OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: M$ code audit? ;-)
From: haywardslothmud.org
Date: Tue Oct 31 2000 - 06:35:48 CST

>Well, you could of course scour through the sources, think up exploits
>with it and then have a field day on BugTraq... If you only describe the
>exploitation process rather than the offending piece of code, and a
>reasonably method used to discover the bug, I'd think they'd have a hard
>time pinning code theft on you.

Good point. Copyright laws only really cover copying and distributing
anyway. They don't really cover "reading" the code. :-)

One example of how copyright law protects distribution but not
personal usage is this: The GPL only restricts distribution, if you
distribute a modified version of a GPL'd product, you must distribute
source code. But even RMS agrees that it is legal under the current
copyright laws to make modifications to a GPL'd program, use it in a
commercial (server) setting, and not distribute the code and those
modifications.

While were on this topic, another thing Stallman has mentioned that may
alarm people is that this can be extended to "entities" like corporations.
Microsoft could take linux, make proprietary modifications to it, and
distribute it internally to their own employees without distributing those
modifications. Copyright laws say that an entity like a corporation is
the same as an individual, so the example in the above paragraph can
extend to a large group as well.

There may even be a loophole where a corporation/non profit
organization/legal entity can be created such that you pay an annual fee
to join it and you get software distributed to you in a similar fashion,
claiming that you are a member of that "corporation". 

--
Brian