On Fri, 02 Dec 2011 13:40:54 EST, Travis Biehn said: > My password leaks will all be released under the GPL.
That may not be legally allowable, for one of several reasons: 1) Most password lists are almost certainly "mere aggregations of facts" and thus not eligible for copyright protection at all. This would almost certainly be true for any list of passwords from one source, as it would almost certainly be programmatic with little or no creative input, and probably true for groups of sources. 2) You can get around that by claiming it's a "compilation". 17 USC 101 says: A "compilation" is a work formed by the collection and assembling of preexisting materials or of data that are selected, coordinated, or arranged in such a way that the resulting work as a whole constitutes an original work of authorship. The term "compilation" includes collective works. And you can probably make the case that the choice of which sources to include in the compilation constitutes an original work. Congrats. You now have copyright on the compilation - but *not* on the individual passwords. 3) Unfortunately, the individual users still have the copyright on their passwords/hashes, and unless you get their permission, you can't relicense the passwords/hashes under GPL. And there's also the compilation copyright the site has on the list of all passwords at their site :) (For real fun, consider that published and unpublished works are treated differently. And a password list almost always becomes a published work without the permission of the author(s) ;)
pgpIExrZoCycN.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
