

Ask HN: What are the rules on publishing exploits? - ParkerK

I've always wondered, what are the rules (ethic wise and legally) on publishing exploits you find? Lets say you find a way to circumnavigate security features on an app; or find an oversight on a websites part where it doesn't verify user input.<p>I've seen people publish exploits anonymously, and on the other hand I've read stories of people like Cody Brocious [1] or Alexey Borodin [2] publicly explaining their exploits. On the other hand Billy Hoffman [3] got a gag order when he tried to reveal his work.  Does the type of exploit matter? Are there protections on hackers publishing research? Why is it that people aren't arrested en masse at Defon?<p>[1]: http://www.forbes.com/sites/andygreenberg/2012/07/23/hacker-will-expose-potential-security-flaw-in-more-than-four-million-hotel-room-keycard-locks/<p>[2]: http://www.forbes.com/sites/adriankingsleyhughes/2012/07/21/ios-in-app-purchase-hack-extended-to-include-mac-app-store-apps/<p>[3]: http://en.wikipedia.org/wiki/Billy_Hoffman
======
lawnchair_larry
There are none. Some believe in "Coordinated Disclosure", some believe in
"Full Disclosure", some in "Non-Disclosure". The disclosure debate is many
decades old. See: <https://en.wikipedia.org/wiki/Full_disclosure>

Admittedly, this article is poorly written, but I think it gets the main
points across.

Disclosing information is not illegal, but that doesn't always stop lawyers
from being hostile towards researchers. Attempts to do that usually end up
backfiring horribly, but they can temporarily ruin a researcher's
day/week/month.

~~~
ParkerK
Ohh okay, thanks! I assume that research involving illegal activity is still
illegal? But it sounds like other stuff is all fair game?

