Slashdot Mirror
Analysis Of Symantec's Stance On Censorship
robochan writes "According to this report in the Sydney Morning Herald, Chief Operating Officer of Symantec, John Schwarz, was quoted as 'calling for laws to make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers.' This article takes a look at the negative affects and also a couple of recent examples of "censorship legislation" backed by the COO of Symantec, and what little effect it has had on criminals, while having a substantial affect on responsible citizens."
But maybe it's time to rethink this portion of Speech.
Speech is not 100% protected. There are types of speech which have been declared illegal: obscenity, fighting words, etc. Perhaps it is time to take the fight to virus writers.
GCC has been made illegal.
- Compilers
- API documentation
- Text editors (can be used to write VBScript virii)
- Microsoft Office (macro virii)
Sounds like a really well thought out idea.Well I, for one, welcome our new Websters Dictionary Overlords
Your hair look like poop, Bob! - Wanker.
An important clarification from an article on this subject a few days ago:
6 85 53158.html
http://www.smh.com.au/articles/2003/09/12/10632
Asked whether Schwarz would like to clarify whether he had really meant that full disclosure should be legislated against, Symantec's Asia-Pacific public relations group manager Lindy Yarnold did not directly deal with the query but said: "Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks."
I don't even understand why he would want this. Its in his companies interest to have worms and viruses going aroudn because if there weren't any, nobody would need antivirus software.
"It is not how things are in the world that is mystical, but that it exists." -Ludwig Wittgenstein
In conclusion, whether or not Symantec's COO is just smokin' crack or understands what is at risk, any attempt to censor these critical security tools, including exploit code, from the Internet will result in a constitutional travesty followed by a significant market downturn, a degraded security community, and the commercialization of vulnerabilities where the market is driven by the criminals we are trying to "stop".
Those damn virus-helpers over at Symantec, I hope the law skins them alive.
I've found that my posts don't format quite right w/o a sig.
I guesss they Symantec people themselves expect not to be subject of their new law?
If people can't discuss bugs and security problems online, the only places it will be done is privately, i.e. in Symantec's and NAI's labs... this is one way to kill your competition--get the government to outlaw it.
I believe it is illegal in most states to be in possession of 'burglary tools' such as slim-jims, lock picks, and the like unless you are licensed in some way to own them (mechanic, lock smith, etc...).
When (if ever) do 'hacking tools' fall under this category? Obviously any tool can be used with ill-intent, but are there specific pieces of software that could be classified as such?
I think this is the slippery slope defined. Even if it were a good idea to keep these tools away from easy access (I won't reiterate the many arguments why it isn't), it is extremely difficult to know exactly where the line from "general purpose networking tool" to "hacking tool" is drawn.
Considering that virtually any tool can be used to hack, when does something get legislated as illegal? Somebody uses a web browser to hack. Is the web browser now an illegal hacking tool?
Okay, maybe that was too easy. But a packet sniffer?
I think one could easily make an argument that that is a hacking tool. Ultimately, the legal definitions may center around "public perception" as often seems to be the case in technical legalities instead of technical accuracy. This is, unfortunately, because the general public typically doesn't understand technically how things work. Notice most bad press is based around technologies that the average guy doesn't understand.
We're treading on dangerous grounds Symantec...
Slippery Slope...
Sunny
Be my Friend
Well, there will always be virus authors, it's like banning weapons: you're only taking away from those who get things through legitimate means.
Think what this would ban: bug tracking and security lists, compilers, assemblers, debuggers, hex editors, etc. These are how viruses get written.
However, if the public doesn't have access to any of this (particularly security tracking lists), then antivirus companies become the one and only legal source for fixes. Presto, huge demand created, which means more legislated profit.
There's your paranoia for the evening.
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
Why does it seem that every single proposed or actual law targeted at "cybercrime" puts absurd limitations on legitimate research while having absolutely no effect on the criminals?
They've just outlawed a large chunk of programming knowledge. Well, non-US programmers now have a lot less competition! ;)
If you stick to shrinkwrapped software, and DON'T run ANY other form of executable, then you DON'T need anti-virus software.
So what is this "Norton AntiVirus" for? To help people who download cracked software keep their computers healthy? Sounds like a shady product to me.
"make it a criminal offense to share information and tools online which could be used by malicious hackers and virus writers."
On the positive side, couldn't this also be applied to Windows, IE, and Outlook? Ignoring the buffer overflows (which all software has) these programs have been developing, promoting, and expanding the viral capabilities since at least 1998.
After all, there's more documentable evidence of Microsoft staunchly keeping an "open" envrionment to incubate and inspire malicious hackers much more so than the white hat hackers simply exchanging exploit documentation.
The real question is, why wont symantec create software that will deal woth these issue as they arrise. It seems like someone is trying to take the load off the company. It would be like Ford trying to make the speed limits of all roads 10mph. Now, they dont have to worry soo much about making a safe car, as accidents are less likely to occur.
Speaking at Defcon 12 - Credit Card Networks Revisted: Pen
As Shaw said, patriotism is the last refuge of the scoundrel. Applied judiciously, it can also be very profitable.
Panurge has posted for the last time. Thanks for the positive moderations.
Don't look at me I voted for Kodos!
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla
ANother poster mentioned that this would be a really bad idea for Symantec because they stand to profit from MORE viruses and worms, and more illegal activity in general. If this were true, this fool would never have mentioned this idea in public, let alone made a serious proposal.
But it's NOT true that a law like this would diminish incidents of new viruses and worms. Like the article says, it's already illegal to hack, and yet we still have hackers. Why?
1) 99.9% (or some similar ridiculous figure) of damaging incidents never lead to a prosecution--too little monetary loss to justify law enforcement attention.
2) Lack of willingness by private sector companies to report (and therefore allow legal penalties to accrue) computer security incidents--they don't want the bad publicity.
The existing laws don't work because they're not enforced often enough when violations exist, either because the violators aren't caught or because prosecution/investigation isn't done. So a new law will do WONDERS, I'm sure, to further intimidate those script kiddies.
It's obvious, though, just how much Symantec could gain from this--goodbye non-commercial security clearinghouses! You'd violate the law to post to an open forum, so nobody will bother (I'm sure Synamtec would contribute resources to policing that aspect), and so there won't be any good open, public security resources. That gives Symantec the perfect market opportunity to fill the vacuum with a new pay-for-info service on pending bugs. The creation of a commercial relationship with subscribers gets them a free pass on the new law (it's not really public, more like those $1500 Gartner reports). And we all get fucked in the meantime.
This is so fucking transparent. I hope that boycott idead gets off the ground--I'd start it, but me and mine are all off Symantec, anyway.
What about the programmers who were stupid enough to create a hole for the vulnerability? I know its hard to error check code, but some holes are just that...stupid. As for your blaster worm comments, I dont think the code was released. You obviously have not programmed anything, it is not as easy as copy and pasting code.
Speaking at Defcon 12 - Credit Card Networks Revisted: Pen
I've said it before, and I will say it again, hiring Yoran is going to produce a huge conflict of interest, and it seems it has already started. Personally I think this comment was made solely to gain a favorite view in the government's eyes. Remember government spends millions on pork barrel garbage, and I'm sure Symantec is looking forward to riding the gravy train back and forth.
All aboard!
MoFscker
my worst fear when Symantec bought SecurityFocus was the ability to exercise free of speech and free research on bugtraq... now it is just matter of time when corporate censorship begin to infect what can be said, research, discused or developed on the mailing list.
This is the same mentality that would ban baking soda because it could be used to make crack, hunting rifles because "guns" are used in crimes, and information about making black powder because it could be used for explosives.
If the software provider has been warned about the issue and provided a copy of the exploit code for testing their fixes, I have absolutely NO sympathy for a vendor which doesn't provide a fix.
Nor do I subscribe to the asinine american penchant for blaming everyone else for the stupid decisions and accidents individuals encounter. Spill your coffee, "reenact" a video game, commit suicide after listening to Ozzy -- and blame/sue someone else.
Bullshit.
It's time to stop trying to make excuses for stupidity and put the blame squarely on the shoulders of the perpetrators. If you want to blame someone, blame our pathetic spineless north american governments who are more concerned about the "rights" of criminals than defending society from them.
If some script-kiddie is smart enough to download and fire up cracker scripts, they're damned well smart enough to know what they're doing is wrong, and should pay the price when caught.
I do not fail; I succeed at finding out what does not work.
the confused people seem to get into high places to deturmin the fate of millions?
"Laws that forbid the unrestricted distribution of information...make ignorant only those who are neither inclined nor determined to commit crimes...Such laws make things worse for the victim and better for the criminal; they serve rather to encourage than to prevent unauthorized access to computer systems, for an insecure system may be attacked with greater confidence and ease than a secure system."
The other side is that the second such censorship is enforced, people who right now are innocent will become criminals - why? - because they have no other way of defending themselves but to go against such censorship!
You are confusing me with someone who cares.
In otherwords, if you outlaw the legitimate dissemination of information regarding viruses and how they are made, you just made writing a GPL or BSD licensed antivirus program illegal - obviously anyone involved in such a project would have to break the law to obtain virus samples, disassemblies, and information. This might be good for Symantec, but it sucks for the rest of us.
However, there is a problem. There's a ton of viruses coming out every day, and the internet makes an extremely fertile ground for even a poorly written virus or worm. A simple virus or worm can literally bring a corporation's operations to a halt for a day or two - even if critical machines run moderately secure operating systems, the traffic overload and DDOS'ing from the compromised machines can be hell.
Most virus writers are kids that feel alienated by "the system". I think most studies have shown that the average virus writer ages are between 14 and 24 - meaning when people get older and join society, they generally phase out of virus writing for moral or practical reasons. For several papers on who exactly writes viruses, go here.
So how do we prevent these kids from writing viruses? Outlawing information regarding viruses is a lot like outlawing the purchase of spraypaint - it isn't going to work, and it makes life suck for the rest of us.
But could we find ways to engage kids within risk groups and help them find useful outlets for their talent, so they could receive positive feedback and recognition for their work instead of getting their kicks unleashing their work on the world? I bet if you got a teenager that otherwise felt the world was against him or her involved in an open-source project they got excited about, where they were tutored and provided with positive feedback by more experienced mentors - they wouldn't have the time or the inclination to write viruses and will learn some very valueable skills that will be useful to them.
So how about this - start something similar to SourceForge for teens, and find programmers willing to donate their time mentoring these kids and helping them take their skills to the next level while teaching them the ethics and responsibilities of a first-rate programmer? Obviously such a system would need to be watched for abusive adults and any found would need to be banned and/or prosecuted, but if a bunch of good coders that gave a shit about kids did it I think it could seriously make a dent in the growth of the virus problem.
The other solution would be to make apprenticeships mandatory for budding programmers :)
I write code.
It's not illegal to be in possession of burglary tools. If that was the case, you'd be breaking the law just by keeping a crowbar in the trunk of your car.
It's illegal to be in possession of burglary tools while committing a burglary, under the theory that bringing burglary tools to a burglary shows that you approached the burglary with premeditation and planning. Premeditated, thought-out-in-advance crimes are almost always punished more severely than "amateur night" or heat-of-the-moment crimes.
E.g.., if I use a rock to break a car window, reach inside and pull out the stereo... maybe I'm a career criminal, or maybe I'm just someone who made a really stupid choice.
But if I've picked the lock on the door with a SlimJim, brought open specialized tools to crack the dash and remove the radio in 15 seconds flat, then it's a pretty good bet I've done this crime before and I'll continue to do it in the future--both of which make me a more serious criminal in the eyes of the law.
My corner convenience store has buckets of Slim Jims! Now I have to get a license to eat one? Also, how do I burglar with one?
Strange women lying in ponds distributing swords is no basis for a system of government.
We'll just share them over freenet along with instructions on how to build bombs and the like.
Guns - Guns don't kill people, people kill people.
Hacker tools - Ban them, put anyone who writes or shares them behind bars??
File Sharing tools - Ban them, put anyone who uses file sharing behind bars??
In my post I specificly mentioned the Bill of Rights. If that does not have something to do with, "The province of the court is solely to decide the rights of individuals." (Marbury v. Madison.) then I don't know what does.
The Court's statement signifies that it only settles disputes that arise between parties (i.e., individuals in most circumstances). These disputes have to satisfy the "case or controversy" requirement of Article III of the Constitution. To establish a case or controversy the plaintiff must have standing, which requires a (1) concrete, particular (as opposed to generalized) injury, (2) caused by the defendant's actions, (3) that can be redressed by favorable court adjudication.
With the foregoing established, the Supreme Court cannot issue advisory opinions because there are no sufficiently interested parties whose rights are to be decided and thus no "case or controversy."
The COO of a large pharmaceutical corporation explained why his firm was lobbying for a ban on all new forms of medicinal research...
Symantec make their money from viruses. Why on earth should we take their pronouncements in any other light? Their dream world is one in which only the criminals and the megacorporations have access to the technology, so that the citizenry squashed between the two can pay a jolly penny.
It's ridiculous. The only defense against malware is transparency, competition, and the evolution of something approaching a natural defense system. Not suppression of the tools people need in order to develop their defenses.
Ceci n'est pas une signature
The only reason the supreme court doesn't want to speak out, is to avoid individual justices being labeled as "Liberal" and thereby attracting the attention of the conservative horde. Who would demand the resignation of the justice, and if they were to resign, everybody would be royally screwed. The only difference between Roe V. Wade being the law of the land, and Bush's brand of christian (psychotic) conservatism is ONE VOTE on the supreme court.
Conservatives (and liberals) can "demand the resignation of the justice" all they want, but there is only one constitutional procedure for removing Justices from the Supreme Court, and it is quite onerous. See Art. II, sec. 4.
As for your other assertion that "one vote" is all that is needed to overturn Roe, perhaps you'd like to vote-count Planned Parenthood v. Casey, and rethink your position.
I understand that without a crime there can be no test of a law due to what you have just established. Or to put it another way, without a party that has been wronged there can be no case that can be brought before the high court to rule upon.
Ok, right. So what we are saying here is that, its ok to pass laws that aren't legal until the wrong someone. And then when they get wronged they have to go though the *whole* court system before they finally get ruled on and then maybe if your lucky the high court will hear your case vs the law and rule against it thus striking down a law that never should have been enacted in the 1st place.
All of that takes time, money, and much much effort. But hey, it's ok because you can site some reference in the original constitution (Where I'm quite sure the founder fathers envisioned it that way.) to where that makes it so.
Well, all I'm saying is I call shenanigans on that clause and hello to a way to review laws that effect, lets face it, the whole gawd damn world before we enact them.
Really, I know what I'm doing...Ohhhh, look at the shiny buttons!
It would make things like "Build your own virus" kits illegal. It's how the majority of virus writers formulate their viruses. They sure as hell couldn't write their own code.
Well, you're quite right. It would make virus building kits illegal.
But Schwarz also wants "to make it a criminal offense to share information". This means that indentifying a security vulnerability could also be prosecuted.
Now, Symantec won't be prosecuted, because they'll keep vulnerability information close to their corporate chest, as "proprietary trade secrets"; they don't benefit from revealing the information. And they'll make sure to make the right bi-partisan contributions, so everybody will know they are good upstanding citizens.
But if you, or I, or Willie White-Hat Hacker publicizes the information, we'll be facing one of Mr. Ashcroft's boys. One of his prosecuters with the unlimited budget, the Federal warrant, and the granite-faced gentlemen who are paid to carry guns.
That this just happens to scare off any upstart competitor to Symantec and MacAfee's control of their market, is, I'm sure, a purely unintended consequence of the fight against terrorism and the terrible threat to our nation of a haxored box adding a few hundred more spam emails to the torrent already flowing in from China.
Opinions on the Twiddler2 hand-held keyboard?
He's stating that "Only the information security elite should ever have access to information security issues." Or if Bill Gates stated: "Only large enterprises should write operating system software. Linux should be outlawed." This means we'd all be forced to eat Microsoft's or Symantec's 'dog food'.
I ask you this: When was the last time Symantec wrote a signature for Snort? How about a nessus plugin? They want to get rid of the open source security model because they can't profit from it!
As an information security professional, I don't even listen to Symantec as their information is generally 2-3 weeks too late. Its like waiting for the Sunday paper to read about the double homicide that's taking place right now on your front lawn. All their info is being published after the fact! If they successfully cut off all access to information that is happening in the security community, then they make everyone reactive rather than proactive.
It doesn't matter how much detail Symantec offers about a virus or bug. I want to be able to take an exploit, compile it and run it against a test server on a test network. Capture the packets transmitted and analyze them. I want to dissect the 'worm' or 'virus' and develop an IDS signature as well as produce a Nessus plugin to scan other servers. If I use other tools, I want to have enough knowledge to look into their signature files to realize that they're looking for the wrong stuff and thereby giving false positives (or false negatives).
It's called FULL DISCLOSURE
Symantec is trying to tell us that I can do all this with a really descriptive set of documentation? Or maybe I should just turn my entire enterprise security model over to Symantec. Uh huh, sure... I don't think so. Gimme the code for the exploit.
Allow me to digress for a moment, stick with me though -- it's not too OT...
Lets talk for a moment about the MS03-039 exploit; the brother to MS Blaster. It's a really nasty bugger. Once it exploits a machine, it creates a user account of "e" with a password of "abc#321". Oh yeah, and the new user has admin rights.
This means the worm could use the newly created account to create other accounts, escalate privileges on existing accounts or just change everyone's password to a random string of garbage.
The price we could pay by not patching every single server and workstation this time around could exceed the damage done by blaster by a thousandfold. All it has to do is successfully nail just one Active Directory controller. Imagine if every single user on your entire network had their password changed on them, at the same time.
When blaster hit, it crashed the RPC service which forced the machine to reboot 60 seconds after the RPC service came crashing down. Imagine now that in the infection process changes admin and user passwords, revokes privileges, then reboots the machine... Your network is now down, and you can't even get back in. You are screwed.
So, how do I know this info? Well, it just so happens that I've got the source code to the worm sitting on my machine right now! I'm not contributing to the project, but I'm sure as hell monitoring what is going on, and I sure as hell didn't get ANY of this information from Symantec.
The only info I'll get from Symantec is the day after the worm's release when they announce that blaster.b is in the wild and that I should have patched my boxes, and they're very sorry but there is no cleanup file available if it compromised your AD controller and changed all the admin passwords. Symantec also recommends you have current tape backups. That's like telling the car accident victim to buckle up. Just a little late there, Jack.
We are going to continue down the road of Full Disclosure debate until M$ et al. starts writing secure code.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
The DMCA.
Really, I know what I'm doing...Ohhhh, look at the shiny buttons!
I'll tell you: just what we did to Intuit: kick Symantec where it hurts, in the pocketbook, until Symantec is ready to disavow Chris Schwarz and his attempts to limit free speech and free inquiry in the name of profit.
I've always had a soft spot for Symantec because of that awesome DOS product, Norton Utilities. And I still have a copy of Peter Norton's 8086 assembler tutorial. Just saw it yesterday, but now I can't recall which bookcase it's in.
But no more. I'm afraid this uses up my good will, and my willingness to see Symantec as the "good guys".
First, let's let Symantec know how we feel. The main switchboard number in the US is (541) 335-5000. The worldwide headquarters number is (408) 517-8000. Tell them you're a computer professional or enthusiast, that many non-specialists rely on you for advice, and that you won't be recommending their products again. And tell them why: because Chris Schwarz whats to criminalize people like you for warning other people about security vulnerabilities.
And then let's do what we said we'd do:
Opinions on the Twiddler2 hand-held keyboard?
... But not information.
Anyway, why should paid for tools be any different?
So if virus abetting tools are outlawed then I imagine that the Sale, Possesion, or Manufacture of Office would be punishable by no less than 10 years' imprisonment or fine no less than $100,000.
Personally, I'd rather not throw kids in jail and ban them from computer usage once they get out - that's a good way to create a hardened criminal or a very bitter and suicidal geek.
There will always be someone writing viruses - whether for misguided political motivations, as a last gesture from a disgruntled employee, or for commercial interests. For example, there's a lot of speculation that SoBig is the work of a professional spammer.
But it would be good to take the kids out of the equation without destroying their futures.
And unfortunately, I'd hardly say that typical security has gotten much better since the Morris worm made its rounds years ago. It's still the same in most places - nonexistant. Places that hire good people to protect their systems improve every day, but for most companies they don't seem to think security is worth the salary a really competent sysadmin usually requires (or they simply can't afford it).
I don't think that's going to change until having a virus take down a company's servers has a larger chance of destroying the company rather than just inconveniencing it.
I write code.
I might be willing to lend a hand if anyone has such a project and needs a coder. I bet you could reduce the money available to lobby for such stupid laws by commoditizing the market and destroying the profit in creating such laws - and such a product, if done well, would benefit the net as a whole.
I'm aware of Clam AV, but since it's POSIX oriented, it's not really a replacement. I'm thinking of something that supports modern AV features under Windows - e.g. real-time scanning, prevention of execution, modern heuristics, auto-updates, etc.
Of course, for corporations, the best solution would probably be something more along the lines of an access control program that disallowed use of any products that weren't officially sanctioned.
I write code.
tools that could help virus writers? like, what? c++? visual basic? or, more realistically, nessus?
Pretty much what I thought. There isn't a lot that you can really ban that would stop a virus writer without negatively affecting regular ol' developers, much less people who work in the security field.
Frankly, I find all this silly. Most people that are handing around information on how to produce viruses will also hand around copyrighted software as well. That's illegal, but it really doesn't seem to stop them.
The right solution is to harden hosts against viruses and worms. Outlook is a huge vector, because it has traditionally made embedding active content and executing attachments very easy. Outlook should go away. The macro system in Word is inappropriate for a format frequently used for general document distribution. Permissions should be tightened up -- there's a reason the UNIX world doesn't run into viruses.
May we never see th
information [...]which could be used by malicious hackers and virus writers
This is exactly the same information that's used to prevent and disable viruses.
contrast this with the words of
so, "information sharing on threats and vulnerabilities" is OK, but "sharing of information and tools" isn't.
as a Symantec customer, i expect you to be smarter than the 16-24 year old punks who "share information and tools" to make variations on well-known hacks.
it seems to me that most problems are the result of programming flaws, mistakes, and plain old "gee wiz didn't think someone could do that" ignorance on the part of developers.
more law enforcement isn't the answer, banning books isn't the solution. technical diligence is.
the job of Symantec is stay ahead of the hackers, not to close the doors after them.
This is just marketing fluff. I've seen this so many times.
He was being interviewed by Wired, and wanted to make gruff noises about the virus issue. He's a COO, so obviously he isn't technical enough to know what he's talking about. The danger, of course, is that because he's a COO, some dimwit doesn't realise that COOs don't know anything, might take him seriously.
If this did ever happen, it would be disastrous for Symantec and the whole antivirus industry. Not because there would be fewer viruses - that would be almost unchanged.
The disaster happens in the sharing of specimens of viruses. In order to code up detection, identification and repair, you have to have one of the things youj're trying to handle. So, where do antivirus companies get specimens?
Two sources. 1) from their customers. This legislation would make it illegal for customers to send speciments to the AV companies using email or whatever. So what you gonna do, copy it onto a floppy disk and put it in the post? Not likely.
2) From the other AV companies. There's been an agreement in place for a great many years between the techies of the AV companies, that specimens get shared, so that when a new thing surfaces, customers aren't forced to buy an AV from any one source, customers still have choice. That specimen sharing would become criminalised.
I've just written to some people to explain that if they really want people like me (and you and you and you) to send them specimens of things that turn up, then they mustn't criminalise that.
make it a criminal offense to share information and tools online
I guess that makes MS Visual Studio and MSDN illegal?
I noticed you can still go into the hardware (screw drivers, power tools, etc.) section of Sears and buy bolt cutters. Bolt cutters have a legitimate use, even when used for cutting pad locks. However, I am sure that some have used them to gain illegal access, somewhere! Quickly, someone tell the government so we can make them illegal!
Of course, if Symantec has their way, they'll also make security testing illegal too. Idiots.
Join Tor today!
I would seem to think it is usefull, and would be a nice replacement for buggy, proprietary, craptools, like McAfee. And Yeah, it should run on windows. /Dread
So, I guess the MS.Blaster worm was only propagated by corporate - and most often firewalled - networks? It wasn't caused by the vast numbers of broadband customers with entirely open computers on countless networks? Hmm.
The remarks that this statement targets (it was a statement made against Symantec) are uderly rediculous. The way to get things done is not to remain hush hush. NTBugTraq often forced Microsoft (et. al.)'s hand to fix a bug that was proven in concept but, perhaps, not yet exploited. It was only a matter of time before the hole would be exploited. If Symantec is turning their efforts of keeping machines "safe" to the "corporate machine", they aren't getting my or my company's business anymore. We need someone that will push to get bugs fixed and viri stopped at all costs - even if it means putting pressure on the publisher.
Besides, almost any post-back news site and development community on the 'net would be liable if such a law was passed. My email address is obtainable from this site and many others (SPAM-proofing aside, which isn't always hard to break if the crawlers look for common patterns). They're sharing my email address and, perhaps, other information.
If it's community backlash they're merely trying to avoid, then it's community backlash they deserve.
It's probably worth pointing out that this discussion took place on Bugtraq, the Symantec-owned full-disclosure mailing-list, a few days ago. Apparently, this is more of a misquote than anything. See http://www.securityfocus.com/archive/1/337333.
Two questions:
(I'm guessing grape goes best, but that's just a guess)
"Murphy was an optimist" - O'Toole's commentary on Murphy's Law
I've never responded to a Slashdot post without first reading the article and a number of comments before but this time I am just climbing straight up on my soapbox!
I know this is outlandish but I propose we outlaw knives because they can be used to kill someone. History shows us how dangerous the knife is; For generations, the knife in various forms has been used to kill and maim people. Therefore, I think we should outlaw it. While we are at it, lets outlaw hammers, candle sticks, and rope since they have all been used to kill people.
My point is that tools sometimes have to be dangerous in order to do their jobs. It is not the hammers fault if someone decides to use it to bash someone's head in! The same is true for the knife. Software "hacker's tools" are tools, just like hammers and knives. They can be used for good (and usually are) or bad (and sometimes are) but that does not mean they should be outlawed.
You know those "emergency hammers" that they sell to break car windows with? My guess is that more of them are sold to car-burgulars than are sold for their legitimate purpose. They are easy to conceal and break windows with a minimum of noise and fuss. Crooks use them every day. Why hasn't there been a cry to have those things outlawed, regulated, or controlled? It is because they are a tool, that the tool has a legitimate purpose, and that the crooks would simply use something else if it were made unavailable to them. I guess I'd rather have them carrying these hammers than a hatchett. Of course, I would rather see the crook in jail where he would have neither.
Every advisory sent by a company to the public would therefore be considered criminal. I've read the jokes about notepad, vi, etc and yes they are funny. But in my line of work we find security holes all the time. And we publish enough details that one who is intelligent enough could reconstruct our work.
This kind of assinine law would essentially shut down all major security vendors (ISS, eEye, Foundstone, etc).
This may be to Symantec's liking since they have been aching to get into that market (after purchasing a small company called SecurityFocus). Oh wait they might have forgotten about that purchase. Because bugtraq DOES distribute that info.
Of course, making anti-pick devices (exploit tools) illegal won't interfer with the activities of the criminal class any more than making firearms illegal has bothered them. This CEO is just another in the class of people who just can't seem to grasp the fact that lawbreakers don't care about laws.
The tools that create exploits are the tools the create software: lanugages and compilers for them. A case can be made that the Corporations real agenda is to gain control of the tools for making software. If your product isn't needed by the Linux platform then the Linux platform is your enemy. If they get compilers outlawed only outlaws will use them. It won't stop the flood of WinXX infectors, as if Symantec wanted that flood to stop their only income stream, but it will stop folks from migrating away from WinXX to a platform that doesn't need their Symantec's software.
Running with Linux for over 20 years!
So it would be illegal to distribute and use gcc / Delphi / Watcom C, and the other development tools hackers love to use?