely idiotic law that is. No more operating system manuals or access to Linux source code either.

Re:It's obviously anti-First Amendment

[Free_Meson]

example expoit code = giving away the plutonium and that would be illegal Hm... i'm not sure whether giving away plutonium would be illegal. Rather, it's not legal to own in the first place, so i doubt giving it away would get you in more trouble than having it in the first place.

Anyway, code is merely instructions. the end user would still need equipment which you do not provide and even if you provide a full uncompiled virus, would require several malicious acts to take it from instructions to a weapon. I mean you almost certainly have the materials necessary to manufacture a musket in your house, and if I told you how to do it, and you did it, and killed someone, then it's you who gets to wear stripes... Me, I may be liable, but i'm not criminally responsible, and I shouldn't be. you can't make information illegal without changing the constitution and code, while it can be quickly turned into an executable which is arguably a thing rather than information, code is still just information.

Re:It's obviously anti-First Amendment

[cujo_1111]

Don't forget punch card readers for all the old-school people around here!

Re:It's obviously anti-First Amendment

[Anonymous Coward]

I'd like to see someone make a punchcard virus that can mutate and spread.

no really i would

Re:It's obviously anti-First Amendment

[Anonymous Coward]

Hey, thats what I was going to say, the exact same tools used in creating good software applicaitons such as for creating & editing graphcis, text files and any other nice piece of software, can also be used for making virus' trojans & worms...

this is no different than a firearm, it can be used for good such as hunting, law enforcement, target & sport shooting, of used for bad things such as robbery & murder...

it just all depends on whos hands the tools is in...

Re:It's obviously anti-First Amendment

[Temsi]

That's absolutely incorrect.

Freedom of speech is absolute. No exceptions.

Obscenity is not illegal, but you can be held accountable for any harm it may cause others (including mental anguish). The FCC has obscenity guidelines for the public airwaves that TV and Radio stations must follow. The on-air personalities can say whatever they want, and their words are not illegal. The FCC can however mandate that the corporations using the public airwaves do not broadcast obscenities, and that they either bleep them or silence them, at the risk of being fined (stipulations of using the public airwaves for free).

Fighting words are not illegal either, but you could get in trouble if you incite violence, which IS illegal.

Yelling "FIRE!" in a crowded theatre is actually not illegal either, but you will most definitely get in trouble for endangering the public if you do it.

There is a distinction here you have to make.
Words by themselves are not and cannot be illegal, nor can the usage of those words be deemed illegal. The first amendment garantees that.
The results of what happens because you spoke your words of choice, however, CAN be held against you.
If you say in a public place "I wish he were dead" (about anyone) you have the right to do so.
However, if you were to say "Go kill this guy", and someone who heard you went out and did just that because of what you said, then you would absolutely be held accountable for saying it.

Anything you say is legal, regardless of content.
The consequences of what you say is another matter entirely.

Fighting virus writers by banning the words they write is absurd and stupid. It is a slippery slope we do not want to enter. It sets a dangerous precedent that can and will be abused. If you ban one use of language, it's very easy to ban another. Next we'll be banning negative movie reviews because they can hurt the movie's business and thus must be banned. Or perhaps we'll start calling people traitors if they criticize the President. Oh, wait, Ann Coulter already is doing that. But of course she has the right to say that too...

Re:It's obviously anti-First Amendment

[tius]

Not to mention that it's like outlawing screwdrivers which have a vast number of legitimate uses, but can be used to pry something open.

So, what falls into this category for S/W? All computer languages, I/O specs (that should be fun, have all the semiconductor manufacturers to pull specs from the web), editors (bvi is very handy tool for legitimate uses)...what else?

Crikey, why don't we just do a "permissive" law; i.e. you are allowed, heck, required to consume without questioning, or doing anything with an item other than it's explicitly stated use and license...and yes, you pay the lawyer fees to interpret the license...

Re:It's obviously anti-First Amendment

[Anonymous Coward]

I agree that Symantec's idea is bad. What that person advocates goes way too far and would hurt legitimate security research. These things need to be discussed among the people who will fix them, and those people shouldn't worry that they are breaking the law.

On the other hand, I think something should be done to curb the childish desire to be first to figure out how to exploit a flaw and publicize it all over script kiddiedom. Currently, people wait until the exact moment a vulnerability is patched by the vendor to announce the flaw and publish full, detailed information about what the flaw is and how to exploit it. By waiting for the patch, they believe they are being responsible and ethical, which IMHO is rubbish.

I have a popular security site which has a message board. That message board was hacked one night at about 4am. The hacker used an exploit for a flaw that had been published 30 minutes earlier on a mailing list similar to bugtraq. The mailing went out within 5 minutes of the message board software's vendor putting a patch on their server.

The hacker read the exploit instructions conveniently mailed to him, googled for "yabbse 1.3" and went looking for white supremacist message boards to trash. Since my site has nothing to with white supremacy, all he did to me was email my MySQL password and tell me about the flaw and warned me to patch before some Brazilian skiddie 0wned me.

That was irresponsible to the point of criminal and civil liability on the part of the jackass who released that exploit tutorial in the middle of the night when no one had heard of this flaw or patch, much less fixed it. If I had lost anything of value in that break in, you can damned well bet I would have sued that stupid SOB.

Why the desire to release exploit code immediately instead of waiting 30 days for people to hear of the patch? Does a person's 1337ness points go up or something? Are they trolling for work at a security company? Or are they hoping for visitors to their commercial security web site advertising their services?

If the company is dragging its feet on fixing their flaw, then hold disclosure over its head. However, how is that a threat if they know the flaw is going to be exposed in full the moment they release their patch anyway? For christ's sake, give people some time to install the patch(es) before telling every script kiddie on Earth exactly how to use the flaw.

Re:It's obviously anti-First Amendment

[freeweed]

Freedom of speech is absolute. No exceptions.

Nope. Freedom of EXPRESSION is. Freedom of speech is far from absolute, and you listed many examples why.

Subtle difference, but there are many things that you can face charges for saying. Libel, Slander, the list goes on and on. But no one can arrest you for expressing an opinion.

Re:It's obviously anti-First Amendment

[LittleGuy]

I'd like to see someone make a punchcard virus that can mutate and spread.

Someone with the flu sneezing on a tapestry made with a Jacquard Loom.

Re:It's obviously anti-First Amendment

[andrew_0812]

I guess if this gets passed, the next step would be that you had to be licensed to own a compiler, and it's use would have to be monitored and logged. Land of the Free.

Re:It's obviously anti-First Amendment

[gr8_phk]

"Yelling "FIRE!" in a crowded theatre is actually not illegal either, but you will most definitely get in trouble for endangering the public if you do it.
If I yell fire and people get hurt by a crowd running for the exit, I will likely get in trouble (sued by the injured). If nothing happens, nothing will happen to me. I suppose there is the chance for a charge of "attempted something". Most important to note is that this discussion we are having right now (about yelling "fire") is not illegal. It's the difference between talking about it and doing it that matters here.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

But no one can arrest you for expressing an opinion.

Are you sure about that?

Suppose this is the (hypothetical) opinion expressed:

In my opinion, so-and-so deserves to die.

It may be an opinion, but it might be interpreted as inciting violence, especially if someone kills so-and-so after such a statement. Consider if the statement is made by the KKK about a black man or by a pro-life agitator about a doctor who performs abortions?

I don't think it's safe to assume that opinions enjoy some sort of blanket protection that other speech does not, although it's probably held to a lower standard in general...

Re:It's obviously anti-First Amendment

[drakaan]

Why the desire to release exploit code immediately instead of waiting 30 days for people to hear of the patch? Does a person's 1337ness points go up or something? Are they trolling for work at a security company? Or are they hoping for visitors to their commercial security web site advertising their services?

Here's a hint. Ever see how many slashdotters try to get firstus-postus?

Re:It's obviously anti-First Amendment

[geronimo87]

Actually, I believe this is a questin of prior restraint on speech. Libel, slander, etc, may be actionable (in civil, not criminal, court), but there is no mechanismfor teh Government to stop it from being published. At least, not yet.

Re:It's obviously anti-First Amendment

[ATMAvatar]

tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?

Outlook Express

Re:It's obviously anti-First Amendment

[bigpat]

tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?

Or, to take it to an extreme, Notepad/vi/emacs.

No, take it to the logical ironic extreme, Norton AntiVirus 2004 is the best way to QA your virus to make sure it will get by anti-virus software. So, really we need to make sure that virus writers don't get access to such a powerful debugging tools. We obviously need to ban anti-virus software in in order to stop viruses from being written.

Sometimes the simple solutions are the most effective.

Re:It's obviously anti-First Amendment

[kdsolutions]

How many of you have downloaded a compiler or interpreter of any kind? Or documentation for a scripting language? Or an HTML editor?

Does this mean that MS could be put out of commission for providing such things as:
Notepad
Windows Scripting Support
BATCH scripting
ActiveX
Visual BASIC
Visual BASIC for Applications
Office Macros
Visual C++
In fact, almost everything they create! You can download alot of it, as well - or at least documentation for it, which could be used by malicious hackers and virus writers!

In fact, I'm sure a malicious hacker or virus writer is capable of using any program or any material available on the web. Does this mean that everything has to come down?

Re:It's obviously anti-First Amendment

[Anonymous Coward]

> Freedom of speech is absolute. No exceptions.

In the U.S. this is not at all true. There are established (case law) standards for the government setting restrictions on speech. The standards are less strict if it is commercial speech being restricted.

I don't have a good reference URL handy -- perhaps someone could contribute one ?

Here is a site purporting to address "time, place, and manner restrictions", which is one aspect of the matter:

http://www1.law.ucla.edu/~volokh/harass/substanc .h tm#TPM

Here is a very brief article mentioning the distinction between content-based and content-neutral restrictions:

http://www.ssrn.com/update/lsn/cyberspace/lesson s/ fresp06.html

Re:It's obviously anti-First Amendment

[jarran]

this is like that crime in britain: "going equipped to commit arson". ie, having a lighter in yr pocket.it's all about selective enforcement. ie, the law is interpreted by the police officer.

It's not all about selective enforcement, it's about intent. A UK court couldn't convict someone in this situation of "going equipped" unless they could convince a jury beyound reasonable doubt that the person intended to use that lighter for arson. With a lighter, this is obviously impossible, as you could come up with a million reasonable excuses for carrying a lighter.

If you were arrested on suspicion of going equipped, and the only evidence against you was a lighter, you could have very good grounds to sue for wrongful arrest, as carrying a lighter is clearly not evidence of intention to commit arson.

On the other hand, imagine the police catch a kid going into a school in the middle of the night carrying matches, large amounts of petrol and some molotov cocktails. Imagine further that the person could give no reasonable explanation for why they were taking those items into a school. Here a jury would be much more likely to convict, as a good prosecution might convince them that it was that kids intention to burn down the school. Without the "going equipped" offence, there would be no case to answer, as no actual arson had been committed. The argument in favour of this is that you shouldn't get away with something bad which you had every intention of doing just because the authorities managed to stop you doing it.

Note, I'm not really defending this law. In fact I disagree with it and a few other similar laws we have (e.g. we also have "going equipped to cause criminal damage"). I'm just pointing out that your interpretation is incorrect.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

"Or, to take it to an extreme, Notepad/vi/emacs. "

Bread, butter, peanuts, water, toiletpaper...

Re:It's obviously anti-First Amendment

[Anonymous Coward]

It still violates the 1st Amendment.

Re:It's obviously anti-First Amendment

[Peyna]

However it still leaves everything up to the discretion of the officer. Such a statement is very easily unconstitutionally vague. Just because we would expect that people would see the difference it is far too easily open for abuse. Governments often try to pass such laws with good intentions, but instead end up adding some stupid words or phrases that make it so that anyone could easily be arrested under the law.

As it is written such a law is very troublesome. It could very easily be rewritten though to be more clear. In the instance of what is mentioned in this article, if the law would be stated in such a way so that only those who would be using such tools for unlawful purposes would be arrested and convicted, then it would work.

Of course, it's kind of a silly law anyway. Sort of like when Chicago made it illegal to loiter in the presence of gang members. Good intents, poorly written law. Hence it was declared unconstitutional after a few years.

Re:It's obviously anti-First Amendment

[drakaan]

Do you even understand why I responded?

DAMN!!!

Trolled.

By an AC.

AGAIN!

Re:It's obviously anti-First Amendment

[Anonymous Coward]

we are heading toward the legal requirement that only licensed professionals who are registered in some sort of legally controlled society will be able to access code, tools and only on a need to know basis. No more just paying the cash or downloading freeware. In fact soon it will be a felony to distribute freeware, any kind of freeware. The wild west days of just anybody being able to write code will be gone. Only 'TRUSTED PROGRAMMING PROFESSIONALS" with a legal local state licence will be allowed to code. Anybody else will be out of business or in jail for doing so. Later on underground coders will be declared enemies of the state and their coding acts, acts of terrorism.

Re:It's obviously anti-First Amendment

[hesiod]

> Outlook Express

Nah, Outlook (ex) is a disease carrier, not a creator.

Re:It's obviously anti-First Amendment

[Temsi]

"there is no mechanism for the Government to stop it from being published. At least, not yet."

It would require nothing less than the reversal of the First Amendment in order to do that.

Re:It's obviously anti-First Amendment

[Temsi]

As I said before...
The government CANNOT stop you from saying whatever the hell you want to.
However, and I repeated this more than once in my original reply: You can be held accountable for the consequences of what you say.

If you tell a known bad guy "can you get this guy to understand my point?" you can be held accountable if that known bad guy then goes and kicks the shit out of the him. It doesn't make what you said illegal. It makes your actions illegal, you just happened to use words.

Again, I said this several times before... the distinction is between what you say, and what happens because of it.

Re:It's obviously anti-First Amendment

[Temsi]

"Nope. Freedom of EXPRESSION is. Freedom of speech is far from absolute, and you listed many examples why."

Speech is a form of expression, so what's your point?

Freedom if speech IS absolute. It's the consequences of it that may not be. As I said numerous times before.

The examples I listed, are examples of why the repercussions of your speech (or writing) can be used against you, but you still have the right to say or write it, and the government does not have the right to tell you not to do it.

So, you see, you're completely missing/ignoring my point.

Libel and slander are also protected by the first amendment, meaning the government does not and can not pursue cases of libel and slander.
These are always civil cases, not criminal. Please make a distinction between those two.
There are three main criteria you have to prove in order to win a libel or slander case:
A) the statement must not be true,
B) a reasonable person could believe it to be true, and
C) there must have been malicious intent.

The last two are extremely difficult to prove, which is why you see so few cases like that. Why do you think a tabloid like The Globe is still in business? Because no reasonable person would believe their crap, and you can't prove malicious intent on their behalf. So, they can publish all the lies they want about anyone they want, without being held responsible for it.

Re:It's obviously anti-First Amendment

[jarran]

I'm not sure if your comments are in response to my comments on going equipped to cause arson, or to the main Slashdot article. Assuming you are replying to me...

Sadly this law is not unconsitutional, as we in the UK don't have the benefit of a proper constitution.

I do broadly agree with your comments, it is a poor law, but it is pretty far down the list of UK laws which concern me. I guess this is because I am not aware of any examples of it being misused.

On the other hand, the Terrorism Act 2000 is being routinely abused by the police in the UK to detain, intimidate and otherwise interfere with people engaging in legitemate, peaceful protest.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

so are you telling me that if you built a nuke with a single det button and left it on the front porch for anyone to take and they did just that and killed thousands of people with it you would feel no guilt? this is like giving away guns to kids, criminals, anyone who wants them and then claiming no responsibility for the people that get shot with them. for the same reason we have rules on buying guns we shouldnt just give out exploit code to anyone with an internet connection to download it.

Re:It's obviously anti-First Amendment

[neonprimetime]

the legal system is so messed up it's frustrating...

Re:It's obviously anti-First Amendment

[Skjellifetti]

The government CANNOT stop you from saying whatever the hell you want to.

Sure they can. They do it all the time. There are many examples of governments that kill their own citizens when they say something the government doesn't like. That shuts up most people.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

Forgive me if I'm wrong but "laws to make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers" is just a little vague - using that description, wouldn't gcc be illegal because it *could be used* to compile malicious hacking tools and/or viruses? Would text editors also be illegal to share, because they can be used to write the virus/hacker tool's source code? Hell let's make operating systems illegal - hacking tools and viruses need to use an operating system to run on.

Re:It's obviously anti-First Amendment

[Anonymous Coward]

What are you talking about "if somebody steals my gun". This example exploit code is giving out the guns for free! It would be different if somebody stole the example exploit code from somebody, but if theyre just giving it out for anyone to download then fry em.

Well I for one..

[Narphorium]

do not welcome our censorship promoting Symantec overloards.

Re:Well I for one..

[OverlordQ]

Well I, for one, welcome our new Websters Dictionary Overlords

Re:Well I for one..

[Anonymous Coward]

Re:Well I for one.. (Score:1) by OverlordQ (264228)

Well, you would, wouldn't you?

In other words

[Leffe]

GCC has been made illegal.

Re:In other words

[Anonymous Coward]

GCC has been made illegal.

You mean GNU/GCC

Re:In other words

[Anonymous Coward]

No, I mean Gnu's Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Compiler Collection

Re:In other words

[tuba_dude]

Shouldn't it be something like "Gnu's Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not Unix Not UnixSTACK OVERFLOW ERROR" Compiler Collection?

Re:In other words

[SpaceLifeForm]

It's *NOT* funny. When compilers are outlawed, only outlaws will have compilers.

Re:In other words

[Anonymous Coward]

I know, I only posted this horribly reused joke to harvest some karma to make sure that no one else gets it. With my +5 moderation(just +4 and an extra +1 on my account?) I made sure that at least one good post did not get it's karma. Maybe even two.

Of course, you don't get karma from 'Funny' posts, that sucks. With that kind of thinking you should not lose karma from un-Funny posts, a.k.a. 'Trolls'.

Oh, and you, sir, are a humble fag gay homosapien!1
(Troll-+6-insurance)

Re:In other words

[Kinlan]

I would have thought MS Office would have to be made illegal!!

Re:In other words

[adrianbaugh]

I don't see why this gets +5, Funny. It should be +5, Insightful. Or possibly -1, Redundant, as RMS has been warning about exactly this danger [gnu.org] since the dawn of time. (Sorry, the link isn't precise but it's in there somewhere..)

Re:In other words

[Anonymous Coward]

If we are lucky, so will Windows. :)

Re:In other words

[Anonymous Coward]

Thanks be to whatever deity floats your boat!
Now maybe we can finally get a decent compiler that isn't extreme bloatware(And that's not even taking the libs into account....)

Informtion and tools

[BorgDrone]

information and tools online which could be used by malicious hackers and virus writers

So that would include:

• Compilers
• API documentation
• Text editors (can be used to write VBScript virii)
• Microsoft Office (macro virii)

Sounds like a really well thought out idea.

Re:Informtion and tools

[R.Caley]

Well, as formulated it would also ban Windows, computers in general, coffee, oxygen...

Re:Informtion and tools

[KronicD]

Personally i beleive that soon enough the use of computers will be outlawed unless you have a specific reason for using them. This is pure speculation buy they could be replaced by severly crippled and purpose specific replacelemts, eg the smartphone, console gaming system, and a stripped down system to write letters and such.

the days of general purpose hardware are numbered.

Re:Informtion and tools

[jc42]

information and tools online which could be used by malicious hackers and virus writers

Obviously this also includes things like:

i = 1;

This could very well be a part of all sorts of malicious code, so teaching someone to use it would be helping them become evil hackers.

Hmmm ... Maybe I shouldn't post this. It could be used against me in court some day ...

Re:Informtion and tools

[Storm]

This is like banning language because someone could use it to yell "Fire!" in a crowded movie theater. Ludicrous.

A clarification

[Chairboy]

An important clarification from an article on this subject a few days ago:

http://www.smh.com.au/articles/2003/09/12/106326 85 53158.html

Asked whether Schwarz would like to clarify whether he had really meant that full disclosure should be legislated against, Symantec's Asia-Pacific public relations group manager Lindy Yarnold did not directly deal with the query but said: "Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks."

Re:A clarification

[_Sprocket_]

There was also a post to the Bugtraq list on this subject from Alfred Huger (Senior Director Engineering, Symantec Security Response). The post states that the quote in question is a misquote. And it claims:

Symantec fully supports information sharing on
threats and vulnerabilities and believes it is an important tool for
consumers and IT professionals to gain a measure of early warning of
potential attacks.

Which is nice. Except I had just happened to stumble on this whole proceeding on CSPAN the week before. I was kind of half-listening to the proceedings until I heard the Symantec chief mention, almost as an aside, that future laws should include the sharing of information and tools. That got my attention. And the Wired article rings true with my reaction to what I saw and heard.

Now - its possible that both I and the Wired reporter didn't hear what we throught we heard. So I've been looking for a transcript or recording of the hearings on an infrequent basis. So far, no luck. Does any body have any suggestions on where we can dig up Schwarz's exact words?

motive

[benna]

I don't even understand why he would want this. Its in his companies interest to have worms and viruses going aroudn because if there weren't any, nobody would need antivirus software.

Re:motive

[richie2000]

Its in his companies interest to have worms and viruses going aroudn

Yes, but he doesn't want people to be able to clean them up themselves. Hence, he wants to limit the free dissemination of information to all, knowing full well that the black hats does not rely on official security bulletins to plot their next move.

Re:motive

[Grishnakh]

As others have noted, what Symantec really wants is to prevent people from cleaning up the worms and viruses without paying Symantec a fee.

But if the number of viruses and worms goes down, I'm sure Symantec would be happy to write a few more to keep their profits up.

Re:motive

[FCKGW]

Black hats are going to share info, legal or not, so viruses and worms will still spread regardless of whatever gets passed into law. It will only stop white hats from sharing info, so the only source to get rid of an infection or get a patch or workaround is Symantec.

No, idiot

[Anonymous Coward]

It would make things like "Build your own virus" kits illegal. It's how the majority of virus writers formulate their viruses. They sure as hell couldn't write their own code.

Re:No, idiot

[orthogonal]

It would make things like "Build your own virus" kits illegal. It's how the majority of virus writers formulate their viruses. They sure as hell couldn't write their own code.

Well, you're quite right. It would make virus building kits illegal.

But Schwarz also wants "to make it a criminal offense to share information". This means that indentifying a security vulnerability could also be prosecuted.

Now, Symantec won't be prosecuted, because they'll keep vulnerability information close to their corporate chest, as "proprietary trade secrets"; they don't benefit from revealing the information. And they'll make sure to make the right bi-partisan contributions, so everybody will know they are good upstanding citizens.

But if you, or I, or Willie White-Hat Hacker publicizes the information, we'll be facing one of Mr. Ashcroft's boys. One of his prosecuters with the unlimited budget, the Federal warrant, and the granite-faced gentlemen who are paid to carry guns.

That this just happens to scare off any upstart competitor to Symantec and MacAfee's control of their market, is, I'm sure, a purely unintended consequence of the fight against terrorism and the terrible threat to our nation of a haxored box adding a few hundred more spam emails to the torrent already flowing in from China.

Re:No, idiot

[Anonymous Coward]

Disclosure: Yes, I am biased. I work for Symantec.

However,

In both articles, Wired's and the follow-up the only direct quote was:

'Symantec's Asia-Pacific public relations group manager Lindy Yarnold did not directly deal with the query but said: "Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks."'

They never gave a Schwartz's quote. Given that a underling would never publically disagree with her boss I have a feeling this has been blown out of context.

Speaking as an insider I can tell you that sharing of information has the highest of priorities. Espcially training for Symantec customers from NEs to end users.

Re:No, idiot

[0x0d0a]

Regardless of whether Schwartz said so or not, the point is that Symantic has lots of people who aren't idiots. It's unlikely that the company will follow the path that Schwartz has been claimed to have been pushing.

Re:No, idiot

[aminorex]

The intelligence of a corporation can be computed
by adding the individual IQs of its officers
and dividing by the number of employees.

Re:No, idiot

[Anonymous Coward]

Symantec owns Security Focus & BugTraq - so wouldnt they be in violation of the law themselves ?

Re:No, idiot

[raju1kabir]

That this just happens to scare off any upstart competitor to Symantec and MacAfee's control of their market, is, I'm sure, a purely unintended consequence of the fight against terrorism and the terrible threat to our nation of a haxored box adding a few hundred more spam emails to the torrent already flowing in from China.

You're right on the nose here (I entered this article to post what you've already said, so since I've already gone through the trouble, I'm offering a me-too).

This is purely an anti-competitive effort. They want to clamp down on open-source competition by making public collaboration on these issues illegal.

They have no interest in stopping the development of viruses, because without those, they lose their income stream.

This is transparent as glass. It's a craven and manipulative appeal to public fear, aimed at getting themselves legislated into a near-monopoly.

Smokin' Crack

[sssmashy]

In conclusion, whether or not Symantec's COO is just smokin' crack or understands what is at risk, any attempt to censor these critical security tools, including exploit code, from the Internet will result in a constitutional travesty followed by a significant market downturn, a degraded security community, and the commercialization of vulnerabilities where the market is driven by the criminals we are trying to "stop".

Re:Smokin' Crack

[sssmashy]

Just wanted to say that this is the longest run-on sentence I've ever read that includes the words "smokin' crack".

Re:Smokin' Crack

[marko123]

If, as stated in your previous post that obviously didn't quite contain all the information you wanted to include in it, the quote you used was the longest ever run-on sentence that included 'smokin crack', I believe you are in for a pleasant surprise, not unlike the surprise you receive the very first time you are smokin crack, except for the fact that you do not own a time machine, and could not have foreseen this monstrosity.

Re:Smokin' Crack

[MoralHazard]

I've got $10 that says the phrase "smoking crack" becomes the root of the Next Overused Slashdot Phrase. Anybody want to take me up on this? Anybody?

Re:Smokin' Crack

[Anonymous Coward]

"smoking crack" rhymes with "invade Iraq"

Coincidence? I think not.

Re:Smokin' Crack

[Anonymous Coward]

I, for one, welcome our new Smoking Crack Overloards!

Re:Smokin' Crack

[corbettw]

Man, you have got to be smokin' crack if you think that!

So Symtantec's anti-virus software will be illegal

[SnappingTurtle]

After all, I assume every virus writer tests his/her virus by running it through anti-virus software. If we would just get rid of that virus-helping software, we'd be safer from viruses.

Those damn virus-helpers over at Symantec, I hope the law skins them alive.

there does need to be something like this..

[Anonymous Coward]

somewhere in the middle that we can agree on. for example the example code that was linked to on slashdot yesterday for the exploit should be outlawed. the person wrote and released that example code did just as much damage as the person that would use that code to write a worm and do damage across the internet. the blaster worm used copy/pasted example exploit code that had been released on the internet. its worse than irresponsible and i agree that it should be criminal. why shouldnt it? without that example code the blaster worm would probably not have been released. it gives people with very little programming knowledge the opportunity to inflict a hella lot of damage while the person who wrote half the virus walks free as if he had no part of it. its like handing out guns on the streets to show how easy it is for kids to get ahold of bullets and then not holding any responsibility when they put the 2 together and kill somebody.

Re:there does need to be something like this..

[soliaus]

No. There does not need to be any form of middle ground. This is why we are American, because we can *legally* say what we want.

What about the programmers who were stupid enough to create a hole for the vulnerability? I know its hard to error check code, but some holes are just that...stupid. As for your blaster worm comments, I dont think the code was released. You obviously have not programmed anything, it is not as easy as copy and pasting code.

Re:there does need to be something like this..

[kfg]

By your own argument you are now a murderer.

KFG

Re:there does need to be something like this..

[Anonymous Coward]

The problem with "somewhere in the middle" is that the law usually ends up being so ambiguous that it hits unintended targets (law abiding citizens) while leaving wiggle room for the bad guys. I see this as the main problem in today's legislative process. Lawmakers are too (you decide: stupid, lazy, busy campaigning) to create laws that are specific enough to be effective. They use a shotgun instead of a rifle.

On a related note, we have too damn many laws now! Part of the problem is due to the legislator's belief that voters need to see their legislators doing something. In essence, many of our laws are nothing more than 'busy work', intended to fool us into thinking that they are earning their pay by doing something useful. You know, like when your boss walks in unexpectedly and, without looking up, you immediately bring a spreadsheet to the front and start clicking the mouse. Ha! He/she fell for it again! :p

Re:there does need to be something like this..

[Spl0it]

I don't think thats a fair analogy...
How about, its like giving someone alcohol, and if there a big enough moron/jackass to get in a car and drive somewhere....

Example exploit code is helpful, its make paching time alot less I'm sure when the person who wrote the 'said' software doesn't need to figure out how to exploit his own code he can just look at the example code and write up a patch...its hard to see holes in your own logic..everyones knows that...

Symantec?

[yanestra]

I guesss they Symantec people themselves expect not to be subject of their new law?

Re:Symantec?

[miu]

If the security profesionals I've encountered are any indication, then Symantec is probably full of ex-millitary, FBI, and CIA people. I'm sure there are nice people who choose to work for those agencies - I never meet them, I meet the power tripping assholes who think Ashcroft is soft. Such people have a mindset in which no one but professionals having access to security information is an excellent thing, free speech be damned.

So of course the law would not apply to them, they're the good guys.

doesn't want competition?

[Barbarian]

If people can't discuss bugs and security problems online, the only places it will be done is privately, i.e. in Symantec's and NAI's labs... this is one way to kill your competition--get the government to outlaw it.

Re:doesn't want competition?

[Malcontent]

It may be done for nefarious reasons but it may also be a product of pure stupidity.

For example the management at Symantech may truly and honestly believe that if reporting bugs were illegal then all hacking would stop. Hackers would not trade information and the world would be virus free.

Trust me PHBs are really THAT stupid.

Re:doesn't want competition?

[cujo_1111]

Schwarz? Is that you? I didn't know you were a visitor to /.

Re:doesn't want competition?

[Anonymous Coward]

For example the management at Symantech may truly and honestly believe that if reporting bugs were illegal then all hacking would stop.

Bullshit. Malice and stupidity are not as blurred as you like to think. This is the same ignorant argument that says we should disarm citizens (meaning only cops and criminals have guns). It doesn't make sense.

Re:doesn't want competition?

[R.Caley]

They bought out Security Focus and now run bugtraq. Think how that interacts with this stated position on security information sharing.

Re:doesn't want competition?

[Anonymous Coward]

fuck the moderator of this post. just because i dont agree the with slashdot propaganda machine my opinion is flamebait?

Burglary Tools

[EmpNorton]

I believe it is illegal in most states to be in possession of 'burglary tools' such as slim-jims, lock picks, and the like unless you are licensed in some way to own them (mechanic, lock smith, etc...).

When (if ever) do 'hacking tools' fall under this category? Obviously any tool can be used with ill-intent, but are there specific pieces of software that could be classified as such?

Re:Burglary Tools

[kfg]

I know of a man who was convicted of possesion of a burglery tool because he was carrying . . . a screw driver.

Just an ordinary screw driver. Not modified in any way.

The really funny part is that was actually part of what he stole, and as he left the house to boot.

Was not the legitimate owner than also guilty of possession on a burglery tool? He even kept it in a toolbox on his back porch where burglers could get ahold of it ( as evidenced by the fact that one did).

"Ok, now to see if the server is responding I'd like you to type "ping" . . . ARRRRRRRRRRGH!"

I'd think very carefully about what sort of tools you have sitting on your own "back porch," and what you advise people to do with them.

KFG

Re:Burglary Tools

[MoralHazard]

Not quite. First of all, this varies depending on jurisdiction--in some places, owning/possessing/carrying lock-opening tools is problematic (not illegal outright, though), and in other places it's perfectly acceptable.

In the places where it is trouble to carry lockpicks et al., you can't get busted for possession or ownership of the devices in the same way that you can get busted for possessing, say, pot or cocaine. Instead, the possession of those kinds of tools, WITHOUT a reasonable excuse, is considered prima facie evidence of an intent to commit wrongdoing. So if a cop catches you with lockpicks in one of these states, he can bust you for conspiring to commit a burgalary.

But remember, prima facie evidence only means anything in the absence of a countervailing explanation. If you're a locksmith on the way to a house call, you're obviously not planning to commit a crime, and so the cop can't assume that you have intent. Well, he could, but a good lawyer could get the whole beef thrown out in pretrial.

More to the point--I think this comparison fails because information and tools relating to virus/worm manufacture are even more "dual-use" than lockpicks. Lockpicks are for opening locks--the only question is whether you have permission to be opening those locks. Tools and information that could POTENTIALLY be used to code malware would include every CS textbook, compiler, and PC ever made. And my lecture notes from Data Structures in Java (which are already pretty criminal on the basis of the handwriting).

Even exploit code has a legit purpose. Am I going to take offline/patch every sshd in my organization because of a crappy rumor that there's a remote DOS overflow? Hells, no! I ain't gonna patch shit until somebody shows up with an actual, working exploit--you have to manage these risks based on the liklihood that a threat exists (potential threates get patched tomorrow morning, actual exploits get patched tonight) and the amount of shit required to fix it (will this break remote access to all my servers? Do I have the manpower to test and deploy the patch right now, when I'm still fucking around with Windows RPC stuff?).

Re:Burglary Tools

[infonick]

wont work.

remember 9/11? people arent allowed to fly a 747 unless they have a license. well, the alquida got licensed. you could just as easily have a licensed s.o.b. lock smith with picking tools.

Re:Burglary Tools

[Sonnenschein]

"Even exploit code has a legit purpose. Am I going to take offline/patch every sshd in my organization because of a crappy rumor that there's a remote DOS overflow? Hells, no! "

Mind if I ask where you're working, name/address or ip will suffice. TY.

Re:Burglary Tools

[little1973]

In the places where it is trouble to carry lockpicks et al., you can't get busted for possession or ownership of the devices in the same way that you can get busted for possessing, say, pot or cocaine. Instead, the possession of those kinds of tools, WITHOUT a reasonable excuse, is considered prima facie evidence of an intent to commit wrongdoing. So if a cop catches you with lockpicks in one of these states, he can bust you for conspiring to commit a burgalary.

It's kinda like Thought Police, isn't it? To intend to do sg and to do sg are two different things. I think Minority Report taught us that every person can change his mind even in the last minute. So, no crime will be commited. I think banning possesing such harmless (in the sence that it is harmless until used, not like some explosives) physical items like lockpicks is a severe violation of human rights.

Re:Burglary Tools

[Anonymous Coward]

I believe it is illegal in most states to be in possession of 'burglary tools' such as slim-jims, lock picks, and the like unless you are licensed in some way to own them (mechanic, lock smith, etc...).

True, but it is not illegal to distribute information on how to make a 'slim-jim' and.or how to use it.

Re:Burglary Tools

[MoralHazard]

Hahaha. Mind if I ask where YOU work? You need to be outsourced to India.

That said, the implication of your joke is that an organization that doesn't jump on a patch the second it comes out is lax. On my home machines, I can afford to break things by applying every patch the minute it comes out. I can also drop an SSH service for a while, because nobody dies or gets fired if it doesn't work.

Now, at work, this is an entirely different story. Not having SSH services means that business can't get done, which is real, real bad. If it comes down to "doing business insecurely" versus "not doing business at all", the answer here is obvious.

Or are you the kind of admin who just blindly runs patches on production boxes without testing them under load first?

BTW, did you get that email from Microsoft with the attached Windows patch? You should run it ASAP, before somebody roots you.

Re:Burglary Tools

[Anonymous Coward]

I may even USE the exploit to patch SSHD on my system.

Re:Burglary Tools

[Anonymous Coward]

I believe it is illegal in most states to be in possession of 'burglary tools' such as slim-jims, lock picks, and the like unless you are licensed in some way to own them (mechanic, lock smith, etc...).

When (if ever) do 'hacking tools' fall under this category? Obviously any tool can be used with ill-intent, but are there specific pieces of software that could be classified as such?

Software is not just a tool. It is also a legitimate, constitutionally protected means of expression. You have a constitutional right to discuss computer security issues. Part of that discussion involves examples of how to exploit security holes as well as defend against exploits.

The government had to stretch to regulate lock picks. Congress has to meet a much higher standard to regulate expression (The absurd DeCSS ruling not included).

Re:Burglary Tools

[Anonymous Coward]

information and tools relating to virus/worm manufacture are even more "dual-use" than lockpicks.

I was fully with you up until here. I agree at the information is dual use. Maybe even more useful to the good guys. You fail to show why a virus manufacture tool has any good use. The teaching argument doesn't hold with me.

Slippery Slope

[shirai]

I think this is the slippery slope defined. Even if it were a good idea to keep these tools away from easy access (I won't reiterate the many arguments why it isn't), it is extremely difficult to know exactly where the line from "general purpose networking tool" to "hacking tool" is drawn.

Considering that virtually any tool can be used to hack, when does something get legislated as illegal? Somebody uses a web browser to hack. Is the web browser now an illegal hacking tool?

Okay, maybe that was too easy. But a packet sniffer?

I think one could easily make an argument that that is a hacking tool. Ultimately, the legal definitions may center around "public perception" as often seems to be the case in technical legalities instead of technical accuracy. This is, unfortunately, because the general public typically doesn't understand technically how things work. Notice most bad press is based around technologies that the average guy doesn't understand.

We're treading on dangerous grounds Symantec...

Slippery Slope...

Re:Slippery Slope

[Anonymous Coward]

just because the slope is slippery doesnt mean we shouldnt try to define it. heroin is illegal but we dont outlaw perscription oxycontin or vicodin. even things like anti-hystimines can be used to make illegal drugs but that doesnt mean we outlaw it all. and we dont allow it all either and sell heroin, cocaine and meth along with the toothpaste and aspirin in the drug store. we have to try to define the line as best we can and then make educated decisions as scenarios come along. by allowing these virus-assistants to continue we are selling heroin on the shelves. this causes real damage to real people in the range of billions of $ per widespread virus. that translates into reality when people are layed off, when people line up for welfare, when kids go hungry. not to be dramatic and overly emotional but this is literally what it comes down to when this "harmless and helpful code" is released. "security through obscurity is no security at all". well, to a point it is. writing and releasing example exploit code should be illegal, i can say that much. packet sniffers should be legal. bugtrackers that dont give example code should be legal.

Re:Slippery Slope

[Hatta]

That government which governs best, governs least.

Re:Slippery Slope

[entartete]

I remember some PHB type at a university i worked at had this list of 'hacking tools' that he had gotten from some 'security expert' that we were supposed to be on the watch for if we saw any of the students using these dangerous and evil things. These tools included things like text editors and resource fork editors for macintosh and such. I thought at first that it was some prank played upon the the PHB but whoever gave the this list to them was apparently completely serious about it.it was funny and scary at the same time. When text editors are illegal only outlaws will have text editors.

Re:Slippery Slope

[Anonymous Coward]

The cute thing is that there actually is something called "the slippery slope logical fallacy" and it is can be succinctly stated "it is not necessary to carry every idea to its logical extreme" - yet exactly that is what you are doing, along with the rest of the Slashdot crowd, in this article and all the ones preceeding it.

There's always a tradeoff in law. Every law infringes on someone's rights, for the benefit of the common good. The knee jerk "Symantic wants to outlaw compilers!" helps noone, and is pathetic. Of course noone wants to outlaw compilers, they want to outlaw virus writing kits and dissimination of working exploit code.

Slashdotters refuse to see grayzones in every discussion, which testifies to their intellectual immaturity. An acknowledgment that the world isn't black and white is a first step toward a sound idea of the legal system, and society, works. You have yet to take it.

Re:Slippery Slope

[ScrewMaster]

The real problem with any such legislation is that it presumes that the legislation will have the desired effect.

What irks me about all this is that Congress seems not to have fully grasped the GLOBAL nature of the Internet. They keep talking about "New World Orders" and "The Global Economy" and all that but they seem to forget that Federal laws only hold sway in the United States and are meaningless to the rest of the world (other than as a source of amusement for it.) No matter what you try to make illegal here (whether it be music, movies, virus toolkits or anything else) it just doesn't MATTER. Users in other countries (say, Canada) will simply host any verboten material and that's that. I really wish more members of Congress would get a clue.

Re:Slippery Slope

[Idarubicin]

Ah yes. The powerful technique of governing by aphorism.

Re:Slippery Slope

[cookie_cutter]

It's called an anarchy, and I personally don't think it is the best form of goverment.

Re:Slippery Slope

[raju1kabir]

It's called an anarchy, and I personally don't think it is the best form of goverment.

That's because you haven't been to Somalia, the Libertarian Paradise.

There, everyone is free to pursue their economic dreams without any government interference whatsoever. It's even a meta-libertarian paradise: Contract enforcement itself is provided by contract, with each participant in a transaction hiring its own band of thugs to ensure that the other participants stay honest.

Obvious

[oGMo]

Well, there will always be virus authors, it's like banning weapons: you're only taking away from those who get things through legitimate means.

Think what this would ban: bug tracking and security lists, compilers, assemblers, debuggers, hex editors, etc. These are how viruses get written.

However, if the public doesn't have access to any of this (particularly security tracking lists), then antivirus companies become the one and only legal source for fixes. Presto, huge demand created, which means more legislated profit.

There's your paranoia for the evening.

Re:Obvious

[Anonymous Coward]

An excellent example of an insightful comment. Impressive

Re:Obvious

[muffen]

Well, there will always be virus authors, it's like banning weapons: you're only taking away from those who get things through legitimate means.

Not true at all. In Europe, I don't think that most people, criminals or not, can get hold of weapons easily. There are better things to compare it to than banning weapons!

Think what this would ban: bug tracking and security lists, compilers, assemblers, debuggers, hex editors, etc. These are how viruses get written.

Apart from the first two, NO!
He didn't say people are no longer allowed to look at files in hexeditors or that he thinks that no-one can write assemblycode anymore. He also never said that a developer isn't allowed to debug his own code.

To be honest, I don't even think he knows what he said. I don't think it was thought through fully, and it just kinda slipped out or something (or they guy is a complete retard, but I don't think thats the case, based on the position his holding).

Don't get me wrong here, I think that this idea of his is stupid and won't happen. I just think that there is no need to make it worse than it is.

Re:Obvious

[aminorex]

In Europe, I could get off a plane with nothing
but a passport and a handful of cash and *manufacture*
a submachine gun from freely downloadable CNC data
and steel stock in less than 24 hours.

In any major city of Europe, I would be willing
to wager, oh, 3 months salary ($30,000 US)
that with enough cash in my pocket I can purchase
a handgun within 24 hours of arrival.

If I really wanted a weapon quickly, I'd just
garrote a police officer.

What you really mean is that you are not competent
to aquire a firearm, and that none of your friends
has divulged to you that they possess firearms.

Evidently, you are not Swiss.

Re:Obvious

[Anonymous Coward]

In any major city of Europe, I would be willing to wager, oh, 3 months salary ($30,000 US) that with enough cash in my pocket I can purchase a handgun within 24 hours of arrival.

Yeah right. And I'll wager, oh, 3 months salary ($1,000,000 US) that you don't make $120,000.

Crack down on those dirty scientists!

[Sage Gaspar]

Why does it seem that every single proposed or actual law targeted at "cybercrime" puts absurd limitations on legitimate research while having absolutely no effect on the criminals?

Re:Crack down on those dirty scientists!

[Anonymous Coward]

Because this is how nasty things have always been pushed in politics, and not only when it's a matter of "cybercrime".
You know, there are a lot of laws in the style of "let's make make our voters have the perception we are doing a good thing while doing bad things".
Should I mention any?

Re:Crack down on those dirty scientists!

[Free_Meson]

Why does it seem that every single proposed or actual law targeted at "cybercrime" puts absurd limitations on legitimate research while having absolutely no effect on the criminals?

Most of the laws targeted at any kind of crime tends to undermine legitimate uses of materials and technologies while doing little or nothing to diminish the same resources from being used by criminal elements. Guns/Drugs/WMD's/etc -- if it is made, or can be made, a determined criminal can obtain it and use it for ill.

Perhaps it's the only remotely intelligent thing that Reagan ever said, but "When guns are outlawed, only outlaws will have guns"...

Re:Crack down on those dirty scientists!

[0x0d0a]

Because most of the people pushing for legal changes to reduce "cybercrime" have little or no interest in actually reducing cybercrime. They have their own aims, and fear of cybercrime makes a nice vehicle to put their own issues through.

Whee.

[Aldric]

They've just outlawed a large chunk of programming knowledge. Well, non-US programmers now have a lot less competition! ;)

Re:Whee.

[azaris]

They've just outlawed a large chunk of programming knowledge. Well, non-US programmers now have a lot less competition! ;)

Those who think this won't affect non-USasians, think again. Most transcontinental Internet connections pass through networks owned by US-based entities - thereby covered by US law.

Let's say you're contracted to perform a vulnerability scan from London against a subsidiary company in Tokyo. You decided to use the hacker tool known as nmap. Since the packets travel through the US, you are violating this proposed law. As I believe the UK has an extraditement treaty with the US over cybercrime, guess what happens if your competitor who lost the contract turns you in to the FBI for using hacker tools inside US networks?

Sure, it's a radical example of the potential effects of badly written law, but do you trust the current US government to know any better?

anti-virus software, tool of the pirate

[Anonymous Coward]

If you stick to shrinkwrapped software, and DON'T run ANY other form of executable, then you DON'T need anti-virus software.

So what is this "Norton AntiVirus" for? To help people who download cracked software keep their computers healthy? Sounds like a shady product to me.

Re:anti-virus software, tool of the pirate

[Anonymous Coward]

Really?

How about people who run things they get as e-mail attachments?

Or the Blaster worm, what pirated software did it require you to be running?

Antivirus programs are mostly workarounds for the stupidity of regular users, most of the viruses that cause a lot of damage are not spread via pirated software.

Re:anti-virus software, tool of the pirate

[soliaus]

If you stick to shrinkwrapped software, and DON'T run ANY other form of executable, then you DON'T need anti-virus software.

You sir, are wrong. There is a product on the market that comes shrink wrapped, and is by far one of the worst viruses ever made. They seem to have a legitimate business operation, but innocent users fall victim to their faulty coding every single day.

More information is available here.

Re:anti-virus software, tool of the pirate

[Anonymous Coward]

Really? What about the worms that exploit old bugs in Outlook that force it to auto-execute their executable attachment?

To be honest, there are no viruses in cracked software. Oh, there are TROJANs in "cracked" software, certainly no shortage of that crap floating around (Office 2003 circa 2002 = trojan horse executable)...

Re:anti-virus software, tool of the pirate

[Anonymous Coward]

Yeah...tell that to the people infected by Blaster...no exe needed. Just being connected to a network will get you infected. So lets see don't connect to any network, including the Internet, and run shrink wrapped software...then why the hell would I even need a computer?

Re:anti-virus software, tool of the pirate

[barzok]

Viruses have found their way onto "shrink-wrapped" CDs too.

Re:anti-virus software, tool of the pirate

[ScrewMaster]

If you stick to shrinkwrapped software, and DON'T run ANY other form of executable, then you DON'T need anti-virus software.

Ah ... I'm afraid I have to disagree with that statement.

Up until the Internet permitted thousands of machines to be infected remotely, the largest computer virus outbreaks were due to commercial software. A local chain of computer stores here in Chicago once released a boot-sector infector in boxes of pre-formatted floppy disks!

Put it this way: suppose the development team for application X does the final compile, burns it to a CD, and sends it to the duplicator. Further suppose that there's a virus resident on the machine used to compile said release. If it's not caught, there will be untold thousands of infected discs sold to unsuspecting customers. This has happened in the past and will continue to occur, as people aren't perfect and mistakes do get made.

The need for antivirus software will not go away until we have found, shot, and cremated the last virus author. In any event, your assumption that shrink-wrapped software is guaranteed to be clean is, well, wrong. I wouldn't uninstall your virus checker just yet.

Re:anti-virus software, tool of the pirate

[aminorex]

I understand that your comment was ironic, and I
do appreciate the irony. However, many readers may
take it seriously. Such persons should be alerted
that "anti-virus" software also protects against
worms which spread through e-mail, and that shrink-
wrapped software often contains viruses, for the
simple reason that the computers used to produce
that software are not inherently immune to
infection. Why, even Microsoft security updates
have been known to come pre-infected with viruses.

I have yet to see a Unix/Linux/BSD/Solaris/Mach/OS-X
virus in the wild, however.

Alternative Policy Applications?

[buckhead_buddy]

"make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers."

On the positive side, couldn't this also be applied to Windows, IE, and Outlook? Ignoring the buffer overflows (which all software has) these programs have been developing, promoting, and expanding the viral capabilities since at least 1998.

After all, there's more documentable evidence of Microsoft staunchly keeping an "open" envrionment to incubate and inspire malicious hackers much more so than the white hat hackers simply exchanging exploit documentation.

Re:Alternative Policy Applications?

[cujo_1111]

What about?

GCC?

Nmap?

Ping?

Telnet?

They would all become illegal too.

Well...

[soliaus]

There are already first ammendment issues, thats a given with something like this.

The real question is, why wont symantec create software that will deal woth these issue as they arrise. It seems like someone is trying to take the load off the company. It would be like Ford trying to make the speed limits of all roads 10mph. Now, they dont have to worry soo much about making a safe car, as accidents are less likely to occur.

What Happens to Full Disclosure?

[Anonymous Coward]

This from the people who now own the full disclosure mailing list! What would they do with the list?

Obtaining power

[panurge]

Schwarz wants this because it is a way for Symantec to gain power. Briefly, if these activities are criminalised the income for lawyers will go up, but so will the income for expert witnesses and analysts - which means Symantec is in a position to sell what are effectively consulting services at the higher prices that start the moment the legal clock starts ticking. They are also in a position to gain more influence in Washington because they would be seen as being in a position to advise representatives. If Symantec could effectively corner the market in expertise over a law they themselves have been involved in drafting, they would also gain influence in the IT industry because of their ability to influence the government in matters concerning software design and deployment, thus having some measure of control over other companies.

As Shaw said, patriotism is the last refuge of the scoundrel. Applied judiciously, it can also be very profitable.

PR stunt

[Anonymous Coward]

i get it: buy more symantec stuff ...
i wonder if there's a doc going like this:
"hello Mr. schwarz this is a slashdot editor."
"hello."
"we are running low on interessting articles. we decided to mention your company on our website if you pay us a small fee. is there anything you want to comment on?"
"sure. i'll send you 10k and please mention on your web-site that our company despises virus writers and people how encurage other people to write viruses."
"thank you mr. schwarz."

Don't look at me

[Rhinobird]

Don't look at me I voted for Kodos!

This makes perfect sense, though

[MoralHazard]

ANother poster mentioned that this would be a really bad idea for Symantec because they stand to profit from MORE viruses and worms, and more illegal activity in general. If this were true, this fool would never have mentioned this idea in public, let alone made a serious proposal.

But it's NOT true that a law like this would diminish incidents of new viruses and worms. Like the article says, it's already illegal to hack, and yet we still have hackers. Why?

1) 99.9% (or some similar ridiculous figure) of damaging incidents never lead to a prosecution--too little monetary loss to justify law enforcement attention.

2) Lack of willingness by private sector companies to report (and therefore allow legal penalties to accrue) computer security incidents--they don't want the bad publicity.

The existing laws don't work because they're not enforced often enough when violations exist, either because the violators aren't caught or because prosecution/investigation isn't done. So a new law will do WONDERS, I'm sure, to further intimidate those script kiddies.

It's obvious, though, just how much Symantec could gain from this--goodbye non-commercial security clearinghouses! You'd violate the law to post to an open forum, so nobody will bother (I'm sure Synamtec would contribute resources to policing that aspect), and so there won't be any good open, public security resources. That gives Symantec the perfect market opportunity to fill the vacuum with a new pay-for-info service on pending bugs. The creation of a commercial relationship with subscribers gets them a free pass on the new law (it's not really public, more like those $1500 Gartner reports). And we all get fucked in the meantime.

This is so fucking transparent. I hope that boycott idead gets off the ground--I'd start it, but me and mine are all off Symantec, anyway.

1st Amendment

[yoshi_mon]

I swear, there needs to be a check after each law is passed such that it is even legal!

How many laws would we have today if they were checked before they were put into action by the high court of the land. Just even for that nasty bill of rights kinda deal.

Talk about checks and balances.

Re:1st Amendment

[jonblaze]

How many laws would we have today if they were checked before they were put into action by the high court of the land.

I assume you are referring to laws passed in the United States. If so, it is a long-established principle of constitutional law that the Supreme Court (and the inferior federal courts) do not issue advisory opinions. "The province of the court is solely to decide the rights of individuals." Marbury v. Madison.

Re:hey

[Anonymous Coward]

yeah, cheap too. It only costs a slashdot subsciption.

Who are they protecting?

[Anonymous Coward]

I really can't say I am happy with the current state of affairs concerning virii and such.

But what symantec wants is not to protect us, but
to protect themselves.

Now if they were to advocate, as a bare minimum, an open source directive. Which would entail any product which networked to have it's source readily available for peer review.

Yeah that would be something that is a step in the right direction.

Stop giving people guns and ammunition and not expect them to use it.

Whoops!

[Black Parrot]

> Chief Operating Officer of Symantec, John Schwarz, was quoted as 'calling for laws to make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers.'

No more e-mail, folks!

Though I can't say I'll miss it much, after the past few days.

How coincidental is this really...

[segment]

Security software industry veteran Amit Yoran is expected to be named the new head of federal cybersecurity by the U.S. Department of Homeland Security (DHS) on Tuesday. ... Yoran stayed on as Symantec vice president of worldwide managed security services operations, according to Symantec spokesman Cris Paden. Yoran was well regarded at Symantec, Paden said. Infoworld

I've said it before, and I will say it again, hiring Yoran is going to produce a huge conflict of interest, and it seems it has already started. Personally I think this comment was made solely to gain a favorite view in the government's eyes. Remember government spends millions on pork barrel garbage, and I'm sure Symantec is looking forward to riding the gravy train back and forth.

All aboard!

...and the moment has come

[SignificantBit]

my worst fear when Symantec bought SecurityFocus was the ability to exercise free of speech and free research on bugtraq... now it is just matter of time when corporate censorship begin to infect what can be said, research, discused or developed on the mailing list.

Sure

[Anonymous Coward]

If you're parsing it with a language with an inefficient recursion scheme like Lisp.

I can respect that but!

[yoshi_mon]

In my post I specificly mentioned the Bill of Rights. If that does not have something to do with, "The province of the court is solely to decide the rights of individuals." (Marbury v. Madison.) then I don't know what does.

Re:I can respect that but!

[Excen]

"The province of the court is solely to decide the rights of individuals."

[]

The only reason the supreme court doesn't want to speak out, is to avoid individual justices being labeled as "Liberal" and thereby attracting the attention of the conservative horde. Who would demand the resignation of the justice, and if they were to resign, everybody would be royally screwed. The only difference between Roe V. Wade being the law of the land, and Bush's brand of christian (psychotic) conservatism is ONE VOTE on the supreme court.

[]

Re:I can respect that but!

[jonblaze]

In my post I specificly mentioned the Bill of Rights. If that does not have something to do with, "The province of the court is solely to decide the rights of individuals." (Marbury v. Madison.) then I don't know what does.

The Court's statement signifies that it only settles disputes that arise between parties (i.e., individuals in most circumstances). These disputes have to satisfy the "case or controversy" requirement of Article III of the Constitution. To establish a case or controversy the plaintiff must have standing, which requires a (1) concrete, particular (as opposed to generalized) injury, (2) caused by the defendant's actions, (3) that can be redressed by favorable court adjudication.

With the foregoing established, the Supreme Court cannot issue advisory opinions because there are no sufficiently interested parties whose rights are to be decided and thus no "case or controversy."

Re:I can respect that but!

[jonblaze]

The only reason the supreme court doesn't want to speak out, is to avoid individual justices being labeled as "Liberal" and thereby attracting the attention of the conservative horde. Who would demand the resignation of the justice, and if they were to resign, everybody would be royally screwed. The only difference between Roe V. Wade being the law of the land, and Bush's brand of christian (psychotic) conservatism is ONE VOTE on the supreme court.

Conservatives (and liberals) can "demand the resignation of the justice" all they want, but there is only one constitutional procedure for removing Justices from the Supreme Court, and it is quite onerous. See Art. II, sec. 4.

As for your other assertion that "one vote" is all that is needed to overturn Roe, perhaps you'd like to vote-count Planned Parenthood v. Casey, and rethink your position.

OT: Don't look now, but Jennifer Ringley is naked.

[B747SP]

... right now. I know so, 'cos I saw so in my slashbox.

What is "insightful" about this?

[msobkow]

This is the same mentality that would ban baking soda because it could be used to make crack, hunting rifles because "guns" are used in crimes, and information about making black powder because it could be used for explosives.

If the software provider has been warned about the issue and provided a copy of the exploit code for testing their fixes, I have absolutely NO sympathy for a vendor which doesn't provide a fix.

Nor do I subscribe to the asinine american penchant for blaming everyone else for the stupid decisions and accidents individuals encounter. Spill your coffee, "reenact" a video game, commit suicide after listening to Ozzy -- and blame/sue someone else.

Bullshit.

It's time to stop trying to make excuses for stupidity and put the blame squarely on the shoulders of the perpetrators. If you want to blame someone, blame our pathetic spineless north american governments who are more concerned about the "rights" of criminals than defending society from them.

If some script-kiddie is smart enough to download and fire up cracker scripts, they're damned well smart enough to know what they're doing is wrong, and should pay the price when caught.

Re:What is "insightful" about this?

[Anonymous Coward]

You ruined a good post by going on about asinine american penchant for blaming everyone and using the mcdonalds coffee case.

The TRUTH behind the McDonalds coffee case

Here are the REAL facts about the infamous case of the woman burned by coffee from McDonalds.

1. To get more coffee per pound of beans and increase profits, McDonald's served its coffee up to 40 degrees hotter than other fast food eateries.

2. The coffee was so hot that if spilled would cause 3rd degree burns.

3. McDonalds had over 700 filed claims for burns from coffee but never lowered the temperature of the coffee.

4. The plaintiff in the case was not driving here car but was a passenger in another's car and suffered 3rd degree burns when she removed the lid & spilled the coffee.

5. Plaintiff was hospitalized for 8 days and had multiple surgeries due to the burns

6. Plaintiff only sued McDonalds after they refused to pay for her medical expenses

7. Jury awarded $2.7 Million against McDonalds to deter future conduct.

8. McDonalds lowered the temperature the day after the verdict.

9. The judge reduced the verdict to $400K because he thought the penalty was too high.

This case is used over and over to justify an attempt by business to limit your right to sue them for their misconduct. It like all red herrings are effective only if you do not know the facts. Do you expect the coffee you get anywhere to be hot enough to do the kind of damage described below.

What is a Third Degree Burn?

A third-degree burn occurs when an injury occurs to the epidermis, burns through the dermis, and burns the underlying structural tissue, such as muscular, skeletal, nervous and vascular tissue. Third degree burns are also referred to as full thickness burns, which describe the depth of the injury.

Third-degree burns are dry and leathery in appearance. The skin may look pearly white and waxy, or it may look mahogany, brown or black. The skin may look charred, and blood vessels underneath the skin may also appear charred.

Third-degree burns can be life threatening, depending on the percentage of the body surface injured. Treatment involves skin grafts, and possibility of other procedures depending on the kind and extent of scarring.

All to make a few cents more per cup. And the animation below is from the McDonalds web site. I think it is a little guy polishing their image. What if this happened to your mother, wife or daughter. The next time you hear this come up, remember these facts. You MUST retain your rights. SAY NO to tort reform.

Rich Mann

The facts are from case transcripts and I can provide reference material.

http://www.mannco.com/mcdonalds_coffe.htm

Re:What is "insightful" about this?

[TiggsPanther]

But it's still down to thatr, and cases like it, that we now get such important information on packaging. Such as "Warning, contents may be hot" on something bought as hot food, or "Warning, may contain nuts" on a packet of peanuts.

It's still indicative of the American (and now British, too...) knee-jerk "compensation culture" that is becoming evermore prevalent. And the McDonalds case could be (and probably has been/will be) used as a precedent when something happens to a much lesser scale.

Re:What is "insightful" about this?

[msobkow]

That doesn't change the bottom line that the "victim" put hot coffee in a position where it could spill while driving. Therein lies the stupidity that deserves no compensation.

Had the coffee somehow melted the coffee cup, I could have seen a case. Had the cups been poorly constructed and collapsed or leaked the hot coffee, there might have been a case.

Someone being awarded damages for burns from a liquid that is expected to be hot is asinine, no matter what temperature McD's kept it at. Had she ordered tea, which is made by steeping in water that has just stopped boiling, would you still be claiming it was the restaurant's fault?

Of course not! That would have made it obvious to even the most slow-witted that it was a frivolous lawsuit that should have been tossed the first time it came before a judge.

Re:What is "insightful" about this?

[raju1kabir]

Someone being awarded damages for burns from a liquid that is expected to be hot is asinine, no matter what temperature McD's kept it at.

I don't agree at all. People make rational risk assessments based on reasonable expectations.

I expect the water in a hotel shower to be hot. So before I step in, I wave my hand under the stream. If the water is so hot that doing that causes the skin on my hand to blister, I am going to hold the hotel responsible - even though I "expected" it "to be hot". I didn't expect it to be that hot.

Likewise, she took a calculated risk in placing the coffee between her legs. She should have known that if it spilled, it could be painful or even cause a mild burn. However, at the temperature at which coffee is normally served, she would not have received a third-degree burn, and there was no evident reason to plan for that possibility.

What good is a law like this

[Tommy Boomfiger]

when other countries won't have similar laws? Viruses don't follow political boundaries.

Re:What good is a law like this

[Hatta]

Viruses don't obey the law either. If every country passed such a law, it would still have no effect on virus writers who are already breaking the law.

why is it that...

[infonick]

the confused people seem to get into high places to deturmin the fate of millions?

"Laws that forbid the unrestricted distribution of information...make ignorant only those who are neither inclined nor determined to commit crimes...Such laws make things worse for the victim and better for the criminal; they serve rather to encourage than to prevent unauthorized access to computer systems, for an insecure system may be attacked with greater confidence and ease than a secure system."

The other side is that the second such censorship is enforced, people who right now are innocent will become criminals - why? - because they have no other way of defending themselves but to go against such censorship!

We Need To Make A Choice...

[tyrcadia]

Is the InterNet going to become the domain of government and corporate interest, for whom the line is blurring every day? Or is it going to become the digital commons most Slashdotters, I would guess want it to develop into or remain? We need to start expressing our complicated technical concepts in laypeople's terms the average citizen can comprehend and find a way to deliver that to the masses that interests them otherwise we're never going to get across that these misguided requests for non-security are really veiled corporate protectionism. How do we band together to run our own TV ads, press runs, etc., etc.?

Obviously bad, but for an alternative...

[Satan's Librarian]

Obviously, this is stupid. Outlawing such information will, at best, make it hard for programmers to learn enough about the different types of viruses out there, the techniques they use, and the methods to protect against them.

In otherwords, if you outlaw the legitimate dissemination of information regarding viruses and how they are made, you just made writing a GPL or BSD licensed antivirus program illegal - obviously anyone involved in such a project would have to break the law to obtain virus samples, disassemblies, and information. This might be good for Symantec, but it sucks for the rest of us.

However, there is a problem. There's a ton of viruses coming out every day, and the internet makes an extremely fertile ground for even a poorly written virus or worm. A simple virus or worm can literally bring a corporation's operations to a halt for a day or two - even if critical machines run moderately secure operating systems, the traffic overload and DDOS'ing from the compromised machines can be hell.

Most virus writers are kids that feel alienated by "the system". I think most studies have shown that the average virus writer ages are between 14 and 24 - meaning when people get older and join society, they generally phase out of virus writing for moral or practical reasons. For several papers on who exactly writes viruses, go here.

So how do we prevent these kids from writing viruses? Outlawing information regarding viruses is a lot like outlawing the purchase of spraypaint - it isn't going to work, and it makes life suck for the rest of us.

But could we find ways to engage kids within risk groups and help them find useful outlets for their talent, so they could receive positive feedback and recognition for their work instead of getting their kicks unleashing their work on the world? I bet if you got a teenager that otherwise felt the world was against him or her involved in an open-source project they got excited about, where they were tutored and provided with positive feedback by more experienced mentors - they wouldn't have the time or the inclination to write viruses and will learn some very valueable skills that will be useful to them.

So how about this - start something similar to SourceForge for teens, and find programmers willing to donate their time mentoring these kids and helping them take their skills to the next level while teaching them the ethics and responsibilities of a first-rate programmer? Obviously such a system would need to be watched for abusive adults and any found would need to be banned and/or prosecuted, but if a bunch of good coders that gave a shit about kids did it I think it could seriously make a dent in the growth of the virus problem.

The other solution would be to make apprenticeships mandatory for budding programmers :)

Re:Obviously bad, but for an alternative...

[f0rt0r]

Wouldn't outlawing MS Windows be the simplest solution? It definitely would have saved me a ton of
virus-cleanup work this year!

Re:Obviously bad, but for an alternative...

[Anonymous Coward]

why not the current sourceforge and online community? why not take some programmers under your wing and encourage others to do so as well? the community already encourages and positivly enforces creative skill from anyone.

Re:Obviously bad, but for an alternative...

[R.Caley]

A simple virus or worm can literally bring a corporation's operations to a halt for a day or two

Think of it as evolution in action. Eventually all the corporations with clueless IT people (or manages who outlaw clue use) will die. This will result in either an economy full of clued up corporations or no economy, all of us starving in the streets, and an ecological niche for a new apex species.

Re:Obviously bad, but for an alternative...

[Satan's Librarian]

Because of the tendancy of geeks to diss on newbies. I suspect a *lot* of top quality mentoring goes on on SourceForge, but I also suspect that inexperienced coders are often not allowed on projects or rudely dismissed when they make mistakes.

If a place was set up specifically for young programmers just learning the trade, I think it would have a better effect. In addition, I suspect you could get more sponsorship benefits in such an environment. Here I'm thinking Apple, Microsoft, RedHat, CodeWarrior, Compuware, the antivirus companies, and others chipping in on training materials, equipment, and manpower.

Re:Obviously bad, but for an alternative...

[10am-bedtime]

if a lot of people diss on others, placing the others in an easily identifiable box is going to make it easy for the people who diss others to find these others (to diss).

while the spirit of this initiative is worthy, the above fragment of human nature will just get in the way, in the end. to improve things you cannot run from that which needs improvement to some imagined better place. better to stay and grow your own tree of improvement in the current place, even if it is imperfect there, if you care about the place as well as the improvement.

here, the place is the programming mindset, and the improvement is its dissemination into people (young and old, traditional programmers and non traditional programmers), so that the community of programmers can survive and grow. water the tree, don't transplant it.

Re:Obviously bad, but for an alternative...

[Satan's Librarian]

Perhaps if our industry moves towards an apprenticeship model, such will be more palatable. But currently I think the school of hard knocks combined with repeated rejection is a rough and inefficient way to train young programmers.

Universities and trade schools might be the ideal place to train, but in my experience they hardly teach algorithms and concepts well - much less good programming practices - during the undergrad years. Post-graduate studies do often pair a student with an experienced mentor, but is it worth 4 more years? Is it worth going through years of babysitting and repetition in the public systems and tens of thousands of dollars just to gain access to a mentor who may be wholly out of touch with the industry? In some cases, yes. In many other cases, however, I think not.

If we were to focus on making SourceForge more open to newcomers, I'd recommend at least the following, although I believe a seperate system could be more effectively implemented for the purpose:

• Add searchable flags to coders who wish to become mentors, and create a reputation-based system with which to gauge their sincerety and dedication.
• Add searchable flags to the projects themselves, such that one knows which projects would like to accept young coders, allow them to participate, and assist them in their quest for knowledge and skill.
• Create a pool of tools for young coders who cannot afford them. Not everyone's platform of choice is Linux, nor is it appropriate for all projects. And even within Linux, not all of the worthwhile tools are free.
• Add a ratings system to allow peer review of the quality of code, such that people may be drawn to more professionally managed projects where they can learn better practices.
• Encourage experienced programmers to provide more tutorials on their best practices, and work to build a high quality library of free (and preferably categorized and easy to find) knowledge. Such should not simply consist of solutions to single problems, but should also provide guidelines and thought processes that result in great software. Most teenagers are not yet going to have the finances to purchase the works of Stroustrup, Knuth, and Stevens, and it can be very hard to find useful information on the net at large - the signal/noise ratio is quite low these days. Consolidating such knowledge in one place could be of great benefit to everyone, but especially those just beginning their study of the trade.
• Provide a subset of projects that are less ethically questionable, or at least a rating system to ensure that projects which might land their participants in hot water legally are clearly marked and young programmers are recommend to avoid them. While the vast majority of projects are responsible, some are questionable and others are downright inappropriate for minors (and most likely illegal for minors to work on).

Not quite.

[rjh]

It's not illegal to be in possession of burglary tools. If that was the case, you'd be breaking the law just by keeping a crowbar in the trunk of your car.

It's illegal to be in possession of burglary tools while committing a burglary, under the theory that bringing burglary tools to a burglary shows that you approached the burglary with premeditation and planning. Premeditated, thought-out-in-advance crimes are almost always punished more severely than "amateur night" or heat-of-the-moment crimes.

E.g.., if I use a rock to break a car window, reach inside and pull out the stereo... maybe I'm a career criminal, or maybe I'm just someone who made a really stupid choice.

But if I've picked the lock on the door with a SlimJim, brought open specialized tools to crack the dash and remove the radio in 15 seconds flat, then it's a pretty good bet I've done this crime before and I'll continue to do it in the future--both of which make me a more serious criminal in the eyes of the law.

Re:Not quite.

[BrynM]

If that was the case, you'd be breaking the law just by keeping a crowbar in the trunk of your car. In California, if the crowbar is within arms reach (like under the back seat), you can be charged with possession of a deadly weapon which is a felony.

Re:Not quite.

[expro]

In Arizona, if I take the set of lock picks out of my house, it is illegal.

Re:Not quite.

[mindstrm]

Unless you have a good reason to have that crowbar there... like you are a construction worker, and your tools are in the back seat, and you are on the way home form work.

A crowbay kept at the ready to bash someone with qualifies as a weapon. A crowbar that just happens to be present without that intent, is not. The idea is that, without a reasonable reason to have that crowbar, it's assumed your intent is to use it as a weapon.

If I carry a baseball bat in my back seat, same deal.
If I happen to be on the way to a baseball game that I play in, it's certainly not.

Slim Jims?

[toupsie]

My corner convenience store has buckets of Slim Jims! Now I have to get a license to eat one? Also, how do I burglar with one?

Re:Slim Jims?

[Anonymous Coward]

Poor Dead Moo-Cow.
He wasn't hurting nobody, he was just being a cow.
And you killed him.
And now you are gonna munch on his widdle dead body.

"At least we don't waste the cadaver", you say.
So I ask, " Should Jeffery Dahmer have gotten a reduced sentence because he didn't waste the bodies?"

Won't SOMEBODY think of the children? After all, they are much more succulent and tender. And claims of ownership would appear to have a stronger basis if based on birth.
It would be a more consistant, principled stance to support abortion and/or consumption of your own offspring, rather than enslaving another species.

But no. You hurt the poor Moo-Cow

freenet

[oohp]

We'll just share them over freenet along with instructions on how to build bombs and the like.

In a nation where .....

[losttoy]

Guns - Guns don't kill people, people kill people.

Hacker tools - Ban them, put anyone who writes or shares them behind bars??

File Sharing tools - Ban them, put anyone who uses file sharing behind bars??

Acronyms

[Free_Meson]

You know, there are a lot of laws in the style of "let's make make our voters have the perception we are doing a good thing while doing bad things". Should I mention any?

I wonder what would happen if they used up all of the "good" acronyms? Like what happens when PATRIOT and GOODLAW and RE-ELECT are all taken? Is some sort of NEA funding bill going to get stuck with being called the POUND-ME-IN-THE-ASS act? You figure there are a limited number of sensical acronyms, after all.

Bah.

[Gwala]

It's just another company buying a new law. This however, I do not understand - since this is going to hurt Symnatec's business, at least in the long run if its effective, but its also going to put the whole realm of programming into a legal gray area.

Hrrm.
-Gwala

This can happen, it already has

[Anonymous Coward]

For years all different manner of firearms and accesories have been banned and made illegal, because they "could" be used to commit a crime. just wait until there are sound bytes about "computershow loopholes" and "preban programs", or better yet when the latest technology you can legally own is ten or fifteen years old. Maybe we will have "common sense" computer control laws that allow you to have no more than two hacker friendly feature such as high capacity hard drives (over ten gigs), broadband network connection, CPU more than 500MHZ, or any detatchable media. I live with laws exactly like this in one hobby, I know that this is not a very sympathetic venue for this type of comparison, but maybe you will think a little more the next time somebody is wanting to sanatch the rights from a group of people you don't share interestes with. It is exactly the same situation, the average American has no understanding of how pointless gun control is, but is done with good intent, so they figure it is alright, well guess what, to the average american this law will seem like a good idea to fight the growing plague of cyber crime. These laws would do nothing to stop virii, just like the Assault Weapons Ban has done nothing to reduce gang violence.

And in more news...

[heironymouscoward]

The COO of a large pharmaceutical corporation explained why his firm was lobbying for a ban on all new forms of medicinal research...

Symantec make their money from viruses. Why on earth should we take their pronouncements in any other light? Their dream world is one in which only the criminals and the megacorporations have access to the technology, so that the citizenry squashed between the two can pay a jolly penny.

It's ridiculous. The only defense against malware is transparency, competition, and the evolution of something approaching a natural defense system. Not suppression of the tools people need in order to develop their defenses.

Ok, post jurance got it but again...

[yoshi_mon]

I understand that without a crime there can be no test of a law due to what you have just established. Or to put it another way, without a party that has been wronged there can be no case that can be brought before the high court to rule upon.

Ok, right. So what we are saying here is that, its ok to pass laws that aren't legal until the wrong someone. And then when they get wronged they have to go though the *whole* court system before they finally get ruled on and then maybe if your lucky the high court will hear your case vs the law and rule against it thus striking down a law that never should have been enacted in the 1st place.

All of that takes time, money, and much much effort. But hey, it's ok because you can site some reference in the original constitution (Where I'm quite sure the founder fathers envisioned it that way.) to where that makes it so.

Well, all I'm saying is I call shenanigans on that clause and hello to a way to review laws that effect, lets face it, the whole gawd damn world before we enact them.

Re:Ok, post jurance got it but again...

[jonblaze]

All of that takes time, money, and much much effort. But hey, it's ok because you can site some reference in the original constitution (Where I'm quite sure the founder fathers envisioned it that way.) to where that makes it so.

Here's the thing: Legislatures don't typically pass blatantly unconstitutional laws (folks in the peanut gallery please save your PATRIOT Act jokes). So, courts rely on sufficiently interested parties (and injury in-fact is usually a good proxy for interest) to provide them with perspective on the practical scope and effects of the legislation.

When a court acts issues an advisory opinion, there is great danger that not only will the court lack this proper perspective but also that it will substitute its policy judgments for that of the democratically elected legislature. The separation of powers implications are hopefully apparent.

Are these concerns worth the extra time and money? Reasonable minds may differ, but I tend to think so.

A reply from Symantec on Bugtraq

[biftek]

From this thread on Sept 12 (love the slow Australian IT press):

I am posting this In reference to the recent Wired article which Richard Smith posted to this list. Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks.

The Bugtraq mailing list, maintained as an independent entity under the SecurityFocus brand, remains one of the most respected and open sources for security information and early alerting by security professionals worldwide and full disclosure is *critical to the integrity of the Bugtraq community*.

With regards to cyber crime we need more and higher quality resources for law enforcement to work on computer forensics, and we need cooperation from government and industry to assist prosecutors in building cases against attackers.

Given the increase in the number of security threats and the availability of online tools we also believe that the industry should focus on training and educating todaya(TM)s youth about the ethics of computer crime and its affects and impact on victims.

These are not simply my words but also an official Symantec statement.

Cheers,
-al

Alfred Huger
Senior Director Engineering
Symantec Security Response

What are they going to do?

[Starmaven]

It's like the airport security dilemma: anything in the right hands can be classified as a weapon. Cloth, paper, etc... The LoveBug virus was written in VBasic. So, what, ban VBasic? That'll go over really well. Anyone with a freeware compiler, a text editor, and a bit of knowledge can create a virus. Most of us just DON'T, that's all. So, ban text editors and compilers? Microsoft Word macros can contain viruses. So, ban Microsoft Word? We shouldn't focus on banning programming tools. That's like taking away a chair because you can hit someone over the head with it. Focus more on creating tools to combat viruses (right, Symantec? You stick to your job, and the programmers will stick to theirs.).

-StarMaven

He must be hangin' out with Darl McBride...

[JRHelgeson]

This is the dumbest thing I've heard. It ranks right up there with SCO's claims against IBM and Linux. Where do they come up with these delusions?

He's stating that "Only the information security elite should ever have access to information security issues." Or if Bill Gates stated: "Only large enterprises should write operating system software. Linux should be outlawed." This means we'd all be forced to eat Microsoft's or Symantec's 'dog food'.

I ask you this: When was the last time Symantec wrote a signature for Snort? How about a nessus plugin? They want to get rid of the open source security model because they can't profit from it!

As an information security professional, I don't even listen to Symantec as their information is generally 2-3 weeks too late. Its like waiting for the Sunday paper to read about the double homicide that's taking place right now on your front lawn. All their info is being published after the fact! If they successfully cut off all access to information that is happening in the security community, then they make everyone reactive rather than proactive.

It doesn't matter how much detail Symantec offers about a virus or bug. I want to be able to take an exploit, compile it and run it against a test server on a test network. Capture the packets transmitted and analyze them. I want to dissect the 'worm' or 'virus' and develop an IDS signature as well as produce a Nessus plugin to scan other servers. If I use other tools, I want to have enough knowledge to look into their signature files to realize that they're looking for the wrong stuff and thereby giving false positives (or false negatives).

It's called FULL DISCLOSURE
Symantec is trying to tell us that I can do all this with a really descriptive set of documentation? Or maybe I should just turn my entire enterprise security model over to Symantec. Uh huh, sure... I don't think so. Gimme the code for the exploit.

Allow me to digress for a moment, stick with me though -- it's not too OT...
Lets talk for a moment about the MS03-039 exploit; the brother to MS Blaster. It's a really nasty bugger. Once it exploits a machine, it creates a user account of "e" with a password of "abc#321". Oh yeah, and the new user has admin rights.

This means the worm could use the newly created account to create other accounts, escalate privileges on existing accounts or just change everyone's password to a random string of garbage.

The price we could pay by not patching every single server and workstation this time around could exceed the damage done by blaster by a thousandfold. All it has to do is successfully nail just one Active Directory controller. Imagine if every single user on your entire network had their password changed on them, at the same time.

When blaster hit, it crashed the RPC service which forced the machine to reboot 60 seconds after the RPC service came crashing down. Imagine now that in the infection process changes admin and user passwords, revokes privileges, then reboots the machine... Your network is now down, and you can't even get back in. You are screwed.

So, how do I know this info? Well, it just so happens that I've got the source code to the worm sitting on my machine right now! I'm not contributing to the project, but I'm sure as hell monitoring what is going on, and I sure as hell didn't get ANY of this information from Symantec.

The only info I'll get from Symantec is the day after the worm's release when they announce that blaster.b is in the wild and that I should have patched my boxes, and they're very sorry but there is no cleanup file available if it compromised your AD controller and changed all the admin passwords. Symantec also recommends you have current tape backups. That's like telling the car accident victim to buckle up. Just a little late there, Jack.

We are going to continue down the road of Full Disclosure debate until M$ et al. starts writing secure code.

Re:He must be hangin' out with Darl McBride...

[Anonymous Coward]

http://home.eunet.no/~pnordahl/ntpasswd/editor.htm l

have this handy when it hits

Re:He must be hangin' out with Darl McBride...

[ScrewMaster]

I say the medicine is bad, but the disease is worse. Full Disclosure is the Medicine, bad coding the disease.

I think you mean bad code is the disease. I do basically agree with you, but as a software engineer, I think you'll find that bad coding isn't necessarily the issue. Fundamentally bad design and poor quality control methodologies are ultimately to blame for Microsoft's problems.

Software development is a cycle, where code is developed, tested, broken, returned to be fixed and then tested again. Laying the blame for poor quality software solely at the feet of the actual coder is wrong, as he or she is only a part of the overall development process, and ultimately not the one responsible for product quality.

Heh, I'll see your PATRIOT Act and raise you...

[yoshi_mon]

The DMCA.

That's OK.

[Anonymous Coward]

They're shipping all the programming jobs to India anyway..

Not future - Instant bump in malware & profits

[Anonymous Coward]

Not just the possible (and unlikely, as explained in many other comments - how do you draw the line?) future ban.

By stirring up the issue he increases the chances of malware activity now, as various hats scramble to collect info and test their ideas.

Instant bump in virus and malware activity & thus profits.

His defense: "Law of unintended consequences"

Unintended. Riigghht!

We need a firebell in the night

[orthogonal]

So gentlemen, what is to be done?

I'll tell you: just what we did to Intuit: kick Symantec where it hurts, in the pocketbook, until Symantec is ready to disavow Chris Schwarz and his attempts to limit free speech and free inquiry in the name of profit.

I've always had a soft spot for Symantec because of that awesome DOS product, Norton Utilities. And I still have a copy of Peter Norton's 8086 assembler tutorial. Just saw it yesterday, but now I can't recall which bookcase it's in.

But no more. I'm afraid this uses up my good will, and my willingness to see Symantec as the "good guys".

First, let's let Symantec know how we feel. The main switchboard number in the US is (541) 335-5000. The worldwide headquarters number is (408) 517-8000. Tell them you're a computer professional or enthusiast, that many non-specialists rely on you for advice, and that you won't be recommending their products again. And tell them why: because Chris Schwarz whats to criminalize people like you for warning other people about security vulnerabilities.

And then let's do what we said we'd do:

• don't buy Symantec products;
  
• don't recommend Symantec;
  
• actively recommend against Symantec;
  
• and tell your friends, your colleagues, your family, exactly why: Symantec wants to suppress free speech in order to maintain a monopoly;
  
• explain that Symantec wants to throw into jail (that's what happens when you outlaw something) computer professionals like yourself just because they would warn people of real threats to their security.
  

Re: I support this...

[Anonymous Coward]

Someone linked to SMBDie on slashdot, somtime back. Seriously folks.. what hacker wannabe could resist testing it?

The right to bear arms...

[jamie(really)]

... But not information.

Such a Law would destroy their market

[Crashmarik]

Youd have to eliminate the ultimate tools of virus writers. The idiotic users that go around opening attachments from people that they don't know and refuse to keep their computers properly patched.

Lets face it most virus propagation occurs because people don't know better or don't care because its not their problem. The real tool of virus writers is the willfull ignorance of the userbase. The truly sad thing about this law is it will tend to extinguish pockets of understanding.

Oh well one more Eye for an Eye idiot thats out to blind the world.

Alternatives with unforseen consequences?

[tugrul]

But could we find ways to engage kids within risk groups and help them find useful outlets for their talent, so they could receive positive feedback and recognition for their work instead of getting their kicks unleashing their work on the world?

Something occurred to me when reading this. What if we need these kiddie's to do what they do today? These recent news makers are relatively harmless compared to the worst that can happen. If you've read /. long enough, you've seen the suggestions of what a really malicious virus/worm could do. Would you rather see the systems of those ill prepared to maintain them all knocked right offline by a premature brute, or would you rather let them silently fall prey to those with a real agenda?

We should regard the issues we have today as the side effects of a vaccine. A little bit of uneasiness now, but protection from all but the most determined adversary. And the law already completes the vaccine analogy by punishing those who are caught actually perpetrating the crime. Outlawing the vaccine of full disclosure itself is just as silly as it would be to skip those childhood vaccinations.

Re:Alternatives with unforseen consequences?

[Satan's Librarian]

A little bit of uneasiness now, but protection from all but the most determined adversary. And the law already completes the vaccine analogy by punishing those who are caught actually perpetrating the crime.

Personally, I'd rather not throw kids in jail and ban them from computer usage once they get out - that's a good way to create a hardened criminal or a very bitter and suicidal geek.

There will always be someone writing viruses - whether for misguided political motivations, as a last gesture from a disgruntled employee, or for commercial interests. For example, there's a lot of speculation that SoBig is the work of a professional spammer.

But it would be good to take the kids out of the equation without destroying their futures.

And unfortunately, I'd hardly say that typical security has gotten much better since the Morris worm made its rounds years ago. It's still the same in most places - nonexistant. Places that hire good people to protect their systems improve every day, but for most companies they don't seem to think security is worth the salary a really competent sysadmin usually requires (or they simply can't afford it).

I don't think that's going to change until having a virus take down a company's servers has a larger chance of destroying the company rather than just inconveniencing it.

What about compilers?

[excessive]

Compilers are tools available on line that can be used for malicious purposes by hackers and virus writers.

Anyway, why should paid for tools be any different?

Obligatory Microsoft Bashing

[fydfyd]

So if virus abetting tools are outlawed then I imagine that the Sale, Possesion, or Manufacture of Office would be punishable by no less than 10 years' imprisonment or fine no less than $100,000.

*sigh*

[Anonymous Coward]

does the writer of the story know the difference between affect and effect?

affect is a VERB.. and effect is a NOUN..

not so hard.. eh mate?

Since it would kill BSD and GPL'd alternatives....

[Satan's Librarian]

I'm curious, are there any viable open source alternative anti-virus products out there?

I might be willing to lend a hand if anyone has such a project and needs a coder. I bet you could reduce the money available to lobby for such stupid laws by commoditizing the market and destroying the profit in creating such laws - and such a product, if done well, would benefit the net as a whole.

I'm aware of Clam AV, but since it's POSIX oriented, it's not really a replacement. I'm thinking of something that supports modern AV features under Windows - e.g. real-time scanning, prevention of execution, modern heuristics, auto-updates, etc.

Of course, for corporations, the best solution would probably be something more along the lines of an access control program that disallowed use of any products that weren't officially sanctioned.

My thoughts as well

[0x0d0a]

tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?

Pretty much what I thought. There isn't a lot that you can really ban that would stop a virus writer without negatively affecting regular ol' developers, much less people who work in the security field.

Frankly, I find all this silly. Most people that are handing around information on how to produce viruses will also hand around copyrighted software as well. That's illegal, but it really doesn't seem to stop them.

The right solution is to harden hosts against viruses and worms. Outlook is a huge vector, because it has traditionally made embedding active content and executing attachments very easy. Outlook should go away. The macro system in Word is inappropriate for a format frequently used for general document distribution. Permissions should be tightened up -- there's a reason the UNIX world doesn't run into viruses.

Re:My thoughts as well

[Abreu]

The Unix world

• does

run into viruses, but Joe Sixpack doesnt run any variant of Unix.

If Linux ever gets "world domination" (bear with me, dont laugh yet) it will be plagued by dumb users and 133t script kiddies, almost the same as windows now.

And now, before someone flames me, please note that I said "almost"

Re:My thoughts as well

[BlackHawk-666]

Is it because all the Unix gurus are too busy writing Windows viruses and laughing their asses off about how easy it is?

Re:My thoughts as well

[0x0d0a]

The Mac world is now many, many times larger than the Windows market was when it was already flooded with new viruses. It still hasn't seen the inrush that people have claimed would happen as it got larger.

Unix machines host many more servers than Windows machines, but there hasn't been a Code Red or Nimbda for Unix. There are worms that exist -- but they are far more limited in scope.

It's not the OS itself -- that's true. It's also care being taken WRT application software. While the userbase plays some role as well, all three elements -- OS, apps, and users -- tend to be more aware of security in the Unix world.

Not a run-on sentence

[0x0d0a]

It's not a run-on sentence. It's gramatically correct, though it is quite long. Take a look at Webster's Run-on Reference.

Legitimate uses

[BinBoy]

information [...]which could be used by malicious hackers and virus writers

This is exactly the same information that's used to prevent and disable viruses.

but hunting *is* murder

[DrSkwid]

Thou shalt not kill.

I don't see any species / race mentioned in that commandment.

Goddamn Christians are so selective in their interpretation.

fools

Re:but hunting *is* murder

[GlassUser]

That's because that's not the comandment. Go read the original version and learn what you're talking about.

Re:but hunting *is* murder

[drakaan]

Two questions:

1. Is celery alive?
2. What flavor kool-aid goes best with most microbes?

(I'm guessing grape goes best, but that's just a guess)

Re:hey

[Anonymous Coward]

and a spellchecker.

It's viruses

[DrSkwid]

Anything else and sound like a wanker.

Re:It's viruses

[shepd]

It's co.uk.

Anything else and you simply don't sound as British. :-)

Impune Impugner! Only dead languages have no grammar and spelling misteaks! Computers get virii! The world comes to an end! Watch ITV News for more disinformation.

defending society from them.

[DrSkwid]

Would that be the same North America Government that has more people locked up per head of population than any other country ?

Maybe it wasn't labelled :

[DrSkwid]

For authorised use only.
Only to be used as a tool for insertion / extraction of screws.

Re:Maybe it wasn't labelled :

[ralphus]

Crap, now all the prying i've done with my flathead screwdriver has probably voided the warranty.

Re:Maybe it wasn't labelled :

[swb]

..and pissed off your junior high shop teacher, who's told you "...a thousand times that its a screwdriver, not a fucking prybar, chisel, scraper, trowel, knife, boxcutter, punch, doorstop, icepick, or any of the other unauthorized uses you've been using it for, and I don't care of Sears/Mac/Snap-On promise to replace it no matter how it breaks."

Bugtraq, smugtraq

[harriet nyborg]

Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks.

contrast this with the words of

... John Schwarz, president and COO of antivirus firm Symantec, who called for legislation to criminalize the sharing of information and tools online that can be used by malicious hackers and virus writers.

so, "information sharing on threats and vulnerabilities" is OK, but "sharing of information and tools" isn't.

as a Symantec customer, i expect you to be smarter than the 16-24 year old punks who "share information and tools" to make variations on well-known hacks.

it seems to me that most problems are the result of programming flaws, mistakes, and plain old "gee wiz didn't think someone could do that" ignorance on the part of developers.

more law enforcement isn't the answer, banning books isn't the solution. technical diligence is.

the job of Symantec is stay ahead of the hackers, not to close the doors after them.

Gruff marketing fluff

[drsolly]

This is just marketing fluff. I've seen this so many times.

He was being interviewed by Wired, and wanted to make gruff noises about the virus issue. He's a COO, so obviously he isn't technical enough to know what he's talking about. The danger, of course, is that because he's a COO, some dimwit doesn't realise that COOs don't know anything, might take him seriously.

If this did ever happen, it would be disastrous for Symantec and the whole antivirus industry. Not because there would be fewer viruses - that would be almost unchanged.

The disaster happens in the sharing of specimens of viruses. In order to code up detection, identification and repair, you have to have one of the things youj're trying to handle. So, where do antivirus companies get specimens?

Two sources. 1) from their customers. This legislation would make it illegal for customers to send speciments to the AV companies using email or whatever. So what you gonna do, copy it onto a floppy disk and put it in the post? Not likely.

2) From the other AV companies. There's been an agreement in place for a great many years between the techies of the AV companies, that specimens get shared, so that when a new thing surfaces, customers aren't forced to buy an AV from any one source, customers still have choice. That specimen sharing would become criminalised.

I've just written to some people to explain that if they really want people like me (and you and you and you) to send them specimens of things that turn up, then they mustn't criminalise that.

Re:Gruff marketing fluff

[Satan's Librarian]

It's good to see you posting :) It sounded from the BugTraq article that Alfred posted that there was a bit of internal backlash already, but with some of the founders of the industry making waves one can hope that Symantec will make the sensible decision and never allow their clueless management and marketing fluff to go in front of government legislatures again.

I'm curious - what do you think of my suggestion for reducing the number of kids in virus writing? I know it would be very ambitious, and would need considerable effort and cooperation between a large number of ethical and talented professionals with no direct monetary gain to encourage such participation, but to me it seems like it might help. If such an alternative had been present in the late 80's and early 90's, I suspect I would have been interested.

Criminalizing tools?

[rikkards]

make it a criminal offense to share information and tools online

I guess that makes MS Visual Studio and MSDN illegal?

I was in Sears the other day...

[Jerk City Troll]

I noticed you can still go into the hardware (screw drivers, power tools, etc.) section of Sears and buy bolt cutters. Bolt cutters have a legitimate use, even when used for cutting pad locks. However, I am sure that some have used them to gain illegal access, somewhere! Quickly, someone tell the government so we can make them illegal!

Of course, if Symantec has their way, they'll also make security testing illegal too. Idiots.

Symantic tool wants people to stop writing virii?

[louissypher]

Fire this man immediatly! Seriously, corporations such as this have the most to gain from massive virus outbreaks.

grammar nazi

[theblacksun]

negative "effects"

So where is Open Source AV?

[SlashDread]

I would seem to think it is usefull, and would be a nice replacement for buggy, proprietary, craptools, like McAfee. And Yeah, it should run on windows. /Dread

Symantec's product outlawed!

[penguin7of9]

Great! Maybe this will mean that Symantec's awful product will finally become illegal to use. After all, one of the first thing a virus writer needs to check is whether his virus gets caught by common antivirus software. And, unlikely as it may seem, even Symantec's software occasionally does actually catch viruses (usually, it just incorrectly claims that random shareware or free software contains virusese).

The Corporate Club?

[ClubStew]

Don't kid yourself, there are plenty of others out there just like them who would like nothing more than to make the so called 'security community' an exclusive club open only to corporate types who see things their way.

So, I guess the MS.Blaster worm was only propagated by corporate - and most often firewalled - networks? It wasn't caused by the vast numbers of broadband customers with entirely open computers on countless networks? Hmm.

The remarks that this statement targets (it was a statement made against Symantec) are uderly rediculous. The way to get things done is not to remain hush hush. NTBugTraq often forced Microsoft (et. al.)'s hand to fix a bug that was proven in concept but, perhaps, not yet exploited. It was only a matter of time before the hole would be exploited. If Symantec is turning their efforts of keeping machines "safe" to the "corporate machine", they aren't getting my or my company's business anymore. We need someone that will push to get bugs fixed and viri stopped at all costs - even if it means putting pressure on the publisher.

Besides, almost any post-back news site and development community on the 'net would be liable if such a law was passed. My email address is obtainable from this site and many others (SPAM-proofing aside, which isn't always hard to break if the crawlers look for common patterns). They're sharing my email address and, perhaps, other information.

If it's community backlash they're merely trying to avoid, then it's community backlash they deserve.

Are you sure?

[Anonymous Coward]

The Liberian "government" wasn't able to govern at all and look at the mess the country went into.

As Aristotle once said, there is virtue between the extremes. Too much government and things stagnate because everything is predictable. Too little government and things stagnate because nothing can be predicted (including your safety from injury or theft) even using the best precautions and forethought.

obnoxious grammar nitpick

[sammy baby]

This article takes a look at the negative affects and also a couple of recent examples of "censorship legislation" backed by the COO of Symantec...

Negative effect . Not affect .

Thank you, I feel better now.

Apparent Misquote

[KrispyKringle]

It's probably worth pointing out that this discussion took place on Bugtraq, the Symantec-owned full-disclosure mailing-list, a few days ago. Apparently, this is more of a misquote than anything. See http://www.securityfocus.com/archive/1/337333.

Ethics

[ScrewMaster]

Well, even if Symantec were one of the "security elite" (whatever that means) I suppose that they are saying we should blindly trust both their competence and their ethics. As I am not one of the "elite" I can't speak for their technical competence however any company that stoops to using spam to the degree that they do has questionable ethics so far as I'm concerned. I frequently get a dozen or more Symantec messages every day.

he must just be posturing

[bbc22405]

It makes no sense. Why would the COO of Symantec want there to be fewer viruses, fewer virus writers, etc.? As a good capitalist, why wouldn't he want his market to increase? Why wouldn't he want the demand for his product to increase?

My conclusion is that he's just posturing. Responsible legislators should ignore him. I hope they do.

Down w/ Symantec..

[Anonymous Coward]

Someone has to develop a kick ass virus scanner and make it freely available. Symantec is becoming a monster. Cut off Symantec's revenue. Make them go away.

Very important

[theolein]

It is important in issues such as this that people not only complain here but also write letters to their Congressmen, Senators, MP's whatever, explaining their point of view. This is the only way that obviously crooked motions such as this can be dismissed.

Another way is to write to companies such as Symantec and inform them that you will no longer be purchasing their products.

Do it. Complaining here won't stop any laws.

It's "effects", dumbass!

[Anonymous Coward]

Yeesh. Why is it the slashdot community, some of the brightest people around, cannot grasp this simple concept?

"Effect" is the noun form. "What effect will it have if I punch your smug, stupid face in the mouth?"

"Affect" is the verb form. "Would it affect you negatively to have your tongue removed?"

GET IT RIGHT ALREADY!

Conflict of Interest

[dpete4552]

Wouldn't this be a little like shooting themselves in the foot considering how they make their money? You'd think they'd want as many script kiddies and viruses out there as possible as that would increase demand for their products and services.

Why not get right down to the point.

[Anonymous Coward]

...and just make Microsoft Windows illegal since it is the root of 99.9% of *ALL* the virus/worm/trojan problems the world is experiencing right here, right now, today.

Re:bit tricky

[GlassUser]

You're ill equipped to practice debate or logic then, as pretty much every writing formative of our cultures is in a language other than modern english. You would be well advised to learn Greek, Latin (both of which are used extensively in antiquity) and Aramaic (ancient hebrew, a very colorful language when used in poetry). You seem to have some unresolved bitterness issues too. You might ask yourself why you hate Christians.

I doubt this is true

[pantycrickets]

If it is, then Symantec will be out of business. Why would they want that?

I didn't even read the article

[gone.fishing]

I've never responded to a Slashdot post without first reading the article and a number of comments before but this time I am just climbing straight up on my soapbox!

I know this is outlandish but I propose we outlaw knives because they can be used to kill someone. History shows us how dangerous the knife is; For generations, the knife in various forms has been used to kill and maim people. Therefore, I think we should outlaw it. While we are at it, lets outlaw hammers, candle sticks, and rope since they have all been used to kill people.

My point is that tools sometimes have to be dangerous in order to do their jobs. It is not the hammers fault if someone decides to use it to bash someone's head in! The same is true for the knife. Software "hacker's tools" are tools, just like hammers and knives. They can be used for good (and usually are) or bad (and sometimes are) but that does not mean they should be outlawed.

You know those "emergency hammers" that they sell to break car windows with? My guess is that more of them are sold to car-burgulars than are sold for their legitimate purpose. They are easy to conceal and break windows with a minimum of noise and fuss. Crooks use them every day. Why hasn't there been a cry to have those things outlawed, regulated, or controlled? It is because they are a tool, that the tool has a legitimate purpose, and that the crooks would simply use something else if it were made unavailable to them. I guess I'd rather have them carrying these hammers than a hatchett. Of course, I would rather see the crook in jail where he would have neither.

When Information Is Outlawed....

[nurb432]

Only outlaws will have information.

Making the law-abiding sheep ignorant and unable to support themselves.. requiring governmental influence.

Goodbye to-

[citizen6350]

"make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers"

So, goodbye to downloading DevCPP, getting code from Sourceforge.net, and CVS in general. Im sure you guys could think of more.

You're thinking about the wrong kinds of tools....

[DonGar]

Hum....

Would it also make Outlook, Word, and Windows illegal? After all, they are the tools most commonly used to write viruses...

Vulnerability research companies all criminal

[neoThoth]

Every advisory sent by a company to the public would therefore be considered criminal. I've read the jokes about notepad, vi, etc and yes they are funny. But in my line of work we find security holes all the time. And we publish enough details that one who is intelligent enough could reconstruct our work.
This kind of assinine law would essentially shut down all major security vendors (ISS, eEye, Foundstone, etc).
This may be to Symantec's liking since they have been aching to get into that market (after purchasing a small company called SecurityFocus). Oh wait they might have forgotten about that purchase. Because bugtraq DOES distribute that info.

Why they are saying that...

[Jerry]

Translation: We can only close the door after the fox has raided the henhouse. Util we see how he does it we can't make an anti-pick device to prevent them from breaking in the first million times.

Of course, making anti-pick devices (exploit tools) illegal won't interfer with the activities of the criminal class any more than making firearms illegal has bothered them. This CEO is just another in the class of people who just can't seem to grasp the fact that lawbreakers don't care about laws.

The tools that create exploits are the tools the create software: lanugages and compilers for them. A case can be made that the Corporations real agenda is to gain control of the tools for making software. If your product isn't needed by the Linux platform then the Linux platform is your enemy. If they get compilers outlawed only outlaws will use them. It won't stop the flood of WinXX infectors, as if Symantec wanted that flood to stop their only income stream, but it will stop folks from migrating away from WinXX to a platform that doesn't need their Symantec's software.

Heh

[christoofar]

So it would be illegal to distribute and use gcc / Delphi / Watcom C, and the other development tools hackers love to use?

It's not exclusively Christians.

[DrSkwid]

but they can fuck off and take the catholics, the protestants, the muslims, the buhddists, the toasists, the athiests, the marxists and the agnostics, the gnositics, the mormons, the hindus and the rastafarians with them.

So long as you are at the front, carrying the standard.

The only safe softcomputer...

[Roadkills-R-Us]

...is encased in concrete, wrapped in high explosives with hair-trigger detonators, locked in a vault, and dropped into the sun.

I know the comment I'm replying to is a "funny" remark, but I also know folks who believe it.

Nevermind that a system running only shrunk software on the net is still in danger; I am personally aware of *two* cases where shrink-wrapped software (SWSW?) was shipped *with a virus*. (Not intentionally, of course.) I'm sure there are more. One was *from* a company at which I was employed (I won't go into the details, but I will note that it was a security-related product, and the customer finding the virus was the DOD - it wasn't a happy day for anyone). In the other case, an acquaintance discovered the virus on a CD his company had bought.

Why they want this

[soft_guy]

So if you find a vulnerability in Windows and try to report it to Microsoft, you can be put in prison. They don't want to hear that shit. They just pay Symantec to make the statement because MS has no more credibility.

It's been tried before,

[mindstrm]

by the antivirus comercial sector.

Why won't it fly? Simple.

Symantec, and other antivirus companies, are no different than any other company person out there.. they are NOT elected officials, and are not police officers, or other law enforcement officers.

They have the same level of access, as far as the law is concernd, to virus materials as you or I do. To outlaw sharing such materials means an exception has to be made for them... and that leads to a government controlled, adn enforced, business... something we don't want.

wrong name

[Anonymous Coward]

Umm, that's John Schwarz.

Bad people don't obey good laws...

[seiko2]

Bad people don't obey good laws... That is just the way it works. Investing in today's youth is a good idea. I suspect though that the modern cyberpunk is striving for a world of more substance and reality. These kids don't respect the system because the system is such a joke in so many ways. The computer is a taskmaster instead of a tool, it must be overcome. Also many of them feel that if they wrote a program as insecure as windows they would expect to be fired, sued, or at the least be ashamed of themselves and disrespected by their peers. -- I hope whoever you get to teach kids understands such things... that is my take on it all

Corperate trolling?

[Trailwalker]

Chief Operating Officer of Symantec, John Schwarz, cleverly distupts /.ers from their usual thoughtful discussions....