Publishing Exploit Code Ruled Illegal In France 362
Dexter writes "A French Court has condemned the security researcher Guillame Tena for publishing a security vulnerability in the Viguard anti-virus software of Tegam. This ruling makes the publication of security vulnerabilities and their proof of concept through reverse engneering illegal in France."
French Court: "Surrender Now" (Score:5, Informative)
If one really wants to help, isn't it better to inform the software maker? If the latter couldn't care less, maybe one shouldn't care more?
However, as the friendly article pointed out, the fine was for a copyright infringement charge, so it looks like you can still publish a vulnerability as long as it is subtle enough.
Re:French Court: "Surrender Now" (Score:2, Informative)
They once had to postpone one publications for a long time because they deontologically refuse to publish some story concerning a product that would not be patched.
Now it was supposed to help others to protect similar products.
Re:French Court: "Surrender Now" (Score:5, Insightful)
Re:French Court: "Surrender Now" (Score:5, Insightful)
Going public forces the publisher to fix the problem if it hasn't already, and it let's the public know that there's a problem and they should do an update.
I agree, going to the author first with an exploit is good etiquette. And that going public afterwards is important, too, after some decent interval that is as short as possible.
Public disclosure gives the software user a tool to test just how vulnerable he is and whether various stopgap measures provide adequate protection against the exploit. Public disclosure is better than just having exclusive disclosure to black hats and vendors, IMHO.
Re:French Court: "Surrender Now" (Score:4, Informative)
They might be vying with the Aussie minister for the "world's biggest luddite" award...
And as for the google debacle... if I were Google, I'd consider pulling out of France altogether. Let them see what a world without Google is like.
It's not that I don't like the French, but geez, they seem to be exceeding the limits of common sense lately.
Re:French Court: "Surrender Now" (Score:2)
Easy, they just give MSN search their attention.
Re:French Court: "Surrender Now" (Score:5, Informative)
The 'full disclosure' idea came about because of the frustration of sysadmins finding security holes, and not being able to get the vendor to take it seriously.
Good 'full disclosure' first notifies the vendor, and then if within a reasonable time the vendor takes no action or there is no response you disclose to something like BugTraq.
It's been the reason that Microsoft and other vendors take such bugs VERY seriously. But they would be more than happy if it all just went away, or was criminialized.
You decide which is more valuable: A company keeping their PR image spotless, or getting serious software bugs fixed.
Re:French Court: "Surrender Now" (Score:3, Funny)
How about, not going to jail for disclosing a bug! It's very valuable to me!
Re:French Court: "Surrender Now" (Score:5, Informative)
Re:French Court: "Surrender Now" (Score:5, Insightful)
http://www.windowsitpro.com/Article/ArticleID/2
It's one of the conditions of being a "Gold Level" partner.
Of course, this makes one realize how nonsensical the "window of vulnerability" arguments comparing Windows vs. Linux security are. For those of you who don't know, these arguments compare how much time time from announcement of a vulnerability to the time that the patch comes out. The F/OSS community is big into full disclosure, and the MS community isn't, so, the MS Window of vunlerability is almost always smaller, hence leading to claims that it's more secure. That is, until someone finds a bug that's been swept under the rug for a couple years and uses it to make the next Nimda.
Re:French Court: "Surrender Now" (Score:3, Insightful)
Re:French Court: "Surrender Now" (Score:5, Interesting)
Can you really make a secure system? Open source or closed, there are going to be security risks. So what happens if the security hole would be so expensive to fix that you simply couldn't afford to address it? Keeping it quiet, while not always effective or preferred, is still security (through obscurity).
I discover security holes in web applications all the time. My protocol is to stop once I've proven it's possible to compromise, notify the company of the issue, the implications of the hole, and ways to go about fixing it. I always include a link to my company's website, but I never threaten to publish it or do anything that might be construed as extortion. I've never been accused to wrongdoing, I usually get a big thank you, and sometimes it lands me a meeting - which is where they become clients.
People generally appreciate a helpful tip, whether it's a "you have a word spelled wrong on your site" or "you have a SQL Injection vulnerability on your site." Just don't be an ass about it.
Re:French Court: "Surrender Now" (Score:5, Insightful)
Read any good EULAs lately?
Re:French Court: "Surrender Now" (Score:3, Interesting)
Seems to me that you can put anything in a EULA. Getting it enforced in a court of law is yet another thing.
Re:French Court: "Surrender Now" (Score:4, Insightful)
Yes.
Security is not a hard problem. It does add to both the cost and complexity of a system though. The problem is most people avoid the issue or try and make some sort of wrapper around there software that makes it secure. Mostly it's people not separating the data that is moving though the system from the system it's self which leads to security problems. When you treat every interaction a system has with the outside world as a hostile transaction you can make vary secure software. But, few people really want to build secure systems, mostly its just get it out the door fast which is why you keep seeing companies with there pants down.
As to your idea that some bugs are to expensive to fix well that's like saying well we made the bridge. It come in early and under budget, granted it would fall down if anyone ever tried to use it but hay that's not our problem. Yes, you can build a system that's not secure at lower cost, but if a bank get's hacked because they where using your software then clearly you did not do your job.
PS: Yea, sorry that came off as a rant it just pisses me off that people accept that there systems can and will be hacked but hey so does everyone else's so it's ok.
Re:French Court: "Surrender Now" (Score:4, Interesting)
For instance, if a flaw is found in the DNS library for linux such that if you look up a specific hostname you can take over the machine - you could pass that parameter as your email address. When the email address is checked for validity, bam - there goes the server.
Computers, specifically OS interactions, have gotten so complex that security can only be increased, not achieved.
Re:French Court: "Surrender Now" (Score:3, Insightful)
It's not about suing companies for building insecure software, it's about keeping your own data secure.
Re:French Court: "Surrender Now" (Score:2, Informative)
Re:French Court: "Surrender Now" (Score:5, Insightful)
If you discovered this exploit then so can someone else. This someone else could then use this exploit to their every desire (Think beyond viruses, i.e. blackmail, stock market, etc.)
What do you do?
Nag the company to fix it?
Tell everyone how horrible the company is without proof?
Release your exploit into the wild to pressure the company in patching it and giving them motivation to pay more attention to security?
Most exploits that are released typically occur after the vendor has been notified.
Re:French Court: "Surrender Now" (Score:3, Insightful)
It's always best to assume that someone already has, before you did. Always look at the worst case scenario. Unfortunately, marketing is king in the tech world, so companies would rather give us the overly optimistic view than the worst case scenario.
Re:French Court: "Surrender Now" (Score:3, Insightful)
why do you think ~el8, PHC, AcidBitches, and other anti-sec groups want to outlaw exploit code? once we go to a vendor-only or non-disclosure system, blackhats will rule the roost. if exploits are outlawed
Re:French Court: "Surrender Now" (Score:3)
1. You contact the company and ask them how long they think it will take to fix the problem.
2. You ask them when you may release it into the wild and get a definite date/time.
2a. If they won't give you a definite date/time, make some suggestions and work with them to try to come to some understanding about it.
2b. If they still won't give you a definite date/time, ask them if you can release a general statement to everyone via something like BugTraq pointing everyon
Re:French Court: "Surrender Now" (Score:2)
Um... because if vulnerable software is out there, it can be exploited. As we know with Microsoft's slow Windows patch cycle versus the constant updating of most Linux distros package repositories, it's better to disclose vulnerabilities early, write patches quickly, and distribute a fix before anyone can exploit it. Forcing people not to disclose details just adds one more person and one more vulnerability to the list of ways you
Re:French Court: "Surrender Now" (Score:2, Insightful)
What good is it to publish software vulnerability, especially on closed source products?
It punishes the software maker for putting bugs in their software.
If you notify the software vendor FIRST, you are telling them "It's okay to put out bad software, because someone will do your testing for you, for FREE". However unless you are getting paid for your software testing, you have no obligation to tell anybody anything, or to NOT tell anybody anything.
Is that the message you want to send to software au
Re:French Court: "Surrender Now" (Score:2, Insightful)
In these instances, be thankful that the "white hats" found it first. The "black hats" are just likely to exp
Re:French Court: "Surrender Now" (Score:5, Insightful)
A strange question. People who use these closed-source products (aka "the customers") would certainly be interested in knowing the true capabilities (or lack thereof) of the software they bought. People who are thinking about purchasing that software would be interested as well.
The head-in-the-sand technique doesn't work all that well in real life.
If I am running an anti-virus program, I most certainly want to know if that program is a close relative of swiss cheese...
If one really wants to help, isn't it better to inform the software maker? If the latter couldn't care less, maybe one shouldn't care more?
More strange questions... Let's see, there was this car, called Pinto, and its maker (Ford) for a while couldn't have cared less about certain umm... deficiencies in its construction and design. Are you suggesting that the proper response to the manufacturer's saying "I don't care" is replying "Oh, how wonderful, this means all is right in the world then"..?
Re:French Court: "Surrender Now" (Score:2)
I think you give too much credit to the consumer. Maybe you were talking about enterprise products. You can preach to home users all you want about how many security holes IE has in it and look how many still use it. I don't think a
When exploit knowledge is outlawed... (Score:2, Insightful)
Re:French Court: "Surrender Now" (Score:3, Interesting)
Does this ruling actually set any sort of precedent? That would be bad news for both freedom of speech and academic freedoms. From the details it doesn't sound like it, however,; didn't they actually fine him for something else, suspend the fine, and then use the th
Re:French Court: "Surrender Now" (Score:5, Informative)
Yes, I do. I'll try to answer your questions as best as I can.
What sort of constitutional free speech protection does a French citizen have?
Free speech is guaranteed, under French law, through (a) the 1789 Declaration of Human Rights, which is a part of the 1958 V Republic Constitution (Google is your friend if you want an English Translation of this text), (b) the UN Charter on Human Rights, of which France is a part and (c) the different European Community treaties, which also protect free speech.
Please note: The biggest difference with American Law is that 'hate speech' (anti-semitism, racism, fascism, nazism, Holocaust denials, etc) is specifically forbidden under French Law, and will be prosecuted. Anything else is allowed, except that the French government also reserves the right to censor publications in the name of 'national interest' (read: secrets of state). This censorship is very rarely used these days, however.
Does this ruling actually set any sort of precedent? That would be bad news for both freedom of speech and academic freedoms.
French Law does not recognize 'precedents'. It recognizes the primacy of law (vs precedents) and French courts do not have to follow precedents (previous decisions) taken by other court, in the absence of a binding law . If a binding law exists, the court has to respect that, and not any precedents.
This means that, if I publish vulnerabilities on product foobar from French company XYZ, and I am dragged into court, I may well be cleared of all charges. Also, if I win a case, company XYZ would have to pay for both its legal fees and mine. This is a strong deterrent against frivolous lawsuits.
Of course, the reverse is also true: a future decision may refer to a previous decision (precedent) and condemn me. That's when the legal games and fun begin, so to speak...
didn't they actually fine him for something else, suspend the fine, and then use the threat of the suspended fine to incent him to stop publishing?
No, Guillermito was fined because he used an illegal (pirated) copy of the software to find the vulnerabilities he published. Despite the harsh tone of the ruling, he was not really 'fined' ('sursis' means he does not have to come up with the money).
But, in any case, the court did not render a decision on the crucial matter of finding and publishing vulnerabilities, only on the use of an illegal copy of the software. Seems to me the judges were pretty pissed-off by the hysterical attitude of Tegam (the company who brought the lawsuit).
Hope this clears up a few things!
Reclassify your "exploit" as a "hidden feature" (Score:3, Funny)
As in,
"Hey there's a great new hidden feature I found in Internet Explorer for people who need to get remote root access their own systems:
Just load up this javascript + assembly code in a page in the browser, and Internet Explorer will automatically generate a stack overflow, so you can execute the assembly code! What a great new hidden feature I've found."
Re:French Court: "Surrender Now" (Score:3, Interesting)
Re:French Court: "Surrender Now" (Score:3, Insightful)
If no one tells me about the exploit, then I'm a sitting duck.
Blame the victim (Score:5, Insightful)
Re:Blame the victim (Score:5, Funny)
Seriously though, you have a point. If a gas station was selling gasoline with sugar in it (very bad for your car engine) they would be liable for damages. It seems, however, that sofyware companies have no liability for their crappy product. Must be due to those lengthy licenses you agree to by opening the package.
Maybe gas stations should start printing up a 'licensing' agreement on their pumps.
"Notice: By lifting the handle, you agree to check the compatability of this product with your vehicle, etc., etc."
Re:Blame the victim (Score:2)
No, it's not [snopes.com]. Personal datapoint: some idiot put a bunch of sugar into my '68 Mustang's tank when I was in high school. I ran a couple of bottles of fuel treatment through just to be safe, but never noticed anything at all.
Re:Blame the victim (Score:2)
If a gas station was selling gasoline with sugar in it (very bad for your car engine)
It's only bad for the fuel filter and possibly the pump. Sugar is not soluable in petrol, thus it would simply clog the fuel filter. (powdered sugar _may_ be a different story, but I havn't tried that yet.)
-nB
obSimpsons (Score:2, Funny)
Hutz: Thank you, Dr. Hibbert. I rest my case.
Judge: You rest your case?
Hutz: What? Oh no, I thought that was just a figure of speech. CASE CLOSED.
Contrary (Score:5, Funny)
Re:Contrary (Score:2, Insightful)
Re:Contrary (Score:2)
Au Contraire (Score:3, Interesting)
Doesn't sound to me like they're working at odds.
So what ? (Score:2, Insightful)
Bye bye, France (Score:2)
France (Score:4, Funny)
IF instr(HEADLINE, "FRANCE") > 0 THEN
PONDER_FRENCH_MATTERING
LAUGH("FRANCE")
ELSE
READ_ARTICLE
END IF
It's VB (SCREW YOU FOR JUDGING ME!)
Re:France (Score:2)
No details (Score:5, Informative)
I did a Google News Search and found this one which is much better [zdnet.com].
Also, the guys own website [guillermito2.net].
Hope this helps.
Re:No details (Score:2)
Forced application of the age old adage... (Score:2)
Re:Forced application of the age old adage... (Score:2)
and, of course, it's corollary
Surrender is bliss.
Possibly, they believe in the Douglas Adams theory of "What I can't see can't see me", hence the sticking of their heads in the sand.
rogue states (Score:3, Interesting)
Let's hear it for the Virgin Islands and the Bahamas! No software patents there. No export restrictions. True freedom of speech.
Instead of endlessly complain about it... (Score:2)
Judicial Insanity, Not just for Americans anymore. (Score:2, Insightful)
At least I'll feel better about it the next time the 9th Circuit Court of Appeals makes an insane decision.
LK
This puts people out of business... (Score:5, Informative)
I'm a security consultant and I look to these folks as a source of reputable information. I spent a LOT of time on their site when Microsoft was trying to deal with the fallout of the MSO3-026 vulnerability which begat the MSBlaster worm. I even got the source code for blaster from the K-Otik crew.
This is going to have huge ramifications if it is interpreted as described here.
Symantec tried this too (Score:2)
Debugger forbidden... (Score:5, Insightful)
Re:Debugger forbidden... (Score:2)
Seems to be a pretty fine sense of reality to me...
France is stupid (-1 Flamebait) (Score:5, Interesting)
I say geocities-like so you get the picture, but it was nothing like geocities. No nonsense interface -- all text, no pictures, no ads --, great webmail interface -- again, all text, no pictures, no ads. It was also the first (maybe the last, I just got my own paid hosting when it got ultracheap -- it wasn't, in the day) free web space provider to support PHP.
Yes, PHP. In the days where extensions were
Apparently, the whole thing was ran by a techno-anarchist who prophecized in the future technology would make working unnecessary yadda yadda yadda. A sort of techno-optimist Guy Debord.
One day, one of altern.org's free websites had a parody of a France Telecom logo. Tartalacrem, if I'm not wrong. Legal hell ensued.
Not only it wasn't covered under any kind of fair use provisions, but France Telecom sued VALENTIN LACAMBRE, THE GUY WHO RAN THE FREE SERVICE.
Courts rejected his defense of not being responsible for everything hosted in his server as anyone could anonymously host content. Mr. Lacambre was forced to pay up fines and was told he was still responsible for anything held in altern.org.
So altern.org was taken down. That's France, folks.
by the way... (Score:3)
(Admitedly, this description could probably be turned into code very quickly by any hacker, but that's not the point.)
In any case, the article in question is about copyright violation, not making exploit-publication illegal.
3rd country (Score:2)
Where's the real info? (Score:5, Interesting)
Nowhere does it say what, exactly the guy was convicted of, or why. So how are we possibly supposed to be able to react to this?
I have a hard time accepting statements like:
This ruling can cripple the security research in France, making it illegal to publish security vulnerabilities or the proof thereof by reverse engineering. Without being able to tamper software the actually studying and consequent publication of vulnerabilities is made impossible.
Without seeing the judgement or at least a description of it from a neutral source.
Reverse engineering is legal in Europe, and is a protected right under European law. (91/250/EEC [eu.int], article 6.)
I have a strong feeling the whole story is not being given here.
Don't pick on corporations- or cooperate (Score:5, Interesting)
In this case an appeal to the European Court on grounds of effective suppression of fair comment sounds as though it might just be possible if funds were somehow made available. It seems on the fac of it obvious that the real reason for the case was a corporation trying to prevent any adverse publicity and using its superior economic power to get the decision it wanted, but it will need expensive experienced judges to point out what seems obvious to the majority of people.
Link to the Leaflet (Score:2)
Considering a lot of what they are saying and implying, I can understand why McDonalds's is suing. Lets start with McDonald's is directly involved in this economic imperialism, which keeps most black people poor and hungry while many whites grow fat. Hmm... like I've never seen a black person eat at Mics before nor a skiny white guy.
Ruling make illegal? (Score:3, Interesting)
Nonsensel? (Score:3, Interesting)
Just look recently ruling where the Supreme COurt overturned Execution of Minors. Did the written law change? No! In the argument the majority argued that world opinion and decency standards had changed.
Re:Ruling make illegal? (Score:2)
Viva la America! (Score:2)
Awesome! French software manufacturers can now use the threat of prosecution to avoid having faulty software criticized. French software manufacturers thus have less incentive to fix their broken software products.
Hopefully the French will start buying their software products from America!
Detailed proceedings ? (Score:3, Informative)
For all I've been able to (quickly) find, he has been condemned for intellectual property, namely counterfeiting.
One possibility is that it's becausehe has published source code, which looks strange because it would be probably be the fair use (short citation for eduction).
But it's probably because he pirated Tegam's software and didn't buy it.
You can also read on this lawyer blog [eolas.free.fr] that
"Il ne faut pas interpréter cette décision comme une condamnation du (EDIT : full disclosure), à mon sens : la même chose faite sur un programme licite ne tomberait probablement pas sous le coup de la loi."
So that it is NOT condemning full disclosure and that such publiction made on a legal software wouldn't be sanctionned.
At the moment, it really looks like some people are screaming as loud as possible about that, but until the details are know that just PR operations from Guillermito and the others.
VULNERABILITY (Score:3, Funny)
The legislation has a loophole that allows people to give such info to 3rd parties outside France so they can publish such exploit.
The government's illegality detection can be easily bypassed with an SSL connection, provided one does not disclose his identity.
Proof of concept [siteoutsidefrance.com]
Well they surrender to everyone else.... (Score:2)
As usual, only 1 side of story is presented (Score:3, Informative)
and
Tegam is adamant that Tena's claims are false and his motives are questionable. [zdnet.com.au]
BTW, was it already illegal in France to do what he did? If so, then the people should get the laws changed, not trash the judeges and judicial system for doing their jobs by upholding them...
It had to be said... (Score:2)
Even if nobody was allowed to talk about it, everybody would still know how to defeat it.
Free speech? (Score:2, Troll)
It looks like the rest of the world has pretty much caught up with the USA. France denies free speech, the EU bows to big corps and OKs software patents, AU is considering fines for people or corporations if they use the Internet to incite or promote suicide methods.
Is there any decent
Re:Free speech? (Score:3, Interesting)
The US have it so good. This only proves that Americans who are hyping the European institutions are totally clueless about Europe.
You shouldn't take the 1st Amendment as granted.
TEGAM International's description (Score:3, Informative)
http://www.viguard.com/en/news_view
Have no idea about the truth, though.
That's because he did not have a license (Score:2, Informative)
Then I conclude it is more carful to buy the license before publishing security flaws, and then everything is ok. But a question arises : is it possible that a license states that the license holder is forbidden to publish security flaws about the software ? If so, then we are really stuck.
Maginot II? (Score:3, Funny)
History doesn't repeat itself, but it sure does rhyme.
--Mike--
Re:WOW! (Score:2, Funny)
http://www.albinoblacksheep.com/text/victories.
Re:WOW! (Score:2)
I would like to remind you that France is a democracy, and it does not have a Department of Fatherland Security [whitehouse.gov]. Actually, the "Old Europe", as the present Administration like to talk about, are the European countries whose democratically elected Governments listened to the overwhelming majority public opinion.
Sure they do (Score:2)
Well... (Score:2, Informative)
Re:EDITORS SHOULD READ THE FUCKING ARTICLES (Score:2, Informative)
WOW, you are a retard to miss that.
the part you mentioned was in regards to DIFFERENT legal proceedings.
good lord you suck enermous balls for missing that stuff.
Re:EDITORS SHOULD READ THE FUCKING ARTICLES (Score:2, Informative)
Re:EDITORS SHOULD READ THE FUCKING ARTICLES (Score:2)
Actually you've just hit upon the reason the dupe problem is so bad on slashdot. Obviously, the editors have each unchecked the boxes of all the other editors.
Did you read the articles? (Score:3, Informative)
Re:EDITORS SHOULD READ THE FUCKING ARTICLES (Score:3, Informative)
After reading the article I see no information there about software piracy.
Following the links I did find some interesting tidbits that would indicate the company in question is less than honorable:
A factual issue, not part of the trial but seemingly of Tegam's scare tactics, is that
Mod the parent down. (Score:2)
Yesterday the French security researcher Guillame Tena, aka Guillermito, has been fined a suspended fine of 5000 euros by a French court for publishing a vulnerability in the Viguard anti-virus software of the company Tegam.
Re:Just another reason to hate the French.. (Score:5, Interesting)
They've developed nuclear weapons, were one of the original founders of the European Union, who's Euro continues to dominate the American Dollar. They were one of the first modern countries to pick on the buzzword "Democracy" long before a bunch of colonists got pissed at their King's latest tax law.
Oh, did I mention numerous American, Australian and British courts have upheld the same reverse engineering proof of concept rulings?
You Sir, are an uneducated bigot.
(Note: I am not anti-American, I'm just hitting him where it hurts.
Re:Just another reason to hate the French.. (Score:2)
If you believe that Napoleon almost conquered the entire world, you have little room to question anyone's education.
Re:Just another reason to hate the French.. (Score:3, Informative)
Yes, the French continue to be well-known for always willing to make a profit, regardless of consequences.
One little short frenchie with a bad attitude almost conquered the entire world, twice.
Europe != World
developed the most heavily armored and gunned tanks during the early German Blitz, one French Char B1-Bis held up an entire German Division for an entire day.
Sadly, it appears
Re:Just another reason to hate the French.. (Score:2)
Re:Just another reason to hate the French.. (Score:2)
He really kicked Russia's ass [ddg.com]
Re:Just another reason to hate the French.. (Score:3, Interesting)
Actually, Napolean wasn't really French: he came from the island of Corsica, which I believe was a French territory at the time. Part of his bad attitude, IIRC, was that he wasn't accepted by his French peers while he was in school.
Hmmmm..... Minor points (Score:2)
They developed the most heavily armored and gunned tanks during the early German Blitz, one French Char B1-Bis held up an entire German Division for an entire day.
They capitulated and had a fairly sizable number of collaborators too. Not sure what either of these sound-bytes has to do with the current situation....
One little short frenchie with a bad attitude almost conquered the entire world, twice.
http://www.napoleonguide.com/ajaccio.htm
Corsican. That ain't the same thing, really.
They were
Re:Just another reason to hate the French.. (Score:2)
I've heard of this happening once in the USSR with a KV-1. I've never heard if it happening with a Char B.
Also, for what it's worth, the KV-1 had both heavier armour and a better gun than the Char B. And a better engine, better tracks & suspension, and a better crew layout to boot.
One little short frenchie with a bad attitude almost conq
Re:The 'condemned' him? (Score:3, Informative)
Re:The 'condemned' him? (Score:2)
It's always amusing if you speak both languages to hear people find a similar word in their second language to their first which unfortunately has a completely different meaning.
Having worked for a French company for years, I don't even think about it anymore - I just mentally translate the cognates back and forth.
Re:Extortion? (Score:4, Interesting)
Let's say you tell the automotive manufacturer about it, and he claims that your research was flawed and there was no problem, or he just says "ok we'll look at it" and does nothing for four years.
Let's say that, after those four years, you start reading stories of people dying "mysterious" in explosions during crashes in those cars. You tell the vendor again, but again they deny that their problem is causing the deaths, and they even deny that you contacted them about the problem four years before.
Do you continue to keep quiet, and let people die because telling the public about the problem would be "unprofessional"?
Would you have told the public after giving the manufacturer a month to find a fix, so everyone would know about the problem and could participate in the recall?
Would you have told the public as soon as you found the problem, so people could choose to not use the car while a fix was being designed?
What do YOU think is the professional thing to do?
Re:This is getting stupid. (Score:2)
Re:oh great (Score:2)