5/28/2026 at 7:55:58 PM
> Hang on.. proof of concept exploit creation and distribution for zero days is “criminal activity” now?Publicly publishing an exploit is so obviously First Amendment-protected activity that it’s almost tempting to want a test case.
by JumpCrisscross
5/28/2026 at 9:50:30 PM
It's also quite the blame gymnastics. The code that enables the bad actors was written, published, and distributed at massive scale by Microsoft. The "crime" they are accusing the researcher of is telling the world about it.It would be an interesting case if the defendant had good representation.
by avaer
5/30/2026 at 4:40:04 PM
The interesting case seen to be that the researcher apparently got laid off recently by this MS team, and thus has a 6 month NDA. Apparently he still tried to get bug bounties from inside knowledge of these criminal backdoors. That's what is being talked about behind.A true popcorn case if this would go to court. Would cause lot of governments to think about their backend choices.
by rurban
5/28/2026 at 8:42:36 PM
I’d love to see Microsoft try it on. The defence witnesses in any such trial are going to show up holding all kinds of receipts that Microsoft would prefer didn’t see the light of day.by bigfatkitten
5/28/2026 at 9:42:59 PM
Straight to jail for you, citizen. Distribution of 0day for lulz has been criminal since 2022. You're free to try and get away with it under any and all amendments. IANAL!https://krebsonsecurity.com/2022/06/what-counts-as-good-fait...
by 1970-01-01
5/28/2026 at 9:44:26 PM
> Distribution of 0day for lulz has been criminal since 2022Skimmed the article. Not seeing it support your claim.
by JumpCrisscross
5/28/2026 at 9:58:54 PM
Responsible disclosure is a normalized process in the courts. Skipping it opens you to, at very minimum, a plethora of civil lawsuits, including any and all the damages that resulted from skipping it. The odds are very much not great that you'll be OK.by 1970-01-01
5/28/2026 at 10:28:03 PM
Civil, sure. The dispute is over criminal jurisdiction.by JumpCrisscross
5/29/2026 at 3:40:10 AM
Is there actually a civil duty of care here?Responsible disclosure is an industry norm, but I don't really see how an independent researcher has a legal obligation to play by industry norms. If I discover that any product has a defect, I am free to blab about it all I want as long as it is truthful. There may be considerations beyond this if you are disclosing something discovered by breaking terms of service or by fucking with a computer that isn't yours, but discovering that your copy of windows on your machine has a flaw and telling people about it is protected.
by dghlsakjg
5/29/2026 at 11:46:50 AM
Yes. Simply publishing on GitHub makes it's a TOS violation. You're free to blab all you want. Just host it on your own server and maybe even your own ISP. The code will be protected, but the publishing is not!by 1970-01-01
5/29/2026 at 3:16:58 PM
“Our clickwrap terms of service prohibit users from talking about dangerous defects in our products without telling us and keeping it a secret for a month” is a hell of an argument to even attempt in front of a judge, let alone to be accepted.Again, there isn’t really any case law I can find suggesting that skipping responsible disclosure opens you to any legal liability - which is the argument being made here.
by dghlsakjg
5/29/2026 at 11:44:29 AM
The dispute is whether or not it is perfectly legal free speech. By simply publishing it on GitHub, it was a violation of a TOS and that right there opens it up to lawsuits from MS. You are free to go down this path and prove me wrong.by 1970-01-01
5/29/2026 at 1:54:23 AM
I’d be interested to read some case law involving judgements against researchers in these circumstances, if you have any references handy.by bigfatkitten
5/29/2026 at 11:50:43 AM
https://hn.algolia.com/?q=weevby 1970-01-01
5/29/2026 at 12:05:22 PM
Not comparable at all. He was convicted one count of identity fraud and one count of conspiracy to access a computer without authorization — AT&T’s computer, not his computer.by bigfatkitten
5/28/2026 at 9:55:16 PM
Re-read the beginning of the First Amendment, because it's such a common mistake that I'm surprised people still make it:"Congress shall make no laws ... "
The first amendment bars the *government* from infringing on your free speech. It has zero standing or bearing on private citizens or corporations.
Which is why people crowing about it on social media or universities are completely oblivious to the fact that these organizations have absolutely zero responsibility to enable your free speech.
by gremlinunderway
5/28/2026 at 10:28:08 PM
Microsoft's blog is calling this criminal activity. They are threatening to bring in the government to go after this speech.This is a first amendment issue.
by avaer