Hacker News Reader

Comment by hans1729 | Hacker News Reader

>That’s the crucial caveat that I think many missed regarding my call for a global moratorium: it is a prohibition on the commercial trade—that is to say, specifically the for-profit exploitation of society at large, which is the raison d’etre of the insecurity industry—rather than the mere development, production, or use of exploit code.

I don't see how prohibition would solve the problem here, people would just sell it in [insert rogue market].

Raison d'être is not trade, it's demand, and demand doesn't care about the DOJ.

Also, exploits aren't just an arbitrary good, but a tool of power themselves, so effective prohibition seems even more absurd.

What am I missing?

View on HN

There's a difference between underground criminal gangs discovering exploits and selling them on black markets and being able to raise capital, have legal protection, etc. while you hire experienced developers to find exploits that you sell to despotic regimes like Saudi Arabia.

I suspect that distinction is what you are missing.

Exactly, it wouldn't necessarily change the demand, but would hopefully reduce the supply (by raising costs). Being a legal entity has much lower cost of funding and much lower cost of operations than being an illegal entity. Otherwise most entities/corporations would not bother to be legal, which is clearly not the case.

Look how magnificently such a strategy worked for drugs.

It works for nuclear weapons.

It's a crude comparison, but software is a lot more like drugs than it is like nuclear weapons.

Is it? The fundamental reason the war on drugs failed is that drugs have relatively inelastic demand. Someone addicted to meth will find a way to get meth if it costs $10 or $500. Software exploits aren't like that at all. They are a tool used by gangs and governments that are only useful if they cost less than they're worth.

Software takes no less than a crappy laptop and a brain to create.

The Manhattan project consumed 10% of the total US energy output in the mid 1940s. And obviously uranium is hard to come across.

More notable is the fact that (like software transactions) drug transactions happen in private between consenting parties. The war on non-addictive drugs (say, psychedelics) failed too.

That's only because they're weapons of mass destruction. Nuclear capacity is essentially a step function - you either have it or you don't. Those who have it get to push around those who don't. There are some very strong incentives for the haves to prevent the list of nuclear powers from growing.

Also, unlike software vulnerabilities, nuclear weapons don't have a half-life counted in weeks.

Nuclear weapons don’t grow on trees. Bug grow by a side effect of programming.

Illegal recreational drugs are usually used by the buyer in a way that will only affect themselves. So they can't complain to the police if things go bad and they certainly won't if things go good. Enforcement is a huge problem.

NSO style products are used by one entity against another entity. As a result enforcement is a fundamentally different sort of problem. There is a complainant.

And there’s still a market for hitmen too.

This is such a shallow comparison, which seems to come up with every discussion around criminalization. Law enforcement isn’t 100% effective but that doesn’t mean every criminalized activity should be legal.

> people would just sell it in [insert]

This is a specific form of a general argument against any law - "people would just break the law by [insert a way to break the law]".

These arguments are obviously generally true (any law can be broken) but you usually don't need an absolute victory, just a legal weapon against the bad guys, which hopefully is hard to use against the good guys.

Snowden is specifically talking about how this prohibition will deter security researchers from working for this "companies". Having been in the field a while back, I agree with him. Most people won't jump the extra hoop you need to jump to work for an illegal industry if they can make bank without breaking bad.

You may underestimate how much government funding has widened and deepened the production side of the exploit world. Once TLAs outsourced and started buying exploits on the open market, the whole thing professionalized and became much more liquid. That kind of intellectual capital formation really changes things.

Mind you, the genie is out of the bottle. A half-hearted moratorium is unlikely to undo what Pointexter wrought.

Why have any law if bad guys will just break them?

There are different kind of things one law can forbid

- things that are in itself bad. (E.g. killing, stealing, ...)

- things that are neutral, but could be used to do other illegal things (encrypted message, selling weapons, ...)

The second category of things doesn't need to be illegal since the perpetrators would only be doing something bad if they violate a law for the first category and therefore can be prosecuted for that. But making it illegal prevent the potentially good use of it.

When /r/jailbait was the most popular subreddit on reddit, it was generating millions of pageviews in traffic. Sure, you can download Tor and see similar content on the deep web, but you have to know the .onion links and be tech savvy. The added friction goes a long way in removing access - and dissuades people who are on the fence.

That's not a good analogy. I don't agree with OP but the potential "customer" for /r/jailbait comes from a way bigger pool than the potential 0-day buyer. OPs point is that the people looking to buy this things will not mind jumping through hoops.

Reply on news.ycombinator.com