Skip to content
This repository has been archived by the owner on Apr 14, 2021. It is now read-only.

Make reverse engineering legal (as you would like to get responsible disclosures) #17

Closed
LilithWittmann opened this issue Mar 10, 2021 · 6 comments

Comments

@LilithWittmann
Copy link

LilithWittmann commented Mar 10, 2021

As your TOS currently states

(c) Teile der Dienste dekompilieren, im Wege des Reverse Engineerings rekonstruieren, zerlegen oder auf eine andere Weise versuchen, Quellcodes, Objektcodes oder zugrundeliegende(s) strukturelle Ideen, Know-how oder Algorithmen oder andere Funktionsmechanismen der Dienste zu erlangen, es sei denn, dies ist im Einzelfall aufgrund zwingender gesetzlicher Vorschriften zulässig; (d) alle oder einen Teil der Dienste modifizieren, anpassen, übersetzen oder abgeleitete Werke erstellen, die auf den Diensten basieren (außer in dem durch luca gestatteten Umfang oder sofern dies im Rahmen der Dienste genehmigt wurde);

it is basically illegal to do any kind of serious security research except reading your br0ken security documentation.

So if I do any responsible disclosure stuff for your system the next thing I probably would have to expect from you is a letter from your lawyer.

As I hope this is not what you venture-funded 🤡 actually want, just remove this part from your TOS.

@T-vK
Copy link

T-vK commented Mar 10, 2021

I highly agree. This is absolutely ridiculous. You're essentially begging the reverse engineerers to sell their exploits to the bad guys, instead of disclosing them.
Stop pretending you care about security. Set up a bug bounty program and make the code open source!

@LilithWittmann
Copy link
Author

Fixed in the current version of the terms of service. (But that creates a bunch of new issues)

@philipp-berger
Copy link

We removed the part about reverse-engineering. Please note, that this does still explicitly forbid attacks against server infrastructures or similar.

Unfortunately, an information channel for changes for example mail does not exist by design in the current version.

Since this change does not introduce any new obligations on the part of end users, both the existing agreement and the previous version can be referenced.

@FrankGrimm
Copy link

Proposal for future changes: ToS change notification of some sort when opening the app / web app if it changed since it was last accepted on the device in question.

@MarcusWolschon
Copy link

If this has been fixed, why is the issue still open?

@reneme
Copy link
Contributor

reneme commented Apr 7, 2021

TOS were changed accordingly. Closing.

@reneme reneme closed this as completed Apr 7, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

6 participants