> Hang on.. proof of concept exploit creation and distribution for zero days is “criminal activity” now?
Publicly publishing an exploit is so obviously First Amendment-protected activity that it’s almost tempting to want a test case.
Publicly publishing an exploit is so obviously First Amendment-protected activity that it’s almost tempting to want a test case.
It would be an interesting case if the defendant had good representation.
A true popcorn case if this would go to court. Would cause lot of governments to think about their backend choices.
https://krebsonsecurity.com/2022/06/what-counts-as-good-fait...
Skimmed the article. Not seeing it support your claim.
Responsible disclosure is an industry norm, but I don't really see how an independent researcher has a legal obligation to play by industry norms. If I discover that any product has a defect, I am free to blab about it all I want as long as it is truthful. There may be considerations beyond this if you are disclosing something discovered by breaking terms of service or by fucking with a computer that isn't yours, but discovering that your copy of windows on your machine has a flaw and telling people about it is protected.
Again, there isn’t really any case law I can find suggesting that skipping responsible disclosure opens you to any legal liability - which is the argument being made here.
"Congress shall make no laws ... "
The first amendment bars the *government* from infringing on your free speech. It has zero standing or bearing on private citizens or corporations.
Which is why people crowing about it on social media or universities are completely oblivious to the fact that these organizations have absolutely zero responsibility to enable your free speech.
This is a first amendment issue.