Slashdot Log In
HP Backs Off DMCA Threat
Posted by
timothy
on Thu Aug 01, 2002 09:35 PM
from the maybe-that-wasn't-such-a-hot-idea dept.
from the maybe-that-wasn't-such-a-hot-idea dept.
Bruce Perens wrote with this interesting reversal: "News.com reports HP has backed off of its DMCA threat." Which makes SNOsoft's official response thankfully beside the point now. Update: 08/02 05:37 GMT by T : Declan McCullagh points out this CNET story, which includes words from HP, Snosoft, and Bruce Perens. Writes Declan: "HP blames the snafu on... their lawyers!"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Misunderstanding? (Score:2, Insightful)
Re:Misunderstanding? (Score:5, Insightful)
Remind me, again, why I should continue doing business with an entity like this? Give me back the old HP.
Parent
We have zero evidence that HP will stop... (Score:3, Interesting)
Exactly.
We have zero evidence that HP will stop trying to hide the failures in its products.
If Carly Fiorina knew about this, then she also thought it was okay to try to use aggressive tactics to hide severe failures in an HP product. In that case, Carly should be replaced by the HP board of directors.
If Carly Fiorina didn't know about this, a major act by a vice president, then she is clearly not in control of HP. In that case, Carly should be replaced by the HP board of directors.
It was a Compaq bozo who made the threat... (Score:3, Informative)
Re:Misunderstanding? (Score:4, Insightful)
They got what they wanted. Then they said, "OK, everythings all right now."
Everything is not all right. A bully threatened someone smaller and got what he wanted out of it. If anything else happened, it sure isn't clear. But it will take a lot more than that before I ever trust them again.
Parent
Great news Bruce! A few questions about it... (Score:3, Interesting)
Anything else you can tell us about this fortunate reversal? Were you involved in knocking some reason into those responsible? How did the people in power originally decide that it would be strategic to weild the DMCA as a weapon against disclosure?
Sometimes, I guess,... (Score:4, Informative)
Re:Sometimes, I guess,... (Score:2)
Responsible full disclosure (Score:4, Informative)
Re:Responsible full disclosure (Score:3, Insightful)
So far, I have not encountered anything which excuses that, though I am willing to keep looking.
That HP has said "Now that you've withdrawn your threat to release infor about us, we won't threaten to pull the DMCA on you" doesn't count as very much of an appology at all. In fact, it doesn't count as an appology.
I do not feel that HP has yet done anything to redeem themselves for this disgraceful action.
further indication that DMCA does not hold water (Score:4, Interesting)
Vivendi sues bnet.d, originally was under DMCA, but filed under traditional copyright;
HP threatens under DMCA, but backs down.
i think companies *know* that if the DMCA gets taken to court, it will die and we will all live free, so they don't want to risk it. which, incidentally, means that we should try to as much as possible (within reason)
Re:further indication that DMCA does not hold wate (Score:2, Interesting)
On the contrary, I think that if corporations were under the impression that this "tool" would soon disappear from their arsenal, they would have incentive to make use of it ASAP and "get while the getting is good". It's like when retailers make sure to stress that an offer is for a limited time only to try to get people to half-panic and hurry in to the store. More likely, corporations that try to make use of the DMCA are encountering some seriously bad backlash from the community that makes them think twice about using the DMCA. I would suspect that they would only resort to the DMCA when no other weapons are available. That's sort of a good thing, I guess, but it suggests that the DMCA will be the corporate legal equivalent of the H-bomb -- the "no more Mr. Nice Guy" gun that's used more as a scare tactic than an actual weapon.
Hm, kind of a shame, in a way... (Score:4, Informative)
Perhaps they think they can cover the blemishes of their software with the blood of the people who point them out.
Before the arguing starts (Score:5, Insightful)
I think I would have rather it had been tested (Score:5, Insightful)
"We can say emphatically that HP will not use the DMCA to stifle research or impede the flow of information that would benefit our customers and improve their system security."
As long as the only test cases are against individuals and groups the public perceives as "black hats" (e.g. 2600), this damnable law will never be changed.
-- Terry
full disclosure is all about timing (Score:2, Redundant)
(i'm going to go a little bit further from the HP/Snosoft case, so don't be surprised if some of the statements below do not fit 100% in that case)
All these problems will vanish if people will choose to disclose vulnerabilities in a responsible way. Sure, HP's response has been harsh. But every security problem (especially when it's accompanied by an exploit) should be reported first to the vendor! There should be no exception from this rule. The person doing the reporting should give the vendor a reasonable period of time to fix it; say, a few weeks or so.
Only if the vendor does nothing in these weeks, only then the report/exploit/whatever should be made public.
If hacker H writes a comment on Slashdot, making public an exploit against some software made by vendor V, and does not notify V in advance (say, 2...4 weeks in advance), and then V sues H, then who's right?
H is right, because (s)he disclosed a vulnerability, and disclosing is good. V is right, because not being warned in advance, their customers are left to the mercy of script kiddies. H is wrong, because (s)he's obviously looking for cheap publicity (i published a zero-day exploit; mine is bigger), not for improving security. V is wrong, because they are filing a lawsuit against open disclosure, which is not a good thing.
See?
And the solution is so simple: DO NOT publish "zero-day exploits". Give the damn vendors an early warning. Only if they are lazy and do nothing within a reasonable time (2...4 weeks), only then you are entitled to go slashdot-happy.
I'm a big fan of open disclosure, freedom of speech, etc. But people who look for cheap publicity are not my favourites. If H is going to publish the exploit without early warning, i'll say V has all the rights in the world to sue the crap out of H, and put him(her) in jail for one thousand years, and i'll applaud that. However, if there was an early warning, within a reasonable time, like one month or so (unlike some popular security companies did recently), and the vendor did nothing and didn't provide a good reason for the delay (because such reasons could exist, if you think of it), then H is 100% entitled to publish whatever exploit he likes.
It's all about timing. It's all about being reasonable.
Reciprocal Civility (Score:5, Funny)
HP: Please don't. It would sortof reflect badly on us, and could cause trouble.
BRUCE: Well... OK.
HP: We're going to sue the pants off of anyone who reveals Tru64 vulnerabilities using the DMCA!
BRUCE: Please don't. This reflects badly on us, and could cause all sorts of trouble.
HP: Well... OK.
Good to know everyone's getting along.
It takes two to tango (Score:2, Interesting)
If this particular security hole is ever exploited by the "bad guys", we'll probably have both HP and Phased to thank. It really does take two to tango. The Phased exploit code would never have been published if HP programmers didn't mess up in the first place.
So this quote from Kent Ferson of HP in the News.com article was probably a big mistake:
Pretty clearly if there were ever to be any lawsuits over this particular bug, HP has much deeper pockets which are much easier to get to.
What were they thinking before? (Score:2)
The question is what they were thinking in the first place; it's not like you can actually a company and have nobody know. Possibly they just wanted a bit more time in preparing patches before SNOsoft released details. I think it's most likely that think that people won't remember who this incident involved, and will just think "Some big computer company tried suing someone who found a vulnerability in their product. I'd better avoid that big company. Now, was it MicroSoft or Sun?" Of course, as nothing is coming of it, there won't be much in the way of records on the subject. Or maybe HP's lawyers have been spending too much time in Germany and think they should threaten/sue people in HP's name without HP's permission.
Perhaps I'm completely missing the point here... (Score:5, Interesting)
Adobe brought a `DMCA violation' to the attention of the FBI to prompt the Skylarov / Elcomsoft affair. When they backed down, the FBI did not follow suit. Is it not the case that all a person or company can do is bring a `violation' to the attention of the FBI, and let them take it from there?
If this is the case, would not HP's original statement in regards to the researchers violating the DMCA be enough to set the ball in motion? If the FBI were to agree that the event in question is a DMCA violation, would their backing down be enough to prevent further action from being taken?
IANAL and I'm not even from the US, so maybe I've completely misunderstood how this works. But isn't there more to it than HP just deciding to stop waving the DMCA stick?
Re:Perhaps I'm completely missing the point here.. (Score:3, Interesting)
It is correct that a company can not bring criminal charges against a person or another company. When an individual sues another individual, it must be for a violation of civil law. The DMCA is a federal criminal law, so it is up to the US Justice Dept to per^H^Hrosecute victims. The FBI is like a police department; they do not engage in prosecutions, but they have the power to make arrests, conduct investigations with court orders, etc.
One of the many problems with the DMCA is that the line between civil and criminal prosecution is blurring. With Dmitry Skylarov, he was effectively arrested and prosecuted by Adobe; the FBI and the Justice Dept were willing participants, but I don't think there's much doubt that Adobe was calling the shots.
HP backing down from the DMCA threat is not enough to directly prevent a lawsuit. However, if HP will not cooperate in the prosecution (providing witnesses etc) due to public outcry, it is no longer worthwhile for the Justice Dept to prosecute, because they basically have no case. So again, it is not a question of actual policy but the effects of policy.
Hope this clears things up...
Re:Perhaps I'm completely missing the point here.. (Score:3, Interesting)
The FBI didn't follow suit ... at least based on what Adobe publicly said. But how much would you wager that Adobe told the FBI in private to stick it to Sklyarov? That's where my money is...
Remember: we have the best government money can buy. And Adobe has a lot of money...
slight relief (Score:2, Interesting)
My support rep does an awesome job for us, and is our "foot in the door" to HP. That's why I felt it necessary to get the message to him quickly. Now I'll have a good opportunity to follow-up with him regarding HP's response. They've typically done a good job for us, but we've been curious as to how the post-merger HP would behave. I hope this isn't an indication.
This is usually called saving face... (Score:2)
This is bad ... (Score:2, Insightful)
I'm sure any judge will realise how broad the DMCA is and as a result how damaging it can be to a persons rights as well as to a community of developers, not to mention privacy advocates.
Unfortuantely we have lost another great opportunity. HP like all the others want this law to remain. Only when the stakes are really high will they seek to enforce it
Re:This is bad ... (Score:3, Insightful)
You mean like Judge Kaplan did in the 2600 DeCSS case?
money for exploits? (Score:5, Interesting)
Don't get me wrong, as far as I'm concerned, it sounds like HP needs to spend more money on developers and less on lawyers. I'm not trying to defend their actions at all. But, it seems to me that if SNOsoft was merely acting altruistically, they shouldn't need to "build a relationship" in order to "transfer the information privately."
Re:money for exploits? (Score:3, Informative)
"working relationship" could also mean that 1) HP has a contact person assigned to snosoft, who will actually read and respond to snosoft's emails, and 2) snosoft will promise keep exploits and advisories quiet until HP says they are ready.
of course, you'd think this is how it would work anyway, without any formal agreements..
Re:money for exploits? (Score:5, Insightful)
(#include<std/disclaimer.h>, IANAL, etc)
But anyway, assume that SNO simply emailed HP the bug and a patch and HP said "thanks, guys" and rolled it out in the next point release. Six months down the line, SNO *could* (if they were evil enough) sue HP for breech of copyright. Delete the part of the email that said they had permission, etc, and boom.
That's no good.
So, they almost always put stuff out in writing specifying exactly who's giving what to whom and what each party's allowed to do with it.
This is why, if you watch MTV's Jackass, they specifically say at the end of each show "If you send us tapes of yourselves being jackasses, we won't open them. They will be thrown away." It's not that they don't think you could be funny; rather the contrary. They're afraid that if they see your stuff, and then end up publishing something similar by coincidence, they could be sued by you. Because there was no contract.
Furthermore, a contract between two parties, to be legal, must allow both parties to benefit from it. (Which is what separates a contract from extortion.) That's why you don't just give somebody a car and hand them the deed. They always pay you a dollar - so that a contractual agreement was fulfilled between the two of you. If HP and SNO were going to write some sort of contract stating what info SNO was going to give HP, and what HP was allowed to do with it, a transfer of money or other consideration must be given to SNO. (Now, it doesn't have to be a large sum of money. But corporations usually don't work in pocket change. So, SNO probably did want a decent chunk of cash for their part of the bargain.)
So, to summarize, "working relationships" always involve paperwork. Usually to cover people's collective asses. And they usually have cash involved, so that a mutual exchange occurs when the contract is signed. As to why that made HP's lawyers go trigger-happy, well, that's anyone's guess.
Parent
Snosoft security... (Score:2, Interesting)
According to Netcraft [netcraft.com], they're still running Apache 2.0.35 [netcraft.com]...
Re:Snosoft security... (Score:4, Informative)
Parent
Oops, we got caught (Score:2, Interesting)
One can only hope that vigorous outcry from vigilant people can convince corporations that they don't always have to do what their lawyer says. Lawyers don't have consciences. At least, they don't have independent ones. A lawyer believes whatever he is paid to believe. And so they are incapable of looking at any situation from a non-opportunistic/exploitative point of view. Only when their paymasters say, wait a minute, this policy doesn't work, I'm not going to just send that cease-and-desist or SLAPP or call the FBI or whatever, do these corporations do something in the public interest.
I thought so! (Score:4, Insightful)
They knew they would have their posterior kicked black and blue which would eliminate the DMCA threat power.
DMCA strongest if not challenged (Score:3, Insightful)
Anyone else email Ferson? (Score:4, Interesting)
believe everything you read in the press
primary interest and concern is for the Tru64 customers and that the
Tru64 engineering team is committed to finding and fixing any security
problem in the product and getting these fixes/notifications out to
customers ASAP. Trying to do everything possible for Tru64
customers is what motivates and brings me to work every day
(and night
that find security issues in the product to coordinate through the
CERT process, which has been set up to support both product
vendors and customers. Again, I appreciate your concern and
feedback.
Kent
-----Original Message-----
From: XXXXXXX
[mailto:teaser@XXXX.com]
Sent: Tuesday, July 30, 2002 10:56 PM
To: Ferson, Kent
Subject: Rethink this approach.
Concerning this Zdnet article: http://news.com.com/2100-1023-947325.html
HP is going about this all wrong. You have managed to alert many more
people of the mentioned exploit (by making legal threats) than would
otherwise have ever noticed the Bugtraq post. That genie is way to far oput
of the bottle to to be put back now and the poster will just comply to any
cease and desist requests. Besides, there are plenty of buffer overflows in
True64 according to the Bugtraq poster Phased.
My suggestion to you and your colleagues would be that you quietly fix the
code, in a timely fashion, and avoid both the bad publicity and potential
liability.
Thank you.
Actions, not words (Score:5, Insightful)
Lets wait for actions from HP, who knows what they'll do a year from now on some other bug. This also opens the door for MS or Oracle or whoever to do this, without being first, and citing HP, regardless of what HP said today. Can you really open your toaster now and see what's inside? This threat, even though withdrawn, has done what it was supposed to do.
It is what they call the slippery slope.
How many people sent Mrs. Fiorina (CEO) Feedback? (Score:3, Interesting)
I imagined the cross examination as follows with HP on the hotseat:
1. Isn't it true that HP learned of this exploit nearly a year ago and has done nothing except try to "silence" someone sounding a critical warning?
2. Can you explain to us what type control a person could have gained over an HP server using this security flaw?
3. Isn't it true that HP servers are used in key government installations, biomedical research labs, and fortune 500 companies and this flaw could have been used to compromise national security and commit corporate espionage?
4. Why would HP delay acting on this information for so long when so much was at risk?
Oh, this would have been soooo much fun to watch on Court TV!
Anyway, I was just curious how many slashdotters fired off a "polite" feedback.
Hollow Victory (Score:3, Interesting)
The DMCA still stands, it stifles research. Alan Cox is still afraid to step on US soil for fear of being arrested for doing a moral and ethical work.
How is this any sort of victory. HP wussied out. Snosoft wussied out. And maybe Bruce Perens wussied out too.
Where were the necessary changes to the law. Hackers need some sort of protection from this crap.
Imagine if GM said you could open the hood of a car? Would the american public stand for that?
If you found a fault in a Ford, would the american public want Ford to have 30 days to figure out if they want to deal with the problem?
Corps are getting to manhandle us because the public doesnt understand the issues and we're a powerless minority.
Does the auto insurance institute which does crash testing need to inform the car companies thirty days in adnvance prior to disclosing bugs?
We need a secure receipt mechanism when reporting bugs.
We need full disclosure.
We need full authorization to learn from each other, this means sharing how buffer exploit vulnerabilities are found and how they can be exploited.
Simply reporting vulnerabilities to companies is irreponsible in the public scheme of things. If coders dont know how these exploits occur it prevents them from writing secure code.
We need the ability to learn from each other.
DMCA needs SERIOUS changes.
Bruce has done a lot more for hacker freedoms than many of us here, but I'm sorry but it hasnt been enough (not necessarily his fault).
Re:Hollow Victory (Score:5, Informative)
I agree that this is hardly the last shot in the battle. Hardly. If anything, we kept a bad situation from getting a drop worse. But I don't know if "wussied out" is really a fair description. I modified my own DMCA paper to protect HP's Linux program. When Kent Ferson sent his letter a whole 4 days later, I lit fires all over HP and (along with a cast of good people within HP) convinced everyone, including Kent, that using DMCA this way was a bad idea.
But I didn't get the law repealed this week. I'll keep working on that. It would be really nice if you would put in a lot of work on this, too. This is the sort of issue where every one of us has to help or we'll lose.
Thanks
Bruce
Parent
Re:Don't send $100 to EFF! (Score:3, Insightful)
Re:Hollow Victory (Score:5, Interesting)
OK, OK, I shouldn't make fun of someone just because they pressed "Submit" too fast. But the slip opens up an interesting thought in my mind: It is a fact of history that in World War II, American infantry units were the only ones to get progressively more mechanized as a campaign went on. For most armies, continuing action meant trucks and tanks broke down (bad maintenance, lack of supplies, etc.). But for the US, the infantry units would gain mechanized capacity. It was not unheard of that a unit not have to march anywhere, having scrounged enough vehicles to ride. This made the infantry many times more effective and enhanced the efficiency of armor, too (since the infantry could keep up with the tanks).
It doesn't seem that, with the wear-and-tear of battle, you should get more capacity. What was the secret? Well, just about every man in a US unit had some experience with motor vehicles. Most owned their own; many if not all repaired their own. So on the battlefield, they were able to scrabble spare parts together and keep the trucks rolling. In fact, they were often able to scavenge from damaged enemy machines! When a truck or car broke down, most armies had to call in a specialist repair team. But the US infantry could fix it themselves and keep moving. (Source: Dirty Little Secrets of World War II [barnesandnoble.com] , Dunnigan and Nofi)
What's the point? Well, consider that everyone thinks sooner or later we're going to get into a "cyberwar" -- assaults upon information infrastructure. Maybe our only chance of winning such a conflict is to have legions of people familiar with computers and security, with securing a system or attacking it, with picking apart a program and then putting it back together better. In other words, maybe we need a culture of "hackers" (in both sense) as an insurance policy.
In which case, the DMCA is not just intrusive and unbalanced. It's actually a threat to national security. How do you like them apples?
Parent
Those of you who emailed HP to complain (Score:4, Insightful)
Now that they have reversed it, I sent a follow up thanking them and stating that I again looked forward to purchasing from them in the future. The rest of you should do the same- Express displeasure when they fuck up like this, but also express appreciation when they fix it as they have.
Thanks Bruce Perens and the other guys at HP (Score:3, Interesting)
Quote: "At the high point there was an e-mail to (HP CEO Carly Fiorina) every 90 seconds."
It looks like there are quite a lot of HP workers that knows what a bad thing the DMCA is. Thanks for reacting!
Corporate IP Rights? (Score:3, Insightful)
Re:Is there really much to say about this? (Score:5, Funny)
Parent
Re:Good (Score:2, Insightful)
Re:Good (Score:3, Funny)
Good going HP - my next printer will be from you.
I bet you hit yourself in the head with a hammer, because it feels good when you stop.
Re:Hate to say it but the Military uses a bunch of (Score:2, Interesting)
Re:Voting record (Score:3, Informative)
go to thomas.loc.gov
under the Legislation heading, click on Bill Text
select the 105th congress (1997-1998)
search for word/phrase 'digital millennium' (2 L's and 2 N's) or enter bill number "s. 2037"
Click on one of the relevant results.
The Bill Summary and Status link is informative. Check the "All Bill Summary and Status Info" link for some history (or some of the other links), then look for "Recorded Vote"
Bingo.
(phew, stepping through this was a little harder than I thought it would be... But, now that I understand it enough, I can tell everyone else how to do it. Bang on.)
Re:The light at the end of the tunnel? (Score:4, Interesting)
What's worse is that we, as in Anti-DMCA people, clearly lost this battle.
The DMCA will be the law of the land until such time that it is repealed by Congress or overturned in the courts.
In most DMCA cases, the damage is the threat: big/powerful threatens weak/non-powerful into submission using DMCA.
The weaker party must acede or fight it in court. HP's, MPAA, etc know that they have the resources will SNOSoft/ElmcoSoft/Felton etc probably have rather few in comparison. This means they can effectively threaten with impunity.
What we need is someone like HP following threw and taking the case to court. Then a precedent will be set. Right now there are very few precedent's set regarding the DMCA.
Cases like this one are very bad for anti-DMCA peopl: HP got what they wanted (removal of the exploit code, blah blah blah). HP also didnt have to go to court. We (anti-DMCA's) didnt get a court victory. We are appeased because "we won the battle".
Overall this is a step backwards; for now another corporation has decided that the DMCA essentially works, and we are stil no closer to having it overturned.
Parent