Wassenaar Treaty Will Hamper Bug Bounties

msm1267 writes: If the proposed U.S. Wassenaar rules are enacted, researchers who make a living contributing to and participating in the numerous industry bug bounties may feel the pinch in their wallets. Worse may be the impact on the security of software worldwide since many independent researchers find a good number of the bugs that get patched.

Researchers are starting to speak out, not only about the rules' broad definition of intrusion software, but also about the potential need to share vulnerability details with a government if forced to apply for the required export license. Many may soon question whether it's worth the time and effort to go through the export process if governments are acting as a clearinghouse.

Comments

Of course it is a bad idea...

[houstonbofh]

Of course it is a bad idea! Most government ideas are. And yes, it will have a chilling effect on the white hats and no effect at all on the black hats. (Other than some people getting darker hats to continue to work.) The black hat 0day markets will love it, however!

Re:Of course it is a bad idea...

[fustakrakich]

Yep, nothing helps the 'underground' economy like good old prohibition. It's almost like the Black Hatters wrote the treaty.

Re:Of course it is a bad idea...

[gstoddart]

It's almost like the Black Hatters wrote the treaty.

You're almost there ... it was Black Hatters ... but ones who see themselves as the good guys and want to prevent information about security from being publicly discussed.

Because the only thing they care about is their continuing access to computer systems, and pretending they're doing it for our own good.

This is the shady government agencies taking out the competition, and keeping information secret.

Now, ask yourself ... 10 years ago how crazy would that sound?

Because these days, it's not crazy at all.

When they outlaw security, only governments and outlaws will have security. And then they'll be able to find you because you have security.

If you have nothing to hide, you have nothing to fear. The pretext of keeping us safe is just bullshit window dressing.

Are they delusional?

[ZorinLynx]

Why do governments think they can control the flow of security software and exploits over the Internet?

Bad guys already don't follow the laws, and will obtain and use them anyway.

Good guys testing security will probably obtain and use them anyway because the probability of actually getting caught and prosecuted for it are nearly nil if it's not being used in a crime.

In other words, these laws stop no one except maybe one or two goodie-two-shoes. What's the point?

Re:Are they delusional?

[fustakrakich]

What's the point?

Provides *probable cause*...

Re:Licensing should be mandatory

[bezenek]

In most cases, software engineers do not need to be licensed. Maybe this is another item for the general licensing debate.

Re:Licensing should be mandatory

[parenthephobia]

But anyone with a PC can hack whatever ,whoever whenever and answer to no one?

Uh, no. That's already illegal.

The proposed changes to the law are sufficiently broad as to potentially make it illegal for me to notify a non-US software vendor about a security flaw I found in their software when probing it on my own computer.

Bad headline

[dlenmn]

Here's a better headline: Wassenaar Treaty _DRAFT__MAY_ Hamper Bug Bounties

The summary makes it sound like the treaty is a done deal; it's not. (TFA makes that point.) There's an open comment period through July 20th.

Yes, it sounds like the proposed wording isn't good. However, the final version isn't done. Give them useful feedback if you'd like. I'm sure the companies who use bug bounties have already given feedback.

Don't panic, yet.