[00:10.330 --> 00:18.390] Boo! Well, I'm Chuck Willis and as you can see on my presentation here, this talk is called [00:18.390 --> 00:22.450] Trends in Licensing of Security Tools. Sorry, I'm going to try to keep speaking into the [00:22.450 --> 00:28.110] mic. If you can't hear me or anything, just give me one of these or just say something. I [00:28.110 --> 00:31.490] want to make sure that you guys can hear what I'm saying. And I also want to hear what [00:31.490 --> 00:36.250] you're saying. This is meant to be an interactive presentation and in a way it's good we've [00:36.250 --> 00:40.490] got a small crowd here that we can uh maybe people will feel more free to talk a little bit [00:40.490 --> 00:45.070] about this because I I certainly don't intend to come up here and say that I have all the [00:45.070 --> 00:51.030] answers. It's really just more of a kind of uh my slides are going to try to provoke some [00:51.030 --> 00:55.930] thoughts from you all and give kind of what my thoughts on are as far as uh where [00:55.930 --> 01:01.010] licensing is going and security tools and and uh what might be some problems with that. So [01:02.010 --> 01:06.690] anyway, as I mentioned, I'm Chuck Willis. Um these slides are a little updated from what's [01:06.690 --> 01:10.630] on your uh CD so you can go to my website and download them if you want. There's nothing [01:11.170 --> 01:17.610] real substantial in the way of changes. And just uh in case you uh couldn't figure it out [01:17.610 --> 01:22.690] from the title. So what we're going to be doing is uh I I want to discuss uh the trends as [01:22.690 --> 01:28.170] far as the kind of the changes that I've seen in licensing of security tools and uh and [01:28.170 --> 01:32.950] also talk about how that affects the security community. And uh I also want to discuss you [01:32.950 --> 01:37.770] know how licensing could be improved if if necessary. I mean maybe maybe you all think [01:37.770 --> 01:42.950] there's not a problem with what's going on. And uh and also as kind of a kind of a [01:42.950 --> 01:46.410] secondary thing that you I expect that you know maybe some of you all will learn [01:46.410 --> 01:50.150] something about uh security tool licenses in that there's a lot of tools that I'm going to [01:50.150 --> 01:56.210] talk about that um you think are are free open source tools that that really aren't. And [01:56.210 --> 02:00.270] again this this is meant to be interactive. So I'm I'm going to ask a lot of questions and I [02:00.270 --> 02:06.930] hope that you all will will have some uh some thoughts and share share those with us. Uh [02:06.930 --> 02:11.770] just a few disclaimers here. Um I I am going to talk about specific tools that have uh [02:11.770 --> 02:16.230] restrictions in their licenses. And uh this is not meant to be like just ragging on these [02:16.230 --> 02:21.450] people or you know trying to talk bad about people. But I just think it makes the talk [02:21.450 --> 02:25.110] much more interesting if you've got concrete examples to talk about rather than a bunch of [02:25.110 --> 02:29.890] abstract stuff. Um and and and I do think that the authors of those tools have done a [02:29.890 --> 02:33.550] service to the community by releasing them under the license that they're under. I mean [02:33.550 --> 02:37.930] they could a lot of the tools that I'm going to mention could easily be you know strictly [02:37.930 --> 02:42.330] commercial tools that you have to spend thousands of dollars for. So certainly the [02:42.330 --> 02:45.830] authors are going to be commended for what they've done. And also I wouldn't be talking [02:45.830 --> 02:49.770] about the tool if I didn't think it was a useful tool that people uh people use. So I'm [02:49.770 --> 02:53.850] not going to be talking about real obscure stuff I don't think. And uh finally the [02:53.850 --> 02:58.070] licenses may have changed since I put these slides together. Uh licenses change all the [02:58.070 --> 03:03.070] time. So this is uh the this is a disclaimer there that stuff might have changed since I [03:03.070 --> 03:08.670] put this together. And the you need to go out and read the license if you're going to use [03:08.670 --> 03:14.190] these tools. You know this don't just rely on what I'm going to tell you. Okay so a little [03:14.190 --> 03:20.710] bit about me. Um I I work for a government contractor. Um I don't work for and yeah the [03:20.710 --> 03:24.550] reason I say that is I don't work for a consulting firm or software firm which is who [03:24.550 --> 03:28.810] releases most of the security tools as far as companies. And then a lot of security tools [03:28.810 --> 03:33.930] are released just by individuals that do it in their spare time. So I think I'm a a bit [03:33.930 --> 03:38.090] independent in that sense. Um I'm not a free software zealot. I'm not going to come up here [03:38.090 --> 03:42.110] and say that everything should be GPL. Um cause I don't I don't think that's the case. [03:42.110 --> 03:46.770] And I use commercial software along with open source software and all sorts of other [03:46.770 --> 03:53.710] software. And and again I'm not a lawyer this is not legal advice. So but I I do think I'm a [03:53.710 --> 03:59.450] pretty typical security tool user. I mean I I use a lot of tools in my work and also at home [03:59.450 --> 04:03.970] when I'm messing around with stuff and uh and I and I kind of wanted to illustrate this to [04:03.970 --> 04:09.330] show that uh you guys I think are typical security tool users as well but we're different [04:09.330 --> 04:14.970] from normal software users. You know I I use both Linux and Windows. I occasionally use [04:14.970 --> 04:20.150] other Unix variants but um you can't say that certainly about standard software. Most [04:20.150 --> 04:25.170] people just run Windows. Um and and also I'm not a full time programmer. So I don't [04:25.170 --> 04:29.410] necessarily have access to all the programming tools, Visual Studio and all that kind of [04:29.410 --> 04:34.430] stuff. And uh and also I'm I can I can tinker around with stuff but I'm not necessarily [04:34.430 --> 04:39.930] someone that wants to spend all day coding. But I but I compile tools. That's certainly [04:39.930 --> 04:44.050] uh something that we can all do. Uh we can debug compilation issues if you've ever had to [04:44.050 --> 04:51.430] import something from Linux to Windows under like the Cygwin um APIs or to BSD or [04:51.430 --> 04:55.130] something like that. I'm I'm sure that's something that's pretty typical for people here. [04:55.270 --> 04:59.890] Um and I I like to build little tools and scripts to automate things. I hate doing busy [04:59.890 --> 05:04.930] work you know. So I I like to be able to do that kind of stuff. And I also I modify tools [05:04.930 --> 05:08.950] that if I download a tool from the internet or from something that someone has posted to a [05:08.950 --> 05:12.830] mailing list um I'm gonna take it and start tweaking it if it's not doing exactly what I [05:12.830 --> 05:19.450] want. And I also like to share my tools and modifications with other people. So if I if I do [05:19.450 --> 05:25.590] something I think is cool I post it onto a mailing list. So anyway I I wanted to just mention [05:25.590 --> 05:29.290] that because again I think this kind of fits everyone that's here but it's definitely [05:29.290 --> 05:36.150] different than normal software users. So my motivation here was that uh I use a lot of [05:36.150 --> 05:40.850] security tools as I mentioned and and I actually read the licenses which maybe uh not [05:40.850 --> 05:45.050] everybody does. But uh I've actually been quite surprised by some of the stuff I've found. A [05:45.050 --> 05:50.470] lot of tools that I thought were open source really aren't. And a lot of tools that uh just [05:50.470 --> 05:55.470] have some very strange license restrictions that uh that kind of surprised me. And and over [05:55.470 --> 05:59.810] the years I've noticed some trends that you know it seems like more tools are going to more [05:59.810 --> 06:05.250] restrictive license. So I wanted to talk a little bit about that. So here's a quick [06:05.250 --> 06:11.830] example here. And uh so uh SensePost's WIC2 tool. It's a it's a Windows version of uh [06:11.830 --> 06:15.990] NIC2 kind of. It it's got some other features actually that it's built onto the NIC2. Uh it [06:15.990 --> 06:21.350] does some recursion and it's also uh connects in with the Google uh APIs and all that. So [06:21.350 --> 06:27.650] anyone here use that tool? Find it useful? Yes? No? Okay. Good. Um are any of the [06:27.650 --> 06:31.490] contributors here? I I definitely know they're here at the conference. I I sat in on [06:31.490 --> 06:35.950] SensePost's talk earlier. I don't see any of them in the room here. Well you're you're lucky [06:35.950 --> 06:40.050] they're not in the room because uh if you look at the license for WIC2 you'll see that it [06:40.050 --> 06:44.730] starts off with the the full GPL license and then it adds this extra restriction that [06:44.730 --> 06:50.390] basically if uh you find the software useful you're supposed to buy them a drink. So I [06:50.390 --> 06:53.830] expect you all to go out and find them after the session's over and make sure you live up [06:53.830 --> 07:01.470] to that. Excuse me? WIC2 it's a web it's a web uh application scanner. It's a web [07:01.490 --> 07:07.990] server scanner. So and just in case anyone was wondering I I don't think that's [07:07.990 --> 07:14.110] enforceable but I'm not a lawyer so you'll have to talk to your legal about that. Well it [07:14.110 --> 07:19.250] certainly is a violation of the GPL in the sense of well it's not a violation of the GPL [07:19.250 --> 07:23.450] but it's not the GPL. You you can't say that something is GPL and then add extra [07:23.450 --> 07:27.370] restrictions onto it. I don't think the real the two really match. But if you also if you [07:27.370 --> 07:32.010] notice the wording there it says you know it's kind of vague in the wording too. So it's to [07:32.010 --> 07:35.530] be honest it's probably a joke. So I don't think they actually expect anyone to do that. [07:35.530 --> 07:40.630] But it's just one of those little nuggets that you'll see sometimes in reading licenses. So [07:41.470 --> 07:45.130] the uh just a little bit about the scope that the main thing I'm interested in when I'm [07:45.130 --> 07:49.030] talking about these licenses is being able to use the tool for what I want to do and [07:49.590 --> 07:53.830] perhaps modify the tool and be able to you know send those modifications to other people. [07:53.830 --> 07:58.330] So in particular I'm not trying to take someone else's tool and build my own tool that I [07:58.330 --> 08:02.410] want to sell and make a million dollars for. That's much more difficult as far as [08:02.410 --> 08:08.230] licensing. Obviously GPL restricts that in a lot of ways. The BSD license or other licenses [08:08.230 --> 08:13.770] like that can allow that. But that's kind of a different issue for me. So that's what [08:13.770 --> 08:17.630] we're going to talk about. So let's start off with the trends that I've noticed. And [08:17.630 --> 08:21.270] there's quite a few of them here. But there's two kind of overwhelming ones that we start [08:21.270 --> 08:25.510] off with. And the first one is that there's a lot of great open source tools out there [08:25.510 --> 08:30.830] that that are under an OSI certified license. That would be usually the GPL or a BSD [08:30.830 --> 08:35.710] license. And uh y'all can read the list. I'm sure you've heard heard and heard about and [08:35.710 --> 08:40.130] used a lot of these tools. You know the Nmap and Ethereal and the Metasploit framework is [08:40.130 --> 08:44.210] written in Perl. Almost all tools that are written in Perl are released under Perl's [08:44.210 --> 08:47.990] license. The artistic license which is uh basically you know it's an open source [08:47.990 --> 08:54.010] license. OSI certified. Um so I think these people deserve a lot of credit for what they've [08:54.010 --> 08:57.430] done. And everyone who's written open source software contributed to open source software [08:57.430 --> 09:03.070] that uh they've done a lot of great service for the community here. And uh I just wanted to [09:03.070 --> 09:06.450] say this up front to make so that when I start talking about all the other tools later that [09:06.450 --> 09:11.010] doesn't sound like you know everything's a problem. Uh there's certainly a lot of great uh [09:11.010 --> 09:17.270] truly open source software out there. And but I do see that uh more security tools are [09:17.270 --> 09:21.430] strictly commercial. And when I say strictly commercial I say that basically if you want to [09:21.430 --> 09:25.530] use the tool you've got to pay money. Um they they may have some sort of free version that [09:25.530 --> 09:29.330] allows you to download it and try it out for 30 days or on a certain number of IP addresses or [09:29.330 --> 09:35.070] something. But for the most part it's a uh it's a commercial tool. And uh and [09:35.070 --> 09:39.290] unfortunately those commercial tools restrict many of the things that security tool security [09:39.290 --> 09:44.030] tool users want to do. And uh that's really one of the things we're going to talk about for [09:44.030 --> 09:48.090] this session is a lot of those restrictions. And uh so I guess I'll just kind of throw the [09:48.090 --> 09:53.430] question out there. Is is there a place for commercial security tools? Do you guys think [09:53.430 --> 10:00.310] yes? No? Shake your head. A lot a lot of blank stares. Well I I I do. I don't like I said I'm [10:00.310 --> 10:04.730] not an open uh free software uh zealot. I think that there's a place for commercial [10:04.730 --> 10:08.750] security tools especially when there's not an open source equivalent. If if people are [10:08.750 --> 10:14.590] willing to pay money for it then then that makes sense. But um my other question would be [10:14.590 --> 10:21.950] should commercial security tools be licensed differently from other software? Yes or no? [10:22.150 --> 10:26.750] Again more blank stares. And I I think definitely yes. I think commercial commercial [10:26.750 --> 10:33.430] security tool users are much different than other tool users or other software users. So I [10:33.430 --> 10:37.710] think that the license can allow the kind of things that we want to do. And some tools do [10:37.710 --> 10:44.050] have pretty um pretty uh how do you say less restrictive licenses. Um IDA pro for example [10:44.050 --> 10:48.210] allows you to reverse engineer it. Which is kind of funny because it's a reverse [10:48.210 --> 10:52.950] engineering tool. But I guess they kind of saw that that was kind of a of something that a [10:52.950 --> 10:57.810] lot of commercial software doesn't allow you to do. And uh and also if you look at uh some [10:57.810 --> 11:03.130] of the vulnerability uh penetration testing tools like uh core impact or canvas. That [11:03.130 --> 11:07.270] those are commercial software that you have to pay for but they come with all the source [11:07.270 --> 11:11.910] code. So you can go ahead and modify the tool if you want to. Which is a which is a nice thing [11:11.910 --> 11:18.250] and it's certainly something that security tool users want to do. And uh the other kind of [11:18.250 --> 11:22.230] overarching uh theme that I've seen is that a lot of tools are released with what I call a [11:22.230 --> 11:28.530] custom license. Which is basically somewhere between commercial and open source. So there's [11:28.530 --> 11:33.130] a it permits some uses without cost. Usually it means that if it's uh you know for personal [11:33.130 --> 11:39.750] use or for non-commercial use it'll say you can use it. Um but it it usually requires either [11:39.750 --> 11:42.910] payment or something like that for something else. And it restricts some of the other [11:42.910 --> 11:48.350] things that we want to do uh that we'll get into later. And that's really what I'll talk [11:48.350 --> 11:51.930] about for the rest of this session is is those restrictions and uh and tools that have [11:51.930 --> 11:57.510] them. And and just as kind of an aside many of these tools that are kind of somewhere [11:57.510 --> 12:02.470] between open source and commercial are released by companies and not individuals. And [12:02.470 --> 12:07.050] that's because um the companies have have put money into developing this tool and they [12:07.050 --> 12:11.630] want to use it either they're gonna sell it to people or they want people to know that it [12:11.630 --> 12:15.330] came from them. That they don't want other people releasing uh modified versions of the [12:15.330 --> 12:28.820] tool and that sort of thing. Yes? A bait and lure? Um how how do you mean that? Oh [12:28.820 --> 12:34.200] certainly uh some some tools are like that uh uh like uh they'll have a uh a more [12:34.200 --> 12:38.320] restricted version that uh maybe only works for up to a certain number of IP addresses or [12:38.320 --> 12:41.940] whatever. And even even if you look at something like Nessus which I'll get into more a [12:41.940 --> 12:46.860] little later um Nessus is a great vulnerability scanner but it doesn't necessarily scale [12:46.860 --> 12:51.240] real well. And one of the things that Tenable the company that uh that is pretty much in [12:51.240 --> 12:56.100] charge of Nessus now that they uh they have some like web interfaces and other consoles [12:56.100 --> 13:01.140] that they'll sell you that uh allow you to manage uh Nessus scanners. So yeah certainly [13:01.140 --> 13:04.580] it is part of it that it's it's really marketing is what it comes down to to a large extent [13:04.580 --> 13:08.520] that a lot of these companies the consulting type companies you know they release free [13:08.520 --> 13:12.740] tools because they want to draw people to their website and uh and be able to then sell [13:12.740 --> 13:19.760] them consulting services and software and all that sort of stuff. Okay so now let's get a [13:19.760 --> 13:24.380] little bit more into the specifics uh and and the first one is just basically that that [13:24.380 --> 13:29.260] you sometimes you have to pay to use these tools. And uh and usually these are tools [13:29.260 --> 13:33.920] like I said that can be used for free in some situations and then uh in other situations [13:33.920 --> 13:39.220] you've got to pay. And uh sometimes they the license will say that the tool is for like [13:39.220 --> 13:43.560] personal use or non commercial use but there's it doesn't say anything about if you want to [13:43.560 --> 13:47.700] use it commercially how to buy it or how much it costs and there's no information on their [13:47.700 --> 13:53.180] website or anything. And that is very confusing for users that it kind of to me it's like [13:53.180 --> 13:56.320] if you're gonna charge if you want to charge money or you don't want people to use your [13:56.320 --> 14:00.700] software for commercial use you should make it easy for them to stay within the law. You [14:00.700 --> 14:04.720] should make it easy for them to buy the software if they want to buy it. And uh so that's [14:04.720 --> 14:09.900] kind of confusing. And also uh here's some examples of that and uh you can read through [14:09.900 --> 14:16.360] those. Um THC's are you there and is a is a tool that requires uh permission. It doesn't [14:16.360 --> 14:19.840] you you don't have to pay for it but it does require permission. And I lump payment and [14:19.840 --> 14:24.720] permission together because I kind of think that if you require permission for people to [14:24.720 --> 14:28.600] use it for commercial use then you're kind of leading up to maybe you're gonna start [14:28.600 --> 14:34.360] charging for it later. And uh and it really comes down to the same the same issues. Um [14:34.360 --> 14:38.560] Foundstone's free tools are that way that they their license says it's for personal and [14:38.560 --> 14:42.860] non-commercial use. Um but it doesn't say anything about how to purchase it for commercial [14:42.860 --> 14:50.140] use. Um the registered plugins for Nessus and also the VRT certified rules for Snort are uh [14:50.620 --> 14:54.880] are that way as well that you you need to register in order to be able to download these. [14:54.920 --> 14:59.780] Uh both of them use very similar business models in that they uh um the rules will be about [14:59.780 --> 15:05.980] 5 days out of date um if you're gonna use the uh free of cost version. Um and then if you [15:05.980 --> 15:10.760] wanna pay you know I think it's for Nessus it's like uh $1200 a year. I don't know for [15:10.760 --> 15:14.900] Snort how much it costs to buy the uh immediate download so that you know as soon as a new [15:14.900 --> 15:22.820] rule comes out you can get it. Um and then another tool is HTTP print which uh is just a [15:22.820 --> 15:31.340] little neat little web uh server fingerprinting tool. So anyway any questions there? Any other [15:31.340 --> 15:36.600] thoughts as far as other tools that are kinda in this vein or um people think this is a big [15:36.600 --> 16:11.280] problem or not? I don't know. Yeah go ahead. Yeah the just for people who didn't hear that [16:11.280 --> 16:16.940] basically the idea I think what you're saying is that uh basically violating the license of [16:16.940 --> 16:20.560] these tools that if it says it's only for non commercial use and you use it commercially [16:20.560 --> 16:25.040] that's the same as you know downloading you know Windows from the internet you know on [16:25.040 --> 16:37.450] BitTorrent or whatever. It's it's it's piracy and the BSA can come after you for it. Right [16:37.870 --> 16:41.650] exactly and that and that kinda illustrates why I put this whole thing together is that you [16:41.650 --> 16:45.330] know in my job I was downloading a lot of tools and I wanted to make sure that we were [16:45.330 --> 16:50.110] following the license. I didn't want to get my employer or our our customers in trouble so um [16:50.110 --> 16:53.830] yeah it's definitely one of those things that you need to be paying attention to the [16:53.830 --> 17:01.010] licenses of the tools that you're using. Okay uh another another feature that I've seen in a [17:01.010 --> 17:06.130] lot of licenses is that more more of them are restricting redistribution and uh basically [17:06.130 --> 17:09.270] that means that you can only get the tool from the author. That you know you can only [17:09.270 --> 17:13.190] download the tool from their website. Which is fine I guess until the the author [17:13.190 --> 17:16.810] disappears. You know if it's a company and it you know goes bankrupt or if the author [17:16.810 --> 17:20.570] unfortunately dies or decides he doesn't want to deal with it anymore it it makes it [17:20.570 --> 17:25.670] difficult that you know maybe a friend of yours has a copy of the tool but then you you the [17:25.670 --> 17:29.790] license says you can't redistribute it so it's one of those things that's uh it's it's kind [17:29.790 --> 17:33.990] of a gray area. It'd be it'd be nice if people would put in their license that you know if [17:33.990 --> 17:38.270] you're gonna restrict redistribution you know allow it if the case is that uh people can't [17:38.270 --> 17:42.350] find it from you anymore. And just some examples of those as far as tools that you might [17:42.350 --> 17:47.510] have used. Uh the Sysinternals tools are uh a lot of like little windows tools that uh will [17:47.510 --> 17:51.350] show you processes that are running in that. People use them in incident response. Um Net [17:51.350 --> 17:57.810] Stumbler actually restricts redistribution. Um and then again the Foundstone tools uh and [17:57.810 --> 18:05.970] Nessus and Snart plugins. So that's the next uh next thing that I've seen a lot of is uh tools [18:05.970 --> 18:11.790] that restrict or prohibit uh modification and reverse engineering. And uh that's really [18:11.790 --> 18:17.210] it's it's a problem because this is it it prevents us from being able to fix the tool. [18:17.210 --> 18:22.230] That you know even especially if the tools like uh Nessus the Nessus plugins restrict uh [18:22.230 --> 18:27.570] modification. But it's it's just a script. You know you've got the source code right there. [18:27.570 --> 18:31.270] You could easily go in there and fix things if you wanted to but the license doesn't allow [18:31.270 --> 18:36.850] you to. And uh and that's some other examples of that. Uh Kane Enable and also the [18:36.850 --> 18:42.230] Foundstone tools again and and Net Stumbler. Um this is like you can see mostly an issue [18:42.230 --> 18:46.150] with uh with Windows tools that you know if you don't have the source code it makes it [18:46.150 --> 18:52.190] difficult. But some of them like I said Nessus uh it is still an issue. And that's kind of [18:52.190 --> 18:56.430] the next issue is that a lot of tools don't come with the source code. So if you don't have [18:56.430 --> 19:00.950] the source code it makes it very difficult to make any changes. And uh well it's so [19:00.950 --> 19:05.130] strictly it's not a license issue in the sense of it's not in the license. But usually [19:05.130 --> 19:08.890] these tools that don't come with source code also have a license that restrict redistribute [19:08.890 --> 19:13.510] or restrict modification. So it's pretty much the same issue again. And and without the [19:13.510 --> 19:17.290] source code it's it's very difficult to make modifications to the tool and improve the [19:17.290 --> 19:21.810] tool. Try to fix them ourselves. You know a lot of times if you're using a tool on a client [19:21.810 --> 19:25.830] site and and something's being buggy or you're seeing that the output is weird and you want [19:25.830 --> 19:30.290] to be able to try to fix it. You know you can't do that if you don't have the source code. [19:31.150 --> 19:35.110] And uh and also the source code is valuable just for learning purposes. That if you want [19:35.110 --> 19:38.690] to learn how this tool is working and how you know what kind of protocols it's using [19:38.690 --> 19:43.310] especially if it's some sort of a like a vulnerability scanner or a a pen testing tool you [19:43.310 --> 19:47.010] want to know well what you know how is it connecting to the remote system? What exactly [19:47.010 --> 19:50.990] responses are we getting back? Maybe try to weed out some false positives and that sort [19:50.990 --> 19:54.450] of thing. Well that's that's very difficult if you don't have the source code to know you [19:54.450 --> 19:58.930] know what the thing is uh is doing. And and obviously source code is also necessary if you [19:58.930 --> 20:04.090] want to port it to another platform. So if you've got a a Windows tool that's running a you [20:04.090 --> 20:09.650] know standard C++ compiled program then well you've gotta want to port that over to Linux [20:09.650 --> 20:14.250] and that's not really not possible without the source code. And uh even even in some [20:14.250 --> 20:18.990] supposedly portable languages like Java and dot net um there you'll a lot of times run [20:18.990 --> 20:22.690] into little issues between platforms that you need the source code in order to kind of [20:22.690 --> 20:27.190] convert things. Especially if the original programmer didn't consider porting that you [20:27.190 --> 20:31.270] know maybe they're using some Windows specific APIs that aren't available in the dot net [20:31.270 --> 20:37.930] framework for uh for Linux and uh OS 10 and that sort of thing. And again this is mostly [20:37.930 --> 20:42.330] Windows tools although occasionally you'll see it on other tools. Um I don't use Macs but [20:42.330 --> 20:47.870] probably Mac tools uh have some of that as well. And here's a bunch of examples um and [20:47.870 --> 20:51.650] some of them some of them I'm not sure if it was intentional that they didn't include the [20:51.650 --> 20:55.890] source code. Some of them you may be able to email the author and get it from them um but [20:55.890 --> 21:00.310] these are just the ones that I saw that weren't you know readily available on their website. [21:00.510 --> 21:04.710] And uh some of the new ones here you know Achilles well Achilles is an old tool but we [21:04.710 --> 21:10.490] haven't talked about it yet. Um Brutus, uh Sam Spade and uh Odysseus. Um Achilles and [21:10.490 --> 21:21.180] Odysseus are web uh proxies. And there's actually a couple tools uh fortunately only two so [21:21.180 --> 21:26.920] far that require uh credit in the consulting reports. So if you use THC AMAP or THC [21:26.920 --> 21:31.600] Hydra as part of a penetration test or other sort of commercial uh consulting you know [21:31.600 --> 21:35.600] assessment that you're doing. There's actually a a clause in the license that you have to [21:35.600 --> 21:41.260] give them credit in the consulting report. Um I don't know how many people actually do [21:41.260 --> 21:47.040] that or not. I don't know if uh I'm I'm I'm glad like I said that only a couple tools are [21:47.040 --> 21:51.080] doing this so far because if it becomes real common it could be real troublesome to try to [21:51.080 --> 21:55.440] remember well which tools did I use in this consulting and you know trying to get all the [21:55.440 --> 21:59.540] credits in there and making sure the customer doesn't get kind of confused as to why you've [21:59.540 --> 22:06.020] got all this stuff in your report. So is that new to anybody? I mean is do any anybody use [22:06.020 --> 22:14.080] that tool that didn't know about that? No one wants to admit it anyway. Okay well another [22:14.080 --> 22:18.520] another issue I've run into is that sometimes tools have a lot of these restrictions in [22:18.520 --> 22:23.100] their license but then they kind of will tell you in mailing lists or or other places that [22:23.100 --> 22:28.440] well don't worry about it you know. We really didn't mean that I guess. Um and that's a [22:28.440 --> 22:33.020] little bit confusing. So sometimes uh in these couple examples the website is different [22:33.020 --> 22:37.000] from what comes with the tool. So you download the tool and inside the tarball or inside [22:37.000 --> 22:40.640] the zip file is a license that's different than what you see on the website when you [22:40.640 --> 22:46.520] download the tool. Um one example is you know THC Hydra and AMAP. The license is only [22:46.520 --> 22:50.000] slightly different but there's a little difference in the I think it's actually in the [22:50.000 --> 22:54.360] clause that I just showed you that the the credit is different. That I think one of the [22:54.360 --> 22:58.900] licenses it says you have to include the tool name, version, and authors and in the other [22:58.900 --> 23:04.020] one it says you only have to include the name and the version or something like that. And [23:04.020 --> 23:09.560] uh another more significant one is uh Foundstone recently released a tool called uh WS [23:09.560 --> 23:14.960] Digger. I believe it's a web services scanning tool um but don't quote me on that. Um the [23:14.960 --> 23:18.400] license on the website is the standard Foundstone license which we've been talking [23:18.400 --> 23:21.500] about which is very restrictive. You know personal and non-commercial use only. No [23:21.500 --> 23:25.940] reverse engineering. All that other stuff. But when you download the tool inside the tool [23:25.940 --> 23:30.420] distribution is the Apache 2.0 license which is an open source license which allows you to [23:30.420 --> 23:35.580] do all those things that we want to do. So which license are you supposed to follow? I [23:35.580 --> 23:39.480] don't know. But from what I've seen on the when they announce the tool that it's meant to [23:39.480 --> 23:42.920] be under the Apache license there's just uh some sort of miscommunication on their [23:42.920 --> 23:50.540] website. Um another example is that uh sometimes the author like I said on a mailing list or [23:50.540 --> 23:55.800] something will will contradict the tool's license. So when you have a a Foundstone's [23:55.800 --> 24:01.100] Hack Me Bank and their Hack Me Books tools um are great great tools to learn about uh web [24:01.100 --> 24:04.940] web applications and do some pen testing against them in a lab environment and all that. [24:05.180 --> 24:09.640] And but again the license says that they're personal and non-commercial use. So I emailed [24:09.640 --> 24:14.140] them because I wanted to set it up on our internal network at my company and uh they said [24:14.140 --> 24:18.280] oh yeah no problem to use it on an internal lab. You know that they they didn't want other [24:18.280 --> 24:22.160] people going out and you know teaching classes which is part of you know how they make [24:22.160 --> 24:25.720] money using these tools because they put a lot of work into them. But they don't mind you [24:25.720 --> 24:31.520] using them you know at work personally. And that that's something we'll uh another issue [24:31.520 --> 24:35.640] that I've seen is that you know a lot of times people say personal use or non-commercial [24:35.640 --> 24:39.380] use but they don't define that. And and different different companies have different [24:39.380 --> 24:44.860] definitions. Um I know it's not a security tool but uh Google Toolbar um it defines [24:44.860 --> 24:51.040] personal use as if you download it yourself it's okay. So I can use Google Toolbar at work [24:51.040 --> 24:55.200] as long as I install it myself but my system administrator can't install it on every [24:55.200 --> 25:00.440] single machine. Um I don't know it's just it's one of those things that it's different [25:00.440 --> 25:03.580] companies have different definitions so if you're not defining it then it's hard to hard [25:03.580 --> 25:10.220] to enforce it. And then another example is the the the ton of the uh the registered [25:10.220 --> 25:46.680] plugins for Nessus. Yes go ahead. Right. Right yeah that's a that's a good point for if you [25:46.680 --> 25:50.940] guys didn't hear. He basically said that if like the Foundstone tools that they were [25:50.940 --> 25:55.020] written by people at Foundstone but Foundstone owns the copyright. They're the copyright [25:55.020 --> 25:59.700] holder for those tools so they decide the license. And the authors of those tools don't [25:59.700 --> 26:03.880] necessarily have the authority from their employer to waive that license or change the [26:03.880 --> 26:08.700] license. So you need to be aware of that. Um as far as who who actually owns the tool and [26:08.700 --> 26:13.720] are you actually getting permission from the right people. Um the registered plugins for [26:13.720 --> 26:17.760] Nessus is another tool that's uh a little strange because the license is very restrictive [26:17.760 --> 26:23.280] it doesn't allow you to change the plugins or um reverse engineer the plugins. Which is [26:24.240 --> 26:27.580] a bit a bit strange because uh there's some problems with their plugins. You know they [26:27.580 --> 26:32.120] they always have problems with false positives or typos and descriptions and that. And [26:32.120 --> 26:35.920] nothing bad it's just they've got six thousand of the things. So there's inevitably [26:35.920 --> 26:40.020] there's going to be problems that show up. And they've also they frequently have problems [26:40.020 --> 26:45.620] with versions of of uh of services that they're scanning. That you know that when a new [26:45.620 --> 26:49.220] version comes out they're going to give you back uh something strange that it's not [26:49.220 --> 26:53.720] expecting. So anyway the the license prevents you from making those changes yourself or [26:53.720 --> 26:59.220] distributing them. Uh but on the mailing lists the the owner of Tenables which I think is [26:59.220 --> 27:03.500] authorized to make this statement said oh yeah no problem you know you can you can make [27:03.500 --> 27:07.820] changes to the plugins and you can post it back to the the Nessus mailing list so that [27:07.820 --> 27:12.000] other people can see them. So that's another one of those things where it's like well who [27:12.000 --> 27:15.360] do you really follow? I mean I would guess that you know if if they've said that [27:15.360 --> 27:19.260] publicly and and I know people have done that and no one's gotten sued so it's probably [27:19.260 --> 27:22.180] okay but it's just a little confusing for the users that they really should straighten [27:22.180 --> 27:29.360] that out. And the other really big issue that I've seen is a lot of tools just don't have a [27:29.360 --> 27:36.480] license that they are you know you just can't find it and and maybe the the it's uh I don't [27:36.480 --> 27:39.900] know there there may be you know some of these there that I'm going to mention maybe the [27:39.900 --> 27:43.680] tools and maybe the license is in the tool distribution it's just hard to find. I have [27:43.680 --> 27:48.700] seen ones where the binary that gets compiled or is distributed doesn't have any license [27:48.700 --> 27:52.900] at all associated with it but if you look at like the comments in the uh source code [27:52.900 --> 27:57.060] files it'll say you know this tool is under the GPL or this tool is under whatever license [27:57.720 --> 28:02.100] um which is really not sufficient you're supposed to include the the full GPL in there [28:02.100 --> 28:06.340] rather than just saying uh it's supposed to be G excuse me it's supposed to be under the [28:06.340 --> 28:11.320] GPL. Uh and and sometimes the tool's just not present at all you know you just can't find [28:11.320 --> 28:16.900] it and uh and this is also a big problem if you can't figure out who the author was if you [28:16.900 --> 28:19.740] know the maybe you've got an email address that doesn't work anymore or something like [28:19.740 --> 28:24.700] that so then it's kind of like who knows. And then the other thing is that a lot of times [28:24.700 --> 28:28.660] there if there is a license it might be there but it's pretty incomplete that it just [28:28.660 --> 28:32.340] basically says something real simple like oh use it for whatever you want or something [28:32.340 --> 28:36.900] like that well that isn't really a full license in the sense of it doesn't talk about all [28:36.900 --> 28:40.480] the different things that we want to be able to do with tools and give us permission for [28:40.480 --> 28:45.960] it. Again I'm not a lawyer but my understanding of copyright law is that pretty much if the [28:45.960 --> 28:52.560] license doesn't say you can do it then you're not supposed to do it. And and a lot of [28:52.560 --> 28:57.040] times this is uh this is a problem with small exploits and scripts and stuff that are [28:57.040 --> 29:01.180] posted to uh I call them online forums here just to include everything but mailing lists [29:01.180 --> 29:06.420] news groups you know if you look at uh full disclosure or bug track mailing lists hardly [29:06.420 --> 29:09.920] any of the exploits that are posted there have any sort of license associated with them. [29:10.240 --> 29:15.940] And uh again it'd be it'd be nice if uh if we could say well if you post something in a in a [29:15.940 --> 29:19.920] forum like that and don't include a license it's uh it was meant to be you know in the [29:19.920 --> 29:23.780] public domain or something like that but I don't think that's the way the law works but [29:23.780 --> 29:31.080] again I'm not a lawyer. Um here's just some examples here um a bind view's a noom tool I [29:31.080 --> 29:36.660] wasn't able to find a license for it. Um hobbit's original netcat uh there was no license [29:36.660 --> 29:42.540] associated with that. Uh john the ripper um I I think what happened was solar designer the [29:42.540 --> 29:45.980] guy who wrote the tool um incorporated some other code that he wasn't sure about the [29:45.980 --> 29:49.640] license into the tool so that's why there's no license cause he he doesn't even know what [29:49.640 --> 29:54.460] the license is. But um he has said that the next version 1.7 is going to be released [29:54.460 --> 29:59.560] under the GPL um but I have no idea when that's going to happen I mean 1.6 has been out [29:59.560 --> 30:04.440] forever so I don't I don't know when that's going to happen. Um and some other tools [30:04.440 --> 30:08.680] that I saw on sequel security dot com has a lot of sequel tools that uh I didn't see any [30:08.680 --> 30:17.440] license for. And some other ones that we've already talked about. So okay where where are [30:17.440 --> 30:23.020] we at in time? Okay we're we're in good shape. So do you guys agree that this exists? You [30:23.020 --> 30:27.180] know I've talked a lot about you know I think more tools are going to this kind of um more [30:27.180 --> 30:37.980] restrictive licenses. Do you guys agree? Disagree? Um what's what's your thoughts? Yeah [30:37.980 --> 30:54.070] go ahead. Right the the comment was that a lot of tools seem to be uh that they're it's [30:54.070 --> 30:57.730] almost like the bait bait and uh bait and hook method that someone else mentioned that [30:57.730 --> 31:02.470] they they have like free tools to kind of hook you in and then they uh try to get you to to [31:02.470 --> 31:06.670] pay for uh other tools or a more expanded version or something like that. And definitely [31:06.670 --> 31:11.550] that's that's been the case in software for a long time but in security tools it's I think [31:11.550 --> 32:06.460] it's more of a recent trend you know. Yes go ahead. Yeah. Yes I I think that's definitely [32:06.460 --> 32:11.500] true. Um just to repeat for people who may not have heard is that the authors of the tools a [32:11.500 --> 32:16.220] lot of times will will will either clarify the license if it's not there or they'll give you [32:16.220 --> 32:19.840] the source code. They're you know usually if you can get a hold of them they're they're [32:19.840 --> 32:22.780] pretty nice about it and they like to hear that people are using the tools. And definitely [32:22.780 --> 32:26.240] that's that's one of my recommendations uh that we'll get to later on is you know yeah [32:26.240 --> 32:30.680] work work with those people to see what the uh what the license is if it's not uh if it's [32:30.680 --> 32:48.470] not clear. But uh yeah I I agree. Yeah go ahead. I I am not a lawyer. I don't know. I I would [32:48.470 --> 32:54.330] say no just off hand that you know again if someone posts something to full disclosure or [32:54.330 --> 32:58.990] bug track with no license attached I'm assuming he means people can use it for something at [32:58.990 --> 33:08.720] least. But I don't know. I don't know. And that well that's actually something we'll get [33:08.720 --> 33:53.120] into in a little bit. But what what's your thoughts? Yeah that's that's a good point. Just [33:53.120 --> 33:58.000] real quick summary was that you know that there there may be an implied license there that if [33:58.000 --> 34:01.820] someone has released a tool where anyone in the world can get to it either on a mailing list or [34:01.900 --> 34:06.220] a website that you could make the argument that they intended for people to be able to use it [34:06.730 --> 34:11.180] for for things. Again talk to your lawyer and it made it probably depends a lot on what [34:11.180 --> 34:30.150] country you're in. Again I'm not a lawyer but my my understanding is that a license is [34:30.150 --> 34:34.990] similar to a contract and just because you and I sign a contract doesn't necessarily mean [34:34.990 --> 34:40.370] that everything is enforceable. And I don't know all the exact caveats but I know [34:40.370 --> 34:44.610] for instance I can't sign a contract saying that I'll be your slave for the rest of my life. [34:44.610 --> 34:52.230] That that is not a legally enforceable contract. So anyway. Um let me move on to another [34:52.230 --> 34:57.210] question. So and I think we kind of covered this but I'll ask it more specifically is is there a [34:57.210 --> 35:00.950] problem with this? And we have certainly identified a problem of you know if stuff doesn't [35:01.070 --> 35:04.570] have a license and it's kind of in in limbo that it'd be good to have some clarification [35:04.570 --> 35:09.210] there. But um with reference to the other trends that we've seen as far as more more tools [35:09.210 --> 35:15.850] requiring uh payments and uh permission for uses and all that is it does that is that a [35:15.850 --> 36:02.940] problem for the security security community? Yes? No? Yeah go ahead. Yeah that's that's a [36:02.940 --> 36:08.840] good point and uh but quickly a summary of it was that uh yeah that some some tools out [36:08.840 --> 36:12.800] there even security tools that are restricting reverse engineering and cryptanalysis of [36:12.800 --> 36:16.800] them that really causes a problem for us that want to be able to evaluate these tools and [36:16.800 --> 36:21.420] decide are they good or bad uh to deploy into our companies or to recommend to our [36:21.420 --> 36:27.740] customers and and that sort of thing. So that that certainly is a problem. Okay uh next [36:27.740 --> 36:34.100] question was uh well what what can we do to improve security tool licensing? I've got my [36:34.100 --> 36:37.620] own thoughts that uh that I'll talk about in a little bit but I just want to hear what you [36:37.620 --> 36:48.080] guys have to say. Anyone got any suggestions? Yeah go ahead. Make a new license. Yeah well [36:48.080 --> 36:52.160] and and that was that's that's definitely one of my points uh that I'll talk about later is [36:52.160 --> 36:58.280] that yeah if you it would be great if people want an open source product make it an OSI [36:58.280 --> 37:02.180] approved license. Don't make up your own license because it'll run into a lot of these [37:02.180 --> 37:06.440] problems and it makes it confusing for the users. That yeah it's it's hard especially [37:06.440 --> 37:11.420] because of the nature of security tool work that we end up using a lot of little tools to do [37:11.420 --> 37:16.820] our work and it's very it's it's a pain to be able to try to keep track of the licenses of [37:16.820 --> 37:19.720] all these tools and make sure that we're not you know doing something that we're not [37:19.720 --> 37:54.260] supposed to be doing. Any other suggestions before uh mine? Yeah go ahead. Yes that's [37:54.260 --> 37:59.640] that's definitely a good point. Uh the the point was that if you're buying a security [37:59.640 --> 38:04.980] product or even if you're using it for free it it but mostly if you're buying it is you [38:04.980 --> 38:08.320] know talk to the authors or whoever tried to sell this to you and and tell them you [38:08.320 --> 38:11.580] don't like the license. Tell them that you want a different license. Especially for as [38:11.580 --> 38:16.440] much money as we pay for a lot of security products that uh it's amazing that the the [38:16.440 --> 38:19.920] kind of restrictions that they want to put on what we can do and the fact that people [38:19.920 --> 38:23.800] just accept them you know and just kind of treat it like any other piece of software that [38:23.800 --> 38:26.920] they're gonna well we just gotta live with it. Well no you don't have to live with it [38:26.920 --> 38:30.400] especially a lot of these smaller companies that are selling these things that you know [38:30.400 --> 38:34.280] they they want your business and they're willing to make concessions and especially if [38:34.280 --> 38:40.060] they um can understand that what they're trying to restrict is really not um it's it's [38:40.060 --> 38:44.000] it's restricting what we want to do with the tools. And and it really comes down to I [38:44.000 --> 38:48.240] think don't treat your users like criminals you know. If you're you're not giving them [38:48.240 --> 38:52.560] source code and you're preventing them from reverse engineering the tool well you're [38:52.560 --> 38:56.100] you're kind of assuming that oh they want to do something bad to us. Well no we just [38:56.100 --> 38:59.880] want to be able to use the tool is what it comes down to and being able to use it in the [38:59.880 --> 39:07.060] most efficient way that we know how. Okay I got ten minutes left. Okay any any other [39:07.060 --> 39:13.760] suggestions? Okay I'll I'll run through what I have on here and it's it's really just kind [39:13.760 --> 39:20.640] of my own you know thoughts feel free to disagree or or uh what not. Um few few issues for [39:20.640 --> 39:26.080] uh tool users. Well obviously read and follow the licenses you know you you can't [39:26.080 --> 39:31.680] just ignore ignore the issue. And if you don't like the if you don't like the license don't [39:31.680 --> 39:36.840] use the tool or at least go back to the author and say hey can we get this changed. But don't [39:36.840 --> 39:43.340] just ignore it and kind of go on and do whatever you want. And I'd also say uh I call it [39:43.340 --> 39:49.800] legal trickery but just be don't use the uh don't follow the letter of the license while [39:49.800 --> 39:54.240] violating the spirit of the license. And and a lot of that comes down to to uh you know how [39:54.240 --> 40:00.000] you define you know commercial use and that kind of thing. You know if if you don't don't [40:00.000 --> 40:06.400] get into that it would be my recommendation. And uh again work with the writer the tool [40:06.400 --> 40:11.760] writers to clarify if there's a problem and and the key there is politely because tool tool [40:11.760 --> 40:15.600] writers uh have a lot of times you know especially if they're writing it on their own you [40:15.600 --> 40:19.620] know they're they're not getting paid to do it. They have a lot of people emailing them with [40:19.620 --> 40:23.940] bugs and stuff like that and you know you don't want to make demands of them but just talk to [40:23.940 --> 40:29.520] them and usually they'll be pretty uh accommodating. And and also encourage them to remove [40:29.520 --> 40:35.320] the license restrictions which is uh good for everybody. And and also if you if you make [40:35.320 --> 40:39.980] changes to a tool um whether it be an open source tool or any other tool you know share the [40:39.980 --> 40:44.040] changes you know allow all of us to work together on these things so that everyone's not [40:44.040 --> 40:51.140] out you know reproducing the same you know events. Okay well tool writers well you just [40:51.140 --> 40:54.920] obviously you need to follow the license for any software that you're incorporating into your [40:54.920 --> 40:59.520] tool. Um in particular you know if you've got like GPL software or something you can't [40:59.520 --> 41:05.060] just cut cut and paste that into a commercial product. Um choose choose a license and [41:05.060 --> 41:09.820] include it with every tool. That's uh kind of self explanatory. And and remember you know if [41:10.240 --> 41:14.540] the copyright holder can add another license at any time. So just because I released a tool [41:14.540 --> 41:18.680] under the GPL today doesn't mean that every version of that tool is always going to be GPL. [41:18.680 --> 41:23.920] I can release the next version of it under a completely different license. That's that's not [41:24.040 --> 41:29.360] a problem because I own I own the work. And if your employer holds the copyright then [41:29.360 --> 41:34.040] encourage them to use a less restrictive license or just a standard open source license. [41:34.040 --> 41:38.760] That that can go a long way to just you know telling your boss you know hey this is what we [41:38.760 --> 41:42.260] want to what users are going to want to be able to do with this tool and we think it'll be [41:42.260 --> 41:46.300] helpful in the long run because especially if the company is trying to release the tool as [41:46.300 --> 41:50.920] you know marketing and and being able to draw people to their site. Well more people that [41:50.920 --> 41:59.140] use the tool the better it is for them. Um just a quick a quick note of don't make a don't [41:59.140 --> 42:03.360] make a some complicated restrictive license for a pretty simple tool. You know if it's if [42:03.360 --> 42:08.160] it's a simple tool just release it under you know a BSD license or or GPL or something real [42:08.160 --> 42:13.680] simple. And and also say say what you mean and mean what you say when you're uh licensing [42:13.680 --> 42:17.620] the tool. Don't don't do this kind of well the license says you can't do it but then I'm [42:17.620 --> 42:23.000] going to email people and say that they can. And and again if you if you want it to be open [42:23.000 --> 42:29.180] source just use an OSI standard license. Don't make up your own. And it if you're going to [42:29.180 --> 42:33.220] require payments well obviously you need to make the cost reasonable or people aren't going [42:33.220 --> 42:36.660] to buy it. Make it make it easy for the people to buy the tool. That they can find it on your [42:36.660 --> 42:40.180] website. That you've got a link that you people can go to a secure form put in their credit [42:40.180 --> 42:43.840] card information and download the tool. You know you're you're going to get more people [42:43.840 --> 42:47.780] buying it that way than if they've got to email you and and try to figure out what's going on. [42:48.460 --> 42:51.500] And that's pretty much what's there. And and obviously you know make sure you tell people [42:51.500 --> 42:56.260] you know what what upgrades are going to be included. What support and all that. And and [42:56.260 --> 43:00.040] that's just kind of also a disclaimer that you know that's what users are going to expect. If [43:00.040 --> 43:03.980] they're paying for a tool they're going to expect some upgrades and support. And also [43:03.980 --> 43:09.920] consider bundling perhaps the tool with other tools or other authors because um sometimes [43:09.920 --> 43:14.160] people will release a you know little small tool that's kind of useful and they'll say oh it's [43:14.160 --> 43:19.100] you know five dollars or something. Well five dollars is nothing as far as payment but it's a [43:19.100 --> 43:22.960] huge pain in the butt for people that work at a large company or work in the government [43:22.960 --> 43:28.100] because there's a lot of paperwork that goes into buying tools or buying anything. So if if [43:28.100 --> 43:31.680] you're going to make it one of those kind of real cheap tools then maybe bundle it with some [43:31.680 --> 43:35.240] other stuff so that people can buy it more easily. And then if you're going to require [43:35.240 --> 43:38.620] payment you know make sure you define what you mean by you know non-commercial use or [43:38.620 --> 43:42.820] whatever. And there's all sorts of things to consider you know there's development and [43:42.820 --> 43:47.340] testing and internal use and consulting use and educational institutions, government [43:47.340 --> 43:52.380] entities, all this stuff. So you need to make sure you clarify what you mean by all those [43:52.380 --> 43:59.240] terms. And and again I recommend you know don't don't disallow you know redistribution [43:59.240 --> 44:04.360] entirely. Um it's nice to you know allow users to email it to their friends or other people [44:04.360 --> 44:10.080] they think might be users. And uh you know if in the case that the website is is gone [44:10.080 --> 44:16.200] forever then you know let people redistribute it more widely. And and again a lot make the [44:16.200 --> 44:20.060] source code available regardless of whether it's a commercial product or not. You know give [44:20.060 --> 44:24.920] give people the users the source code and allow them to make modifications for internal use [44:24.920 --> 44:30.920] at least. And uh just so they can you know fix things. Um allow users to distribute the [44:30.920 --> 44:34.600] modifications to one another. That you know if you've got if it's a commercial tool maybe [44:34.600 --> 44:38.980] you should set up an internal type mailing list just for tool users and that they can uh [44:38.980 --> 44:44.020] email stuff to each other. And and if you're gonna distribute the source code obviously [44:44.020 --> 44:48.280] make sure it's complete. You've got all the build files and libraries and stuff like that. [44:48.280 --> 44:52.360] And just give a quick how to of you know hey this is a Visual Studio project this is how to [44:52.360 --> 44:59.980] compile it. And again make the tool the license clear. Post it on the website. It a lot of [44:59.980 --> 45:03.300] tools that I noticed that you you couldn't find figure out what the license was until [45:03.300 --> 45:07.320] after you've already downloaded the thing. Well if it's a if it's a several megabyte file [45:07.320 --> 45:10.340] then it's kind of a waste of time to have to download it just to figure out what the license [45:10.340 --> 45:15.260] is. And you know if you're if you're gonna release a news item or post something on a [45:15.260 --> 45:18.900] mailing list about the new tool that's available just include a quick summary of you know [45:18.980 --> 45:24.100] it's a GPL or it's uh you know free for non-commercial use or whatever. You know include [45:24.100 --> 45:28.180] the the copying or license file or something like that in the distribution. Um and then [45:28.180 --> 45:32.160] the online help again put a little summary there. And if you're gonna go to a conference [45:32.160 --> 45:37.640] like Def Con or Black Hat or whatever you know tell people when you're presenting and um [45:37.640 --> 45:40.740] that's important so that people don't get all excited about something and then figure out [45:40.740 --> 45:45.320] that it's well it's under some strange license. And and just for the record Black Hat and [45:45.320 --> 45:48.460] Def Con are actually really good about that that I don't think you're allowed to present [45:48.460 --> 45:52.880] tools at at these conferences without a it being free for at least the conference [45:52.880 --> 45:59.700] attendees. But not all um conferences are like that. And that's just kind of just here I'll go [45:59.700 --> 46:03.780] through this real quick is you know make sure that if you're running a conference you make [46:03.780 --> 46:07.940] sure that people know what the licenses are at least and and consider making it like like [46:07.940 --> 46:12.400] Def Con and Black Hat that if you're gonna present a tool it has to be free for at least [46:12.400 --> 46:19.260] the attendees. And then uh the the big one that I think uh we were talking about earlier is [46:19.260 --> 46:24.220] that if the people that run online forums that's mailing lists or news groups or whatever you [46:24.220 --> 46:29.860] know again I'm not a lawyer but I would think that you could you know come up with like a [46:29.860 --> 46:33.620] default license that you know if if stuff is posted to this mailing list without any other [46:33.620 --> 46:37.900] license attached it's gonna fall under this license. And I'd recommend making that you know [46:37.900 --> 46:42.460] the BSD license or an MIT license. So something that basically says you can use it for [46:42.460 --> 46:47.300] whatever you want don't sue me if it breaks something. And uh and if if people are gonna [46:47.300 --> 46:52.820] patch or post patches to existing tools then it probably makes sense to dual license those [46:52.820 --> 46:57.920] under the forums license and also the existing tools license because if that way if the [46:57.920 --> 47:01.980] person who wrote the original tool uh wants to incorporate that into their tool then they [47:01.980 --> 47:07.160] can do that with no problem. And and also you want to decide you know are you gonna let [47:07.160 --> 47:11.960] people post things under some different license um in particular if people are making up [47:11.960 --> 47:15.740] their own license that doesn't allow redistribution then mailing lists archives and stuff [47:15.740 --> 47:20.560] get screwed up. And then just you know make it clear to members when they join the mailing [47:20.560 --> 47:26.260] list or uh on the website or for the web forum or whatever or in an FAQ that that uh that's [47:26.260 --> 48:06.610] what the license is. So that's all I have yes go ahead. Okay yeah I I understand what you're [48:06.610 --> 48:11.750] saying there I guess uh the the his second point was that some tools especially very [48:11.750 --> 48:16.690] expensive tools they don't want to post the price on their website because you can't just [48:16.690 --> 48:20.510] download it you know you need to talk to them you need to negotiate a contract there's usually [48:20.510 --> 48:24.910] support that involves but you know that's for tools that are in the thousands of dollars. I'm [48:24.910 --> 48:31.090] thinking about tools that are you know in the you know tens or hundreds of dollars. Well [48:31.090 --> 48:36.170] again it's like you know you you you gotta define what you mean by that and all that but [48:36.170 --> 48:39.430] yeah you know there's a lot of you know especially a lot of the security tools that we use you [48:39.430 --> 48:43.610] know little command line things that that shouldn't cost a lot of money. Um and what was [48:43.610 --> 48:53.440] your first point you said something about cross posting? Um yeah how how do you determine [48:53.440 --> 48:59.900] who the original author is? Uh yeah that that's definitely a problem that if if stuff has [48:59.900 --> 49:03.500] been posted especially if it's gone through like an anonymous remailer or something like [49:03.500 --> 49:07.340] that or an email account that doesn't work anymore yeah sometimes you you can't even figure [49:07.340 --> 49:12.440] out who the original author was so I don't know how to fix that but I'm hoping that you know [49:12.440 --> 49:17.580] maybe we can get some forward some forward uh thinking into this that in the future this [49:17.580 --> 49:21.600] won't be a problem if there is some sort of default license that things will fall under. But [49:21.600 --> 49:26.880] again I'm I'm assuming that can be done I'm again I'm not a lawyer so I don't know. Any other [49:26.880 --> 49:31.760] comments or questions? We got a couple. We're done. Okay. Okay well thanks. If anyone else [49:31.760 --> 49:33.100] has any comments see me?