undefined

points

[-]

So would it be fair to say this is less about deterministic vs. LLM-driven tools, and more about software published out of New York vs. software published out of Germany?

by voodooEntity3 hours ago|

parent|

[-]

Yes and no. I have seen (not wanne name them now to not bring them into a bad context) several tools coming from germany which are well in questionable contexts but due to basically beein advertised as full LLM/AI driven its somehow not on anyones radar. So that is kinda a thing.

But sure location itself also plays a role no question.

by Peacefulz3 hours ago|

prev|

[-]

If getting it out there in the world is more important to you than stamping your name on it, pass it out to a friend who can publish it. Continue any related development in private. They can't stop you from distributing something they don't know you're developing.

by voodooEntity3 hours ago|

parent|

[-]

Well its not like i didn't consider it, but it heavily relies on stuff that i have written and that is well only used by me till this day. So arguably, publishing it this way it would still have like "points" which make it extremely related to only me.

Also asked the lawyer in consulted about it... i would be a heavy gamble

by RamblingCTO8 hours ago|

prev|

[-]

Really? Have there been any cases yet?

I'm asking cuz I started devloping a c2+agent+BOF kind of thing with custom bytecode vm for the lulz (to learn how stuff works nowadays) and it's on tangled and github :/

by sdoering6 hours ago|

parent|

[-]

Yes. More than one. This one was especially "interesting", a security researcher was tasked by a company to evaluate the ERP (I believe would be the acronym) software. Diiscovered an external database connection, looked at it, discovered this external DB contained sensitive information from other clients of that vendor - reported it, got sued, lost.

In German: https://ht-strafrecht.de/blog/strafrecht/it-sicherheitslueck...

by voodooEntity3 hours ago|

parent|

prev|

[-]

Ye you should be really careful on that one. If just somebody with a bad mood reports you, even if you have absolutely good intentions, it can cost you and if its just in spendings in a lawyer to proof that your fine....

by actionfromafar8 hours ago|

prev|

[-]

Intentions are very often a factor when it comes to law, and rightfully so. The problems come when you classify some category of software as "dangerous" by default. Software is special in that it can't be a "controlled substance". So everyone needs to have the tools to increase their security. That includes access to "offensive tools" to study what they do. A recent example was the Huggingface attack.

by ksk236 hours ago|

parent|

[-]

As I understand the hole shebang, the German law is about "does the court think you are `hacking` something?" -- this is against the law.

Yes, there was one German pentester that got sued, because he reported a BASE64 encoded, hardcoded authentication token in an application. Not that I would wish him anything like that and am ashamed by the outcome, I also recall that he might have tried to put pressure on the vendor by doing an interview with a blogger or so?

On the other hand, I do not know of any cases regarding publication of dual-use tools as OSS.