WEBVTT 00:10.330 --> 00:11.010 Boo! 00:13.130 --> 00:20.610 Well, I'm Chuck Willis and as you can see on my presentation here, this talk is called Trends in Licensing of Security Tools. 00:20.910 --> 00:22.970 Sorry, I'm going to try to keep speaking into the mic. 00:23.190 --> 00:27.950 If you can't hear me or anything, just give me one of these or just say something. 00:27.970 --> 00:30.350 I want to make sure that you guys can hear what I'm saying. 00:30.350 --> 00:32.170 And I also want to hear what you're saying. 00:32.170 --> 00:45.870 This is meant to be an interactive presentation and in a way it's good we've got a small crowd here that we can uh maybe people will feel more free to talk a little bit about this because I I certainly don't intend to come up here and say that I have all the answers. 00:46.030 --> 01:00.830 It's really just more of a kind of uh my slides are going to try to provoke some thoughts from you all and give kind of what my thoughts on are as far as uh where licensing is going and security tools and and uh what might be some problems with that. 01:00.850 --> 01:04.470 So anyway, as I mentioned, I'm Chuck Willis. 01:04.470 --> 01:10.270 Um these slides are a little updated from what's on your uh CD so you can go to my website and download them if you want. 01:10.270 --> 01:13.110 There's nothing real substantial in the way of changes. 01:14.490 --> 01:18.430 And just uh in case you uh couldn't figure it out from the title. 01:18.450 --> 01:31.070 So what we're going to be doing is uh I I want to discuss uh the trends as far as the kind of the changes that I've seen in licensing of security tools and uh and also talk about how that affects the security community. 01:31.610 --> 01:36.070 And uh I also want to discuss you know how licensing could be improved if if necessary. 01:36.070 --> 01:39.750 I mean maybe maybe you all think there's not a problem with what's going on. 01:39.770 --> 01:56.010 And uh and also as kind of a kind of a secondary thing that you I expect that you know maybe some of you all will learn something about uh security tool licenses in that there's a lot of tools that I'm going to talk about that um you think are are free open source tools that that really aren't. 01:56.010 --> 01:58.330 And again this this is meant to be interactive. 01:58.330 --> 02:05.190 So I'm I'm going to ask a lot of questions and I hope that you all will will have some uh some thoughts and share share those with us. 02:06.490 --> 02:08.630 Uh just a few disclaimers here. 02:08.630 --> 02:13.150 Um I I am going to talk about specific tools that have uh restrictions in their licenses. 02:13.210 --> 02:19.930 And uh this is not meant to be like just ragging on these people or you know trying to talk bad about people. 02:19.930 --> 02:26.390 But I just think it makes the talk much more interesting if you've got concrete examples to talk about rather than a bunch of abstract stuff. 02:26.750 --> 02:33.190 Um and and and I do think that the authors of those tools have done a service to the community by releasing them under the license that they're under. 02:33.210 --> 02:40.390 I mean they could a lot of the tools that I'm going to mention could easily be you know strictly commercial tools that you have to spend thousands of dollars for. 02:40.530 --> 02:43.810 So certainly the authors are going to be commended for what they've done. 02:43.810 --> 02:49.230 And also I wouldn't be talking about the tool if I didn't think it was a useful tool that people uh people use. 02:49.230 --> 02:52.150 So I'm not going to be talking about real obscure stuff I don't think. 02:52.550 --> 02:56.830 And uh finally the licenses may have changed since I put these slides together. 02:56.830 --> 02:58.650 Uh licenses change all the time. 02:58.650 --> 03:03.930 So this is uh the this is a disclaimer there that stuff might have changed since I put this together. 03:04.270 --> 03:09.290 And the you need to go out and read the license if you're going to use these tools. 03:09.290 --> 03:11.930 You know this don't just rely on what I'm going to tell you. 03:13.130 --> 03:15.230 Okay so a little bit about me. 03:15.230 --> 03:18.490 Um I I work for a government contractor. 03:18.610 --> 03:27.730 Um I don't work for and yeah the reason I say that is I don't work for a consulting firm or software firm which is who releases most of the security tools as far as companies. 03:27.830 --> 03:31.850 And then a lot of security tools are released just by individuals that do it in their spare time. 03:32.390 --> 03:35.370 So I think I'm a a bit independent in that sense. 03:35.490 --> 03:37.270 Um I'm not a free software zealot. 03:37.270 --> 03:40.010 I'm not going to come up here and say that everything should be GPL. 03:40.250 --> 03:42.110 Um cause I don't I don't think that's the case. 03:42.110 --> 03:47.610 And I use commercial software along with open source software and all sorts of other software. 03:47.770 --> 03:50.650 And and again I'm not a lawyer this is not legal advice. 03:51.310 --> 03:55.470 So but I I do think I'm a pretty typical security tool user. 03:55.470 --> 04:10.810 I mean I I use a lot of tools in my work and also at home when I'm messing around with stuff and uh and I and I kind of wanted to illustrate this to show that uh you guys I think are typical security tool users as well but we're different from normal software users. 04:10.810 --> 04:13.710 You know I I use both Linux and Windows. 04:13.710 --> 04:20.030 I occasionally use other Unix variants but um you can't say that certainly about standard software. 04:20.030 --> 04:21.710 Most people just run Windows. 04:21.810 --> 04:24.490 Um and and also I'm not a full time programmer. 04:24.490 --> 04:29.890 So I don't necessarily have access to all the programming tools, Visual Studio and all that kind of stuff. 04:29.970 --> 04:36.970 And uh and also I'm I can I can tinker around with stuff but I'm not necessarily someone that wants to spend all day coding. 04:37.410 --> 04:39.290 But I but I compile tools. 04:39.290 --> 04:41.570 That's certainly uh something that we can all do. 04:41.570 --> 04:52.590 Uh we can debug compilation issues if you've ever had to import something from Linux to Windows under like the Cygwin um APIs or to BSD or something like that. 04:52.590 --> 04:55.130 I'm I'm sure that's something that's pretty typical for people here. 04:55.270 --> 04:58.670 Um and I I like to build little tools and scripts to automate things. 04:58.670 --> 05:00.690 I hate doing busy work you know. 05:00.690 --> 05:03.330 So I I like to be able to do that kind of stuff. 05:03.330 --> 05:13.550 And I also I modify tools that if I download a tool from the internet or from something that someone has posted to a mailing list um I'm gonna take it and start tweaking it if it's not doing exactly what I want. 05:14.490 --> 05:18.590 And I also like to share my tools and modifications with other people. 05:18.590 --> 05:22.310 So if I if I do something I think is cool I post it onto a mailing list. 05:22.670 --> 05:32.310 So anyway I I wanted to just mention that because again I think this kind of fits everyone that's here but it's definitely different than normal software users. 05:32.750 --> 05:41.890 So my motivation here was that uh I use a lot of security tools as I mentioned and and I actually read the licenses which maybe uh not everybody does. 05:41.890 --> 05:44.990 But uh I've actually been quite surprised by some of the stuff I've found. 05:44.990 --> 05:48.370 A lot of tools that I thought were open source really aren't. 05:48.370 --> 05:54.790 And a lot of tools that uh just have some very strange license restrictions that uh that kind of surprised me. 05:54.790 --> 06:00.970 And and over the years I've noticed some trends that you know it seems like more tools are going to more restrictive license. 06:01.290 --> 06:03.870 So I wanted to talk a little bit about that. 06:04.350 --> 06:06.330 So here's a quick example here. 06:06.830 --> 06:10.170 And uh so uh SensePost's WIC2 tool. 06:10.170 --> 06:12.770 It's a it's a Windows version of uh NIC2 kind of. 06:12.770 --> 06:15.790 It it's got some other features actually that it's built onto the NIC2. 06:15.790 --> 06:21.110 Uh it does some recursion and it's also uh connects in with the Google uh APIs and all that. 06:21.110 --> 06:23.570 So anyone here use that tool? 06:23.570 --> 06:24.530 Find it useful? 06:24.850 --> 06:25.270 Yes? 06:25.270 --> 06:25.830 No? 06:25.830 --> 06:26.330 Okay. 06:26.330 --> 06:26.910 Good. 06:26.990 --> 06:28.770 Um are any of the contributors here? 06:28.810 --> 06:30.630 I I definitely know they're here at the conference. 06:30.630 --> 06:32.770 I I sat in on SensePost's talk earlier. 06:32.770 --> 06:34.430 I don't see any of them in the room here. 06:34.430 --> 06:49.110 Well you're you're lucky they're not in the room because uh if you look at the license for WIC2 you'll see that it starts off with the the full GPL license and then it adds this extra restriction that basically if uh you find the software useful you're supposed to buy them a drink. 06:49.770 --> 06:54.630 So I expect you all to go out and find them after the session's over and make sure you live up to that. 06:55.730 --> 06:56.850 Excuse me? 06:58.210 --> 07:01.470 WIC2 it's a web it's a web uh application scanner. 07:01.470 --> 07:02.810 It's a web server scanner. 07:04.270 --> 07:12.070 So and just in case anyone was wondering I I don't think that's enforceable but I'm not a lawyer so you'll have to talk to your legal about that. 07:13.530 --> 07:20.810 Well it certainly is a violation of the GPL in the sense of well it's not a violation of the GPL but it's not the GPL. 07:20.810 --> 07:24.470 You you can't say that something is GPL and then add extra restrictions onto it. 07:24.470 --> 07:26.290 I don't think the real the two really match. 07:26.290 --> 07:31.090 But if you also if you notice the wording there it says you know it's kind of vague in the wording too. 07:31.090 --> 07:33.330 So it's to be honest it's probably a joke. 07:33.330 --> 07:35.530 So I don't think they actually expect anyone to do that. 07:35.530 --> 07:39.070 But it's just one of those little nuggets that you'll see sometimes in reading licenses. 07:40.230 --> 07:53.830 So the uh just a little bit about the scope that the main thing I'm interested in when I'm talking about these licenses is being able to use the tool for what I want to do and perhaps modify the tool and be able to you know send those modifications to other people. 07:53.830 --> 08:00.250 So in particular I'm not trying to take someone else's tool and build my own tool that I want to sell and make a million dollars for. 08:00.750 --> 08:02.950 That's much more difficult as far as licensing. 08:02.950 --> 08:05.570 Obviously GPL restricts that in a lot of ways. 08:06.410 --> 08:09.650 The BSD license or other licenses like that can allow that. 08:09.650 --> 08:12.070 But that's kind of a different issue for me. 08:12.570 --> 08:14.590 So that's what we're going to talk about. 08:14.590 --> 08:17.590 So let's start off with the trends that I've noticed. 08:17.590 --> 08:19.330 And there's quite a few of them here. 08:19.330 --> 08:22.150 But there's two kind of overwhelming ones that we start off with. 08:22.390 --> 08:28.210 And the first one is that there's a lot of great open source tools out there that that are under an OSI certified license. 08:28.230 --> 08:31.770 That would be usually the GPL or a BSD license. 08:31.990 --> 08:33.930 And uh y'all can read the list. 08:33.930 --> 08:36.770 I'm sure you've heard heard and heard about and used a lot of these tools. 08:36.770 --> 08:40.990 You know the Nmap and Ethereal and the Metasploit framework is written in Perl. 08:40.990 --> 08:44.650 Almost all tools that are written in Perl are released under Perl's license. 08:44.650 --> 08:48.390 The artistic license which is uh basically you know it's an open source license. 08:48.390 --> 08:49.470 OSI certified. 08:50.110 --> 08:54.330 Um so I think these people deserve a lot of credit for what they've done. 08:54.330 --> 09:01.710 And everyone who's written open source software contributed to open source software that uh they've done a lot of great service for the community here. 09:01.810 --> 09:08.630 And uh I just wanted to say this up front to make so that when I start talking about all the other tools later that doesn't sound like you know everything's a problem. 09:08.710 --> 09:12.890 Uh there's certainly a lot of great uh truly open source software out there. 09:14.210 --> 09:18.270 And but I do see that uh more security tools are strictly commercial. 09:18.270 --> 09:23.150 And when I say strictly commercial I say that basically if you want to use the tool you've got to pay money. 09:23.510 --> 09:29.910 Um they they may have some sort of free version that allows you to download it and try it out for 30 days or on a certain number of IP addresses or something. 09:30.010 --> 09:34.270 But for the most part it's a uh it's a commercial tool. 09:34.390 --> 09:40.830 And uh and unfortunately those commercial tools restrict many of the things that security tool security tool users want to do. 09:40.950 --> 09:46.230 And uh that's really one of the things we're going to talk about for this session is a lot of those restrictions. 09:46.630 --> 09:49.150 And uh so I guess I'll just kind of throw the question out there. 09:49.150 --> 09:52.670 Is is there a place for commercial security tools? 09:52.670 --> 09:53.850 Do you guys think yes? 09:53.850 --> 09:54.310 No? 09:54.310 --> 09:55.290 Shake your head. 09:56.510 --> 09:58.070 A lot a lot of blank stares. 09:58.070 --> 09:59.370 Well I I I do. 09:59.370 --> 10:03.310 I don't like I said I'm not an open uh free software uh zealot. 10:03.310 --> 10:08.130 I think that there's a place for commercial security tools especially when there's not an open source equivalent. 10:08.190 --> 10:11.970 If if people are willing to pay money for it then then that makes sense. 10:12.050 --> 10:19.550 But um my other question would be should commercial security tools be licensed differently from other software? 10:20.470 --> 10:21.950 Yes or no? 10:22.150 --> 10:23.730 Again more blank stares. 10:23.730 --> 10:25.190 And I I think definitely yes. 10:25.190 --> 10:32.990 I think commercial commercial security tool users are much different than other tool users or other software users. 10:32.990 --> 10:36.770 So I think that the license can allow the kind of things that we want to do. 10:36.770 --> 10:42.510 And some tools do have pretty um pretty uh how do you say less restrictive licenses. 10:42.510 --> 10:46.310 Um IDA pro for example allows you to reverse engineer it. 10:46.430 --> 10:49.230 Which is kind of funny because it's a reverse engineering tool. 10:49.230 --> 10:54.890 But I guess they kind of saw that that was kind of a of something that a lot of commercial software doesn't allow you to do. 10:54.890 --> 11:02.770 And uh and also if you look at uh some of the vulnerability uh penetration testing tools like uh core impact or canvas. 11:02.770 --> 11:07.750 That those are commercial software that you have to pay for but they come with all the source code. 11:07.750 --> 11:10.650 So you can go ahead and modify the tool if you want to. 11:10.650 --> 11:14.550 Which is a which is a nice thing and it's certainly something that security tool users want to do. 11:16.010 --> 11:22.870 And uh the other kind of overarching uh theme that I've seen is that a lot of tools are released with what I call a custom license. 11:22.870 --> 11:27.030 Which is basically somewhere between commercial and open source. 11:27.030 --> 11:30.290 So there's a it permits some uses without cost. 11:30.290 --> 11:36.930 Usually it means that if it's uh you know for personal use or for non-commercial use it'll say you can use it. 11:37.390 --> 11:41.850 Um but it it usually requires either payment or something like that for something else. 11:41.850 --> 11:45.930 And it restricts some of the other things that we want to do uh that we'll get into later. 11:46.350 --> 11:52.570 And that's really what I'll talk about for the rest of this session is is those restrictions and uh and tools that have them. 11:53.010 --> 12:02.070 And and just as kind of an aside many of these tools that are kind of somewhere between open source and commercial are released by companies and not individuals. 12:02.070 --> 12:12.710 And that's because um the companies have have put money into developing this tool and they want to use it either they're gonna sell it to people or they want people to know that it came from them. 12:12.710 --> 12:16.930 That they don't want other people releasing uh modified versions of the tool and that sort of thing. 12:17.050 --> 12:17.790 Yes? 12:19.450 --> 12:21.010 A bait and lure? 12:21.390 --> 12:23.350 Um how how do you mean that? 12:28.340 --> 12:38.920 Oh certainly uh some some tools are like that uh uh like uh they'll have a uh a more restricted version that uh maybe only works for up to a certain number of IP addresses or whatever. 12:38.920 --> 12:47.500 And even even if you look at something like Nessus which I'll get into more a little later um Nessus is a great vulnerability scanner but it doesn't necessarily scale real well. 12:47.500 --> 13:00.220 And one of the things that Tenable the company that uh that is pretty much in charge of Nessus now that they uh they have some like web interfaces and other consoles that they'll sell you that uh allow you to manage uh Nessus scanners. 13:00.280 --> 13:15.880 So yeah certainly it is part of it that it's it's really marketing is what it comes down to to a large extent that a lot of these companies the consulting type companies you know they release free tools because they want to draw people to their website and uh and be able to then sell them consulting services and software and all that sort of stuff. 13:18.280 --> 13:27.020 Okay so now let's get a little bit more into the specifics uh and and the first one is just basically that that you sometimes you have to pay to use these tools. 13:27.200 --> 13:34.740 And uh and usually these are tools like I said that can be used for free in some situations and then uh in other situations you've got to pay. 13:35.200 --> 13:48.620 And uh sometimes they the license will say that the tool is for like personal use or non commercial use but there's it doesn't say anything about if you want to use it commercially how to buy it or how much it costs and there's no information on their website or anything. 13:48.620 --> 14:00.700 And that is very confusing for users that it kind of to me it's like if you're gonna charge if you want to charge money or you don't want people to use your software for commercial use you should make it easy for them to stay within the law. 14:00.700 --> 14:03.880 You should make it easy for them to buy the software if they want to buy it. 14:03.940 --> 14:05.880 And uh so that's kind of confusing. 14:06.120 --> 14:10.560 And also uh here's some examples of that and uh you can read through those. 14:10.560 --> 14:15.980 Um THC's are you there and is a is a tool that requires uh permission. 14:15.980 --> 14:18.820 It doesn't you you don't have to pay for it but it does require permission. 14:18.820 --> 14:30.020 And I lump payment and permission together because I kind of think that if you require permission for people to use it for commercial use then you're kind of leading up to maybe you're gonna start charging for it later. 14:30.280 --> 14:34.040 And uh and it really comes down to the same the same issues. 14:34.220 --> 14:40.040 Um Foundstone's free tools are that way that they their license says it's for personal and non-commercial use. 14:40.340 --> 14:43.700 Um but it doesn't say anything about how to purchase it for commercial use. 14:43.760 --> 14:54.880 Um the registered plugins for Nessus and also the VRT certified rules for Snort are uh are that way as well that you you need to register in order to be able to download these. 14:54.920 --> 15:04.580 Uh both of them use very similar business models in that they uh um the rules will be about 5 days out of date um if you're gonna use the uh free of cost version. 15:05.060 --> 15:10.220 Um and then if you wanna pay you know I think it's for Nessus it's like uh $1200 a year. 15:10.220 --> 15:17.240 I don't know for Snort how much it costs to buy the uh immediate download so that you know as soon as a new rule comes out you can get it. 15:17.500 --> 15:25.600 Um and then another tool is HTTP print which uh is just a little neat little web uh server fingerprinting tool. 15:26.220 --> 15:29.700 So anyway any questions there? 15:29.700 --> 15:37.120 Any other thoughts as far as other tools that are kinda in this vein or um people think this is a big problem or not? 15:37.120 --> 15:37.920 I don't know. 15:38.640 --> 15:39.960 Yeah go ahead. 16:09.220 --> 16:25.960 Yeah the just for people who didn't hear that basically the idea I think what you're saying is that uh basically violating the license of these tools that if it says it's only for non commercial use and you use it commercially that's the same as you know downloading you know Windows from the internet you know on BitTorrent or whatever. 16:25.960 --> 16:29.660 It's it's it's piracy and the BSA can come after you for it. 16:37.050 --> 16:46.170 Right exactly and that and that kinda illustrates why I put this whole thing together is that you know in my job I was downloading a lot of tools and I wanted to make sure that we were following the license. 16:46.170 --> 16:55.450 I didn't want to get my employer or our our customers in trouble so um yeah it's definitely one of those things that you need to be paying attention to the licenses of the tools that you're using. 16:57.790 --> 17:08.150 Okay uh another another feature that I've seen in a lot of licenses is that more more of them are restricting redistribution and uh basically that means that you can only get the tool from the author. 17:08.150 --> 17:10.770 That you know you can only download the tool from their website. 17:10.870 --> 17:13.910 Which is fine I guess until the the author disappears. 17:13.910 --> 17:30.610 You know if it's a company and it you know goes bankrupt or if the author unfortunately dies or decides he doesn't want to deal with it anymore it it makes it difficult that you know maybe a friend of yours has a copy of the tool but then you you the license says you can't redistribute it so it's one of those things that's uh it's it's kind of a gray area. 17:30.610 --> 17:39.710 It'd be it'd be nice if people would put in their license that you know if you're gonna restrict redistribution you know allow it if the case is that uh people can't find it from you anymore. 17:40.010 --> 17:43.130 And just some examples of those as far as tools that you might have used. 17:43.130 --> 17:49.250 Uh the Sysinternals tools are uh a lot of like little windows tools that uh will show you processes that are running in that. 17:49.250 --> 17:51.010 People use them in incident response. 17:51.010 --> 17:53.950 Um Net Stumbler actually restricts redistribution. 17:54.150 --> 17:59.470 Um and then again the Foundstone tools uh and Nessus and Snart plugins. 18:00.490 --> 18:09.850 So that's the next uh next thing that I've seen a lot of is uh tools that restrict or prohibit uh modification and reverse engineering. 18:10.050 --> 18:17.210 And uh that's really it's it's a problem because this is it it prevents us from being able to fix the tool. 18:17.210 --> 18:23.090 That you know even especially if the tools like uh Nessus the Nessus plugins restrict uh modification. 18:23.610 --> 18:25.850 But it's it's just a script. 18:25.850 --> 18:27.570 You know you've got the source code right there. 18:27.570 --> 18:31.890 You could easily go in there and fix things if you wanted to but the license doesn't allow you to. 18:32.270 --> 18:35.050 And uh and that's some other examples of that. 18:35.050 --> 18:39.110 Uh Kane Enable and also the Foundstone tools again and and Net Stumbler. 18:39.210 --> 18:46.890 Um this is like you can see mostly an issue with uh with Windows tools that you know if you don't have the source code it makes it difficult. 18:47.070 --> 18:50.070 But some of them like I said Nessus uh it is still an issue. 18:51.230 --> 18:55.370 And that's kind of the next issue is that a lot of tools don't come with the source code. 18:55.370 --> 18:59.030 So if you don't have the source code it makes it very difficult to make any changes. 18:59.270 --> 19:04.470 And uh well it's so strictly it's not a license issue in the sense of it's not in the license. 19:04.470 --> 19:10.310 But usually these tools that don't come with source code also have a license that restrict redistribute or restrict modification. 19:10.310 --> 19:12.210 So it's pretty much the same issue again. 19:12.550 --> 19:17.590 And and without the source code it's it's very difficult to make modifications to the tool and improve the tool. 19:17.590 --> 19:18.790 Try to fix them ourselves. 19:18.850 --> 19:27.050 You know a lot of times if you're using a tool on a client site and and something's being buggy or you're seeing that the output is weird and you want to be able to try to fix it. 19:27.050 --> 19:30.290 You know you can't do that if you don't have the source code. 19:31.150 --> 19:34.690 And uh and also the source code is valuable just for learning purposes. 19:34.690 --> 19:46.510 That if you want to learn how this tool is working and how you know what kind of protocols it's using especially if it's some sort of a like a vulnerability scanner or a a pen testing tool you want to know well what you know how is it connecting to the remote system? 19:46.510 --> 19:48.690 What exactly responses are we getting back? 19:48.690 --> 19:51.630 Maybe try to weed out some false positives and that sort of thing. 19:51.630 --> 19:56.270 Well that's that's very difficult if you don't have the source code to know you know what the thing is uh is doing. 19:56.530 --> 20:00.570 And and obviously source code is also necessary if you want to port it to another platform. 20:00.570 --> 20:12.190 So if you've got a a Windows tool that's running a you know standard C++ compiled program then well you've gotta want to port that over to Linux and that's not really not possible without the source code. 20:12.430 --> 20:23.350 And uh even even in some supposedly portable languages like Java and dot net um there you'll a lot of times run into little issues between platforms that you need the source code in order to kind of convert things. 20:23.350 --> 20:35.470 Especially if the original programmer didn't consider porting that you know maybe they're using some Windows specific APIs that aren't available in the dot net framework for uh for Linux and uh OS 10 and that sort of thing. 20:36.510 --> 20:40.830 And again this is mostly Windows tools although occasionally you'll see it on other tools. 20:40.890 --> 20:44.790 Um I don't use Macs but probably Mac tools uh have some of that as well. 20:45.590 --> 20:52.330 And here's a bunch of examples um and some of them some of them I'm not sure if it was intentional that they didn't include the source code. 20:52.330 --> 21:00.310 Some of them you may be able to email the author and get it from them um but these are just the ones that I saw that weren't you know readily available on their website. 21:00.510 --> 21:05.910 And uh some of the new ones here you know Achilles well Achilles is an old tool but we haven't talked about it yet. 21:05.910 --> 21:09.510 Um Brutus, uh Sam Spade and uh Odysseus. 21:09.510 --> 21:13.610 Um Achilles and Odysseus are web uh proxies. 21:17.080 --> 21:24.380 And there's actually a couple tools uh fortunately only two so far that require uh credit in the consulting reports. 21:24.380 --> 21:32.740 So if you use THC AMAP or THC Hydra as part of a penetration test or other sort of commercial uh consulting you know assessment that you're doing. 21:32.920 --> 21:38.680 There's actually a a clause in the license that you have to give them credit in the consulting report. 21:39.260 --> 21:42.540 Um I don't know how many people actually do that or not. 21:42.540 --> 22:01.220 I don't know if uh I'm I'm I'm glad like I said that only a couple tools are doing this so far because if it becomes real common it could be real troublesome to try to remember well which tools did I use in this consulting and you know trying to get all the credits in there and making sure the customer doesn't get kind of confused as to why you've got all this stuff in your report. 22:02.640 --> 22:04.780 So is that new to anybody? 22:04.780 --> 22:08.000 I mean is do any anybody use that tool that didn't know about that? 22:08.960 --> 22:10.840 No one wants to admit it anyway. 22:12.300 --> 22:24.560 Okay well another another issue I've run into is that sometimes tools have a lot of these restrictions in their license but then they kind of will tell you in mailing lists or or other places that well don't worry about it you know. 22:24.560 --> 22:26.540 We really didn't mean that I guess. 22:26.900 --> 22:29.440 Um and that's a little bit confusing. 22:29.440 --> 22:34.220 So sometimes uh in these couple examples the website is different from what comes with the tool. 22:34.220 --> 22:41.520 So you download the tool and inside the tarball or inside the zip file is a license that's different than what you see on the website when you download the tool. 22:42.080 --> 22:45.200 Um one example is you know THC Hydra and AMAP. 22:45.200 --> 22:52.700 The license is only slightly different but there's a little difference in the I think it's actually in the clause that I just showed you that the the credit is different. 22:52.700 --> 23:02.240 That I think one of the licenses it says you have to include the tool name, version, and authors and in the other one it says you only have to include the name and the version or something like that. 23:03.580 --> 23:10.060 And uh another more significant one is uh Foundstone recently released a tool called uh WS Digger. 23:10.060 --> 23:14.520 I believe it's a web services scanning tool um but don't quote me on that. 23:14.600 --> 23:19.780 Um the license on the website is the standard Foundstone license which we've been talking about which is very restrictive. 23:19.780 --> 23:21.420 You know personal and non-commercial use only. 23:21.420 --> 23:22.360 No reverse engineering. 23:22.360 --> 23:23.280 All that other stuff. 23:23.280 --> 23:32.420 But when you download the tool inside the tool distribution is the Apache 2.0 license which is an open source license which allows you to do all those things that we want to do. 23:32.440 --> 23:35.060 So which license are you supposed to follow? 23:35.300 --> 23:36.220 I don't know. 23:36.220 --> 23:43.720 But from what I've seen on the when they announce the tool that it's meant to be under the Apache license there's just uh some sort of miscommunication on their website. 23:45.140 --> 23:53.000 Um another example is that uh sometimes the author like I said on a mailing list or something will will contradict the tool's license. 23:53.000 --> 24:04.940 So when you have a a Foundstone's Hack Me Bank and their Hack Me Books tools um are great great tools to learn about uh web web applications and do some pen testing against them in a lab environment and all that. 24:05.180 --> 24:08.820 And but again the license says that they're personal and non-commercial use. 24:08.820 --> 24:16.680 So I emailed them because I wanted to set it up on our internal network at my company and uh they said oh yeah no problem to use it on an internal lab. 24:16.680 --> 24:25.020 You know that they they didn't want other people going out and you know teaching classes which is part of you know how they make money using these tools because they put a lot of work into them. 24:25.020 --> 24:28.320 But they don't mind you using them you know at work personally. 24:28.660 --> 24:37.460 And that that's something we'll uh another issue that I've seen is that you know a lot of times people say personal use or non-commercial use but they don't define that. 24:37.720 --> 24:40.420 And and different different companies have different definitions. 24:40.780 --> 24:48.580 Um I know it's not a security tool but uh Google Toolbar um it defines personal use as if you download it yourself it's okay. 24:48.580 --> 24:56.300 So I can use Google Toolbar at work as long as I install it myself but my system administrator can't install it on every single machine. 24:56.900 --> 25:04.680 Um I don't know it's just it's one of those things that it's different companies have different definitions so if you're not defining it then it's hard to hard to enforce it. 25:05.420 --> 25:11.300 And then another example is the the the ton of the uh the registered plugins for Nessus. 25:11.300 --> 25:12.300 Yes go ahead. 25:43.340 --> 25:44.300 Right. 25:44.540 --> 25:47.380 Right yeah that's a that's a good point for if you guys didn't hear. 25:47.380 --> 25:54.560 He basically said that if like the Foundstone tools that they were written by people at Foundstone but Foundstone owns the copyright. 25:54.560 --> 25:57.860 They're the copyright holder for those tools so they decide the license. 25:58.060 --> 26:04.540 And the authors of those tools don't necessarily have the authority from their employer to waive that license or change the license. 26:04.540 --> 26:06.480 So you need to be aware of that. 26:06.540 --> 26:10.840 Um as far as who who actually owns the tool and are you actually getting permission from the right people. 26:11.880 --> 26:22.780 Um the registered plugins for Nessus is another tool that's uh a little strange because the license is very restrictive it doesn't allow you to change the plugins or um reverse engineer the plugins. 26:22.780 --> 26:27.340 Which is a bit a bit strange because uh there's some problems with their plugins. 26:27.340 --> 26:32.040 You know they they always have problems with false positives or typos and descriptions and that. 26:32.040 --> 26:35.060 And nothing bad it's just they've got six thousand of the things. 26:35.080 --> 26:37.860 So there's inevitably there's going to be problems that show up. 26:37.860 --> 26:44.380 And they've also they frequently have problems with versions of of uh of services that they're scanning. 26:44.380 --> 26:49.920 That you know that when a new version comes out they're going to give you back uh something strange that it's not expecting. 26:50.040 --> 26:55.020 So anyway the the license prevents you from making those changes yourself or distributing them. 26:55.240 --> 27:09.020 Uh but on the mailing lists the the owner of Tenables which I think is authorized to make this statement said oh yeah no problem you know you can you can make changes to the plugins and you can post it back to the the Nessus mailing list so that other people can see them. 27:09.480 --> 27:12.900 So that's another one of those things where it's like well who do you really follow? 27:12.900 --> 27:23.020 I mean I would guess that you know if if they've said that publicly and and I know people have done that and no one's gotten sued so it's probably okay but it's just a little confusing for the users that they really should straighten that out. 27:24.240 --> 27:43.300 And the other really big issue that I've seen is a lot of tools just don't have a license that they are you know you just can't find it and and maybe the the it's uh I don't know there there may be you know some of these there that I'm going to mention maybe the tools and maybe the license is in the tool distribution it's just hard to find. 27:43.300 --> 28:07.040 I have seen ones where the binary that gets compiled or is distributed doesn't have any license at all associated with it but if you look at like the comments in the uh source code files it'll say you know this tool is under the GPL or this tool is under whatever license um which is really not sufficient you're supposed to include the the full GPL in there rather than just saying uh it's supposed to be G excuse me it's supposed to be under the GPL. 28:07.740 --> 28:21.940 Uh and and sometimes the tool's just not present at all you know you just can't find it and uh and this is also a big problem if you can't figure out who the author was if you know the maybe you've got an email address that doesn't work anymore or something like that so then it's kind of like who knows. 28:22.480 --> 28:41.060 And then the other thing is that a lot of times there if there is a license it might be there but it's pretty incomplete that it just basically says something real simple like oh use it for whatever you want or something like that well that isn't really a full license in the sense of it doesn't talk about all the different things that we want to be able to do with tools and give us permission for it. 28:41.300 --> 28:49.220 Again I'm not a lawyer but my understanding of copyright law is that pretty much if the license doesn't say you can do it then you're not supposed to do it. 28:51.580 --> 29:09.920 And and a lot of times this is uh this is a problem with small exploits and scripts and stuff that are posted to uh I call them online forums here just to include everything but mailing lists news groups you know if you look at uh full disclosure or bug track mailing lists hardly any of the exploits that are posted there have any sort of license associated with them. 29:10.240 --> 29:25.680 And uh again it'd be it'd be nice if uh if we could say well if you post something in a in a forum like that and don't include a license it's uh it was meant to be you know in the public domain or something like that but I don't think that's the way the law works but again I'm not a lawyer. 29:26.180 --> 29:33.140 Um here's just some examples here um a bind view's a noom tool I wasn't able to find a license for it. 29:33.720 --> 29:37.760 Um hobbit's original netcat uh there was no license associated with that. 29:37.760 --> 29:50.440 Uh john the ripper um I I think what happened was solar designer the guy who wrote the tool um incorporated some other code that he wasn't sure about the license into the tool so that's why there's no license cause he he doesn't even know what the license is. 29:50.880 --> 30:03.080 But um he has said that the next version 1.7 is going to be released under the GPL um but I have no idea when that's going to happen I mean 1.6 has been out forever so I don't I don't know when that's going to happen. 30:03.240 --> 30:09.820 Um and some other tools that I saw on sequel security dot com has a lot of sequel tools that uh I didn't see any license for. 30:10.540 --> 30:12.960 And some other ones that we've already talked about. 30:15.620 --> 30:18.460 So okay where where are we at in time? 30:18.460 --> 30:20.180 Okay we're we're in good shape. 30:20.280 --> 30:22.960 So do you guys agree that this exists? 30:22.960 --> 30:28.280 You know I've talked a lot about you know I think more tools are going to this kind of um more restrictive licenses. 30:28.280 --> 30:29.360 Do you guys agree? 30:29.440 --> 30:30.320 Disagree? 30:30.480 --> 30:32.760 Um what's what's your thoughts? 30:37.540 --> 30:38.740 Yeah go ahead. 30:49.870 --> 31:06.370 Right the the comment was that a lot of tools seem to be uh that they're it's almost like the bait bait and uh bait and hook method that someone else mentioned that they they have like free tools to kind of hook you in and then they uh try to get you to to pay for uh other tools or a more expanded version or something like that. 31:06.370 --> 31:13.890 And definitely that's that's been the case in software for a long time but in security tools it's I think it's more of a recent trend you know. 31:14.630 --> 31:15.730 Yes go ahead. 31:52.340 --> 31:52.880 Yeah. 32:04.820 --> 32:07.220 Yes I I think that's definitely true. 32:07.220 --> 32:17.240 Um just to repeat for people who may not have heard is that the authors of the tools a lot of times will will will either clarify the license if it's not there or they'll give you the source code. 32:17.280 --> 32:22.300 They're you know usually if you can get a hold of them they're they're pretty nice about it and they like to hear that people are using the tools. 32:22.300 --> 32:31.600 And definitely that's that's one of my recommendations uh that we'll get to later on is you know yeah work work with those people to see what the uh what the license is if it's not uh if it's not clear. 32:31.980 --> 32:34.220 But uh yeah I I agree. 32:35.080 --> 32:36.140 Yeah go ahead. 32:44.110 --> 32:45.870 I I am not a lawyer. 32:45.870 --> 32:46.790 I don't know. 32:47.310 --> 32:59.670 I I would say no just off hand that you know again if someone posts something to full disclosure or bug track with no license attached I'm assuming he means people can use it for something at least. 32:59.850 --> 33:01.670 But I don't know. 33:05.960 --> 33:07.180 I don't know. 33:07.280 --> 33:09.760 And that well that's actually something we'll get into in a little bit. 33:09.760 --> 33:11.260 But what what's your thoughts? 33:51.180 --> 33:52.980 Yeah that's that's a good point. 33:52.980 --> 34:08.040 Just real quick summary was that you know that there there may be an implied license there that if someone has released a tool where anyone in the world can get to it either on a mailing list or a website that you could make the argument that they intended for people to be able to use it for for things. 34:08.080 --> 34:12.420 Again talk to your lawyer and it made it probably depends a lot on what country you're in. 34:23.810 --> 34:36.610 Again I'm not a lawyer but my my understanding is that a license is similar to a contract and just because you and I sign a contract doesn't necessarily mean that everything is enforceable. 34:37.610 --> 34:44.610 And I don't know all the exact caveats but I know for instance I can't sign a contract saying that I'll be your slave for the rest of my life. 34:44.610 --> 34:47.030 That that is not a legally enforceable contract. 34:47.310 --> 34:49.810 So anyway. 34:50.250 --> 34:52.710 Um let me move on to another question. 34:52.710 --> 34:57.750 So and I think we kind of covered this but I'll ask it more specifically is is there a problem with this? 34:57.750 --> 35:04.750 And we have certainly identified a problem of you know if stuff doesn't have a license and it's kind of in in limbo that it'd be good to have some clarification there . 35:04.750 --> 35:19.130 But um with reference to the other trends that we've seen as far as more more tools requiring uh payments and uh permission for uses and all that is it does that is that a problem for the security security community? 35:20.110 --> 35:20.850 Yes? 35:20.850 --> 35:21.710 No? 35:24.500 --> 35:26.140 Yeah go ahead. 36:01.580 --> 36:23.020 Yeah that's that's a good point and uh but quickly a summary of it was that uh yeah that some some tools out there even security tools that are restricting reverse engineering and cryptanalysis of them that really causes a problem for us that want to be able to evaluate these tools and decide are they good or bad uh to deploy into our companies or to recommend to our customers and and that sort of thing. 36:23.020 --> 36:24.920 So that that certainly is a problem. 36:26.880 --> 36:32.960 Okay uh next question was uh well what what can we do to improve security tool licensing? 36:33.620 --> 36:38.740 I've got my own thoughts that uh that I'll talk about in a little bit but I just want to hear what you guys have to say. 36:39.240 --> 36:40.600 Anyone got any suggestions? 36:40.600 --> 36:41.400 Yeah go ahead. 36:44.040 --> 36:45.540 Make a new license. 36:47.380 --> 36:59.320 Yeah well and and that was that's that's definitely one of my points uh that I'll talk about later is that yeah if you it would be great if people want an open source product make it an OSI approved license. 36:59.320 --> 37:04.620 Don't make up your own license because it'll run into a lot of these problems and it makes it confusing for the users. 37:04.640 --> 37:20.740 That yeah it's it's hard especially because of the nature of security tool work that we end up using a lot of little tools to do our work and it's very it's it's a pain to be able to try to keep track of the licenses of all these tools and make sure that we're not you know doing something that we're not supposed to be doing. 37:22.080 --> 37:24.240 Any other suggestions before uh mine? 37:24.240 --> 37:25.020 Yeah go ahead. 37:53.460 --> 37:55.940 Yes that's that's definitely a good point. 37:55.960 --> 38:09.420 Uh the the point was that if you're buying a security product or even if you're using it for free it it but mostly if you're buying it is you know talk to the authors or whoever tried to sell this to you and and tell them you don't like the license. 38:09.420 --> 38:10.820 Tell them that you want a different license. 38:10.880 --> 38:25.700 Especially for as much money as we pay for a lot of security products that uh it's amazing that the the kind of restrictions that they want to put on what we can do and the fact that people just accept them you know and just kind of treat it like any other piece of software that they're gonna well we just gotta live with it. 38:25.700 --> 38:42.180 Well no you don't have to live with it especially a lot of these smaller companies that are selling these things that you know they they want your business and they're willing to make concessions and especially if they um can understand that what they're trying to restrict is really not um it's it's it's restricting what we want to do with the tools. 38:42.400 --> 38:46.860 And and it really comes down to I think don't treat your users like criminals you know. 38:46.860 --> 38:55.180 If you're you're not giving them source code and you're preventing them from reverse engineering the tool well you're you're kind of assuming that oh they want to do something bad to us. 38:55.180 --> 39:01.700 Well no we just want to be able to use the tool is what it comes down to and being able to use it in the most efficient way that we know how. 39:02.980 --> 39:04.980 Okay I got ten minutes left. 39:05.520 --> 39:08.180 Okay any any other suggestions? 39:10.220 --> 39:18.160 Okay I'll I'll run through what I have on here and it's it's really just kind of my own you know thoughts feel free to disagree or or uh what not. 39:18.760 --> 39:21.960 Um few few issues for uh tool users. 39:22.640 --> 39:28.280 Well obviously read and follow the licenses you know you you can't just ignore ignore the issue. 39:28.460 --> 39:36.140 And if you don't like the if you don't like the license don't use the tool or at least go back to the author and say hey can we get this changed. 39:36.300 --> 39:39.700 But don't just ignore it and kind of go on and do whatever you want. 39:39.700 --> 39:51.340 And I'd also say uh I call it legal trickery but just be don't use the uh don't follow the letter of the license while violating the spirit of the license. 39:51.340 --> 39:57.840 And and a lot of that comes down to to uh you know how you define you know commercial use and that kind of thing. 39:57.940 --> 40:01.780 You know if if you don't don't get into that it would be my recommendation. 40:03.200 --> 40:17.460 And uh again work with the writer the tool writers to clarify if there's a problem and and the key there is politely because tool tool writers uh have a lot of times you know especially if they're writing it on their own you know they're they're not getting paid to do it. 40:17.460 --> 40:26.500 They have a lot of people emailing them with bugs and stuff like that and you know you don't want to make demands of them but just talk to them and usually they'll be pretty uh accommodating. 40:27.300 --> 40:33.860 And and also encourage them to remove the license restrictions which is uh good for everybody. 40:33.860 --> 40:47.080 And and also if you if you make changes to a tool um whether it be an open source tool or any other tool you know share the changes you know allow all of us to work together on these things so that everyone's not out you know reproducing the same you know events. 40:48.780 --> 40:55.680 Okay well tool writers well you just obviously you need to follow the license for any software that you're incorporating into your tool. 40:55.720 --> 41:02.720 Um in particular you know if you've got like GPL software or something you can't just cut cut and paste that into a commercial product. 41:02.920 --> 41:06.240 Um choose choose a license and include it with every tool. 41:06.520 --> 41:08.500 That's uh kind of self explanatory. 41:08.500 --> 41:13.060 And and remember you know if the copyright holder can add another license at any time. 41:13.060 --> 41:18.680 So just because I released a tool under the GPL today doesn't mean that every version of that tool is always going to be GPL. 41:18.680 --> 41:22.600 I can release the next version of it under a completely different license. 41:23.060 --> 41:25.980 That's that's not a problem because I own I own the work. 41:26.540 --> 41:34.040 And if your employer holds the copyright then encourage them to use a less restrictive license or just a standard open source license. 41:34.040 --> 41:49.540 That that can go a long way to just you know telling your boss you know hey this is what we want to what users are going to want to be able to do with this tool and we think it'll be helpful in the long run because especially if the company is trying to release the tool as you know marketing and and being able to draw people to their site. 41:49.700 --> 41:52.760 Well more people that use the tool the better it is for them. 41:55.020 --> 42:02.580 Um just a quick a quick note of don't make a don't make a some complicated restrictive license for a pretty simple tool. 42:02.580 --> 42:08.680 You know if it's if it's a simple tool just release it under you know a BSD license or or GPL or something real simple. 42:08.880 --> 42:14.120 And and also say say what you mean and mean what you say when you're uh licensing the tool. 42:14.400 --> 42:19.560 Don't don't do this kind of well the license says you can't do it but then I'm going to email people and say that they can. 42:20.880 --> 42:25.080 And and again if you if you want it to be open source just use an OSI standard license. 42:25.080 --> 42:26.280 Don't make up your own. 42:28.140 --> 42:33.800 And it if you're going to require payments well obviously you need to make the cost reasonable or people aren't going to buy it. 42:33.800 --> 42:35.760 Make it make it easy for the people to buy the tool. 42:35.760 --> 42:37.160 That they can find it on your website. 42:37.160 --> 42:41.980 That you've got a link that you people can go to a secure form put in their credit card information and download the tool. 42:42.100 --> 42:47.780 You know you're you're going to get more people buying it that way than if they've got to email you and and try to figure out what's going on. 42:48.460 --> 42:49.860 And that's pretty much what's there. 42:49.860 --> 42:53.480 And and obviously you know make sure you tell people you know what what upgrades are going to be included. 42:53.480 --> 42:55.020 What support and all that. 42:55.100 --> 42:59.960 And and that's just kind of also a disclaimer that you know that's what users are going to expect. 42:59.960 --> 43:03.040 If they're paying for a tool they're going to expect some upgrades and support. 43:03.280 --> 43:15.520 And also consider bundling perhaps the tool with other tools or other authors because um sometimes people will release a you know little small tool that's kind of useful and they'll say oh it's you know five dollars or something. 43:15.520 --> 43:26.680 Well five dollars is nothing as far as payment but it's a huge pain in the butt for people that work at a large company or work in the government because there's a lot of paperwork that goes into buying tools or buying anything. 43:26.940 --> 43:33.300 So if if you're going to make it one of those kind of real cheap tools then maybe bundle it with some other stuff so that people can buy it more easily. 43:33.700 --> 43:39.700 And then if you're going to require payment you know make sure you define what you mean by you know non-commercial use or whatever. 43:40.040 --> 43:49.400 And there's all sorts of things to consider you know there's development and testing and internal use and consulting use and educational institutions, government entities, all this stuff. 43:49.400 --> 43:53.180 So you need to make sure you clarify what you mean by all those terms. 43:54.940 --> 44:00.280 And and again I recommend you know don't don't disallow you know redistribution entirely. 44:00.440 --> 44:05.760 Um it's nice to you know allow users to email it to their friends or other people they think might be users. 44:05.940 --> 44:12.720 And uh you know if in the case that the website is is gone forever then you know let people redistribute it more widely. 44:14.440 --> 44:19.340 And and again a lot make the source code available regardless of whether it's a commercial product or not. 44:19.340 --> 44:25.440 You know give give people the users the source code and allow them to make modifications for internal use at least. 44:25.620 --> 44:28.280 And uh just so they can you know fix things. 44:28.400 --> 44:32.280 Um allow users to distribute the modifications to one another. 44:32.280 --> 44:40.360 That you know if you've got if it's a commercial tool maybe you should set up an internal type mailing list just for tool users and that they can uh email stuff to each other. 44:41.500 --> 44:45.100 And and if you're gonna distribute the source code obviously make sure it's complete. 44:45.100 --> 44:48.280 You've got all the build files and libraries and stuff like that. 44:48.280 --> 44:53.320 And just give a quick how to of you know hey this is a Visual Studio project this is how to compile it. 44:54.940 --> 44:58.140 And again make the tool the license clear. 44:58.140 --> 44:59.300 Post it on the website. 44:59.300 --> 45:04.860 It a lot of tools that I noticed that you you couldn't find figure out what the license was until after you've already downloaded the thing. 45:04.860 --> 45:10.740 Well if it's a if it's a several megabyte file then it's kind of a waste of time to have to download it just to figure out what the license is. 45:11.200 --> 45:22.800 And you know if you're if you're gonna release a news item or post something on a mailing list about the new tool that's available just include a quick summary of you know it's a GPL or it's uh you know free for non-commercial use or whatever. 45:22.900 --> 45:27.140 You know include the the copying or license file or something like that in the distribution. 45:27.540 --> 45:30.700 Um and then the online help again put a little summary there. 45:30.700 --> 45:42.800 And if you're gonna go to a conference like Def Con or Black Hat or whatever you know tell people when you're presenting and um that's important so that people don't get all excited about something and then figure out that it's well it's under some strange license. 45:42.980 --> 45:53.660 And and just for the record Black Hat and Def Con are actually really good about that that I don't think you're allowed to present tools at at these conferences without a it being free for at least the conference attendees. 45:53.820 --> 45:56.980 But not all um conferences are like that. 45:57.660 --> 46:13.260 And that's just kind of just here I'll go through this real quick is you know make sure that if you're running a conference you make sure that people know what the licenses are at least and and consider making it like like Def Con and Black Hat that if you're gonna present a tool it has to be free for at least the attendees. 46:14.680 --> 46:35.980 And then uh the the big one that I think uh we were talking about earlier is that if the people that run online forums that's mailing lists or news groups or whatever you know again I'm not a lawyer but I would think that you could you know come up with like a default license that you know if if stuff is posted to this mailing list without any other license attached it's gonna fall under this license. 46:36.240 --> 46:39.660 And I'd recommend making that you know the BSD license or an MIT license. 46:39.660 --> 46:44.360 So something that basically says you can use it for whatever you want don't sue me if it breaks something. 46:45.340 --> 47:03.340 And uh and if if people are gonna patch or post patches to existing tools then it probably makes sense to dual license those under the forums license and also the existing tools license because if that way if the person who wrote the original tool uh wants to incorporate that into their tool then they can do that with no problem. 47:04.800 --> 47:16.940 And and also you want to decide you know are you gonna let people post things under some different license um in particular if people are making up their own license that doesn't allow redistribution then mailing lists archives and stuff get screwed up. 47:17.220 --> 47:27.580 And then just you know make it clear to members when they join the mailing list or uh on the website or for the web forum or whatever or in an FAQ that that uh that's what the license is. 47:28.740 --> 47:31.920 So that's all I have yes go ahead. 48:04.890 --> 48:24.770 Okay yeah I I understand what you're saying there I guess uh the the his second point was that some tools especially very expensive tools they don't want to post the price on their website because you can't just download it you know you need to talk to them you need to negotiate a contract there's usually support that involves but you know that's for tools that are in the thousands of dollars. 48:24.810 --> 48:28.850 I'm thinking about tools that are you know in the you know tens or hundreds of dollars. 48:30.730 --> 48:42.390 Well again it's like you know you you you gotta define what you mean by that and all that but yeah you know there's a lot of you know especially a lot of the security tools that we use you know little command line things that that shouldn't cost a lot of money. 48:42.750 --> 48:46.090 Um and what was your first point you said something about cross posting? 48:51.420 --> 48:55.040 Um yeah how how do you determine who the original author is? 48:55.440 --> 49:21.040 Uh yeah that that's definitely a problem that if if stuff has been posted especially if it's gone through like an anonymous remailer or something like that or an email account that doesn't work anymore yeah sometimes you you can't even figure out who the original author was so I don't know how to fix that but I'm hoping that you know maybe we can get some forward some forward uh thinking into this that in the future this won't be a problem if there is some sort of default license that things will fall under. 49:21.220 --> 49:25.620 But again I'm I'm assuming that can be done I'm again I'm not a lawyer so I don't know. 49:26.320 --> 49:27.860 Any other comments or questions? 49:27.860 --> 49:29.020 We got a couple. 49:29.180 --> 49:29.860 We're done. 49:29.860 --> 49:30.360 Okay. 49:30.400 --> 49:31.360 Okay well thanks. 49:31.360 --> 49:33.100 If anyone else has any comments see me?