A Hacker Has Wiped a Spyware Company’s Servers

Post by caf » Tue, Feb 20, 2018, 12:26 AM UTC

HarryHirsch wrote: post #59

JumpCrisscross wrote: post #42

Earlier quoted context omitted.

> We put thieves in prison...In the same way society has a reason to put strict limits on surveillance On one hand, we have a stylised burglar. On the other, a stylised lockpicking tool maker. The former is illegal; the latter is more complicated. I am conservative about expanding the scope of the law. You criminalise surveillance apps in one decade and in the next, a security researcher disclosing a bug gets bitten.…

We've decided that privacy and freedom from surveillance is highly valued and deserving protection. The target audience of that company is teenagers of helicopter parents. Whatever they have on their phones isn't privileged or valuable information, so the civil damages approach doesn't work too well. Some may have (against all advice) nudes on them, but I'd rather not wait until those are available to the public, and…

Post by ams6110 » Tue, Feb 20, 2018, 1:36 AM UTC

HarryHirsch wrote: post #13

jim_dow_jones wrote: post #7

I see no reason to praise the hacker. He destroyed a legitimate company's private data for no purpose other than his flawed moral reasoning. The company provides a way for parents to monitor their children and other legitimate business practices. Obviously, the software can be used for nefarious purposes but so can almost any other software. U.S. representatives and senators try to ban encryption using the same exact…

I see a legitimate business opportunity, a phone walking service. You collect the children's phones and take them to the mall, the library or wherever teenagers go these days, and meanwhile the kids can enjoy life without parental surveillance. You do wonder what the 24-hour panopticon does to adolescents' mental health and to the health of the parent-child relationship.

Post by TheSpiceIsLife » Tue, Feb 20, 2018, 1:49 AM UTC

simonh wrote: post #78

HarryHirsch wrote: post #9

Earlier quoted context omitted.

Isn't Google supposed to be reviewing the apps? The real question is: who gets to say in what someone's phone is going to be doing: the programmer, the manufacturer or the phone's owner. Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Germany takes another approach: no one gets to do surveillance outside strict limits, privacy is highly regarded…

>Most everyone would agree that the owner should have a word in it, and that the manufacturer should have no say at all. Isn’t setting the defaults behaviour ‘Having a say’, and who else but the manufacturer gets to do that? Sorry but this suggestion doesn’t make it past even 2 seconds of considered thought. Another few seconds - who gets to decide what privacy controls the phone even has, if not the manufacturer? Do…

Post by tachyoff » Tue, Feb 20, 2018, 2:13 AM UTC

smoyer wrote: post #75

bshacklett wrote: post #45

Earlier quoted context omitted.

It should be mentioned that none of that should ever make its way into a Git repo in the first place. If a secret is committed to Git, it's compromised, period. Suck it up and generate a new secret.

Agreed ... use a pre-commit hook to scan your repository for high-entropy strings before they are forever enshrined in your history ( https://github.com/dxa4481/truffleHog ).

Post by yorby » Tue, Feb 20, 2018, 2:23 AM UTC

wlll wrote: post #44

falcolas wrote: post #2

This is one of those cases where I probably should feel bad for the company being repeatedly hacked to the point of being ripe for being shut down, but I just can't muster the will right now. If you are in the business of collecting data without users' explicit permission, and can't protect that data from being accessed or deleted, you shoudln't be in business.

I feel like this is a better way of putting it: "If you are in the business of collecting data without users' explicit permission you shoudln't be in business."