111–120 of 202 posts
Earlier quoted context omitted.
I downvoted this too, but wish I hadn't. He has a point.
He could have made his point in a more intelligent way.
I mean, I'm all for praising gymnastics, but if we're trying for truth here shouldn't endgame be valued over execution?
Earlier quoted context omitted.
Let's not forget that the victim here is PHPFog's (potential) customers and not PHPFog itself.
I can agree with you that PHP Fog's customers were affected and are thus victims. I don't understand how PHP Fog isn't a victim here though.
If I give the bank my money and the next day I get an email saying "Sorry, we didn't feel like locking up last night and some kids looted the vault." I'd have a hard time calling the bank the victim.
And something concrete: PHPFog knew the holes existed and were negligent. I would say they even have some contributory negligence (IANAL). Especially after admitting they knew they were vulnerable.
Earlier quoted context omitted.
What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…
Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…
This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, rifling through a bunch of people's personal belongings, sticking signs in the windows saying "this building's landlords suck," and changing the locks on some of the doors to make it hard to clean up the whole mess.
They absolutely are the responsible party; you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves. If I accidentally leave my door unlocked one day, that does not make it suddenly OK to come in and take my stuff and it's my fault for not having locked my door, instead of yours for taking my stuff.
Now, in this case PHPFog does bear some responsibility, because they have a duty to protect their customers as well as possible, and from reading about how this happened, it sounds like they were amazingly sloppy and irresponsible about it (passwords stored in the clear on the server, passwords shared between various accounts, leaving unsecured shared systems running after beta launch, etc). But that doesn't reduce the culpability of the attackers; they acted maliciously, with full knowledge of what they were doing, vandalized systems, changed passwords, and bragged about it.
I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…
Reading through those forum posts, I have less and less sympathy for these guys.
I guess the real moral of the story is to finish what you begin, or don't keep putting security off until it is convenient for you.
Earlier quoted context omitted.
From the perspective of security protection, intrusions are an act of nature. You should be no more surprised at an especially strong wave than you are at an exceptionally immature child.
I don't think we're using the same definition of "act of nature": http://en.wikipedia.org/wiki/Act_of_God " Act of God is a legal term for events outside of human control, such as sudden floods or other natural disasters, for which no one can be held responsible " Do you think nobody can be held responsible for this breach?
Earlier quoted context omitted.
I can agree with you that PHP Fog's customers were affected and are thus victims. I don't understand how PHP Fog isn't a victim here though.
I promised myself I'd avoid another analogy but... If I give the bank my money and the next day I get an email saying "Sorry, we didn't feel like locking up last night and some kids looted the vault." I'd have a hard time calling the bank the victim. And something concrete: PHPFog knew the holes existed and were negligent. I would say they even have some contributory negligence (IANAL). Especially after admitting the…
Earlier quoted context omitted.
I promised myself I'd avoid another analogy but... If I give the bank my money and the next day I get an email saying "Sorry, we didn't feel like locking up last night and some kids looted the vault." I'd have a hard time calling the bank the victim. And something concrete: PHPFog knew the holes existed and were negligent. I would say they even have some contributory negligence (IANAL). Especially after admitting the…
You know what we call kids who loot bank vaults? Bank robbers.
And we certainly don't call the bank the victim.
Earlier quoted context omitted.
I don't think we're using the same definition of "act of nature": http://en.wikipedia.org/wiki/Act_of_God " Act of God is a legal term for events outside of human control, such as sudden floods or other natural disasters, for which no one can be held responsible " Do you think nobody can be held responsible for this breach?
You're right, we're not using the same definition. That doesn't mean I don't have a point.