Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

blog.phpfog.com

Post reply on HN
Print view View original

161–170 of 202 posts

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#161

Post by benatkin »

parfe wrote: post #124
lambda wrote: post #121

Earlier quoted context omitted.

> This need to shift some responsibility to a bunch of kids is nauseating. They aren't shifting responsibility. The kids are responsible for their own actions. They did something illegal. They are responsible for it. Now, PHPFog is also responsible for protecting their customers; they are supposed to provide a secure hosting environment. PHPFog is a victim here, but has also acted irresponsibly with regards to securi…

> They aren't shifting responsibility Yes PHPFog is. The only reason these kids are even mentioned in the blog post is to shift blame. Their part in the post serves no other purpose. The entire event could have been recounted without a single personification of the hackers in the blog post.

I couldn't have said it better myself.

Perhaps a little mention would be good, but the way they make it the key points of the post, and so many people commenting on it accept it, disgusts me.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#162

Post by zaidf »

I remain in two minds about idea of charging the kids.

There is no doubt they did some things they should not have. And I don't doubt there can be a decent case built against them. But as someone who actually had something from his teen years come to bite years later, it's not pleasant. At least in my case it was a MAJOR maturing moment(also the worst day of my life). May be it will take a lawsuit to get these kids to mature up...to that extent anything that gets em to mature up before they really get screwed would be fair.

I'm not merely advocating another chance but actually something that gets these kids to be a tad more thoughtful about their actions. It's not always easy to do that when you are 16 and full of adrenaline.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#163

Post by hendi_ »

lambda wrote: post #113
parfe wrote: post #81

Earlier quoted context omitted.

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment buildin…

  This is like someone finding an unlocked door to
  the apartment building's maintenance office, 
  taking the master keys from there, [...]
Yes, in theory, it is. But in practice, it's not. Especially if you're still a kid. It's easy to miss that there's something going on in the real world when you're doing damage "just online". (I know I sound like the "You wouldn't steal a TV! Why do you download movies?" crap-ad, but I hope you get my point.)

I've been a 16 year old idiot myself. After doing some stupid things to a website I was threatened with some trouble. I could avoid it by having extensive talks with the site's owner, and paying for their losses, but still, I learned my lesson: everything you do on the internet, in the virtual world, has an effect in the real word. Also it was an urgently needed wake-up call for me; I learned to think twice and since then haven't done any nasty stuff without considering its impact.

So in my opinion some sort of punishment is needed for the kids to learn their lesson. The FBI or other federal institutions shouldn't be involved. Talk to them, I'll guess they're nervous as shit right now! Just bill them the time you needed to tidy up the mess they left (or a fraction thereof), and I think both sides are good.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#164

Post by PostOnce »

lambda wrote: post #113
parfe wrote: post #81

Earlier quoted context omitted.

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment buildin…

I'm now nearly 25, and the amount I have changed since I was 16 borders on the immeasurable. Teenagers are glorified children. We seem to forget how little reflective capacity we all had when we were teenagers.

If I were 16 and hacking some stupid website, I would think, sure this is "wrong", and I might get in trouble, but I probably wouldn't think that it would matter 5 years from then, or 20. Truth is, a criminal infraction can fuck your life up worse than is deserved. You could be forbidden to immigrate to your wife's home country, denied any worthwhile job you can find, or spend a sizable portion of your life in a smaller cage than they house animals in.

There's a reason juvenile law exists, but we forget it. We charge 12 year olds as adults. This isn't that different.

Hell, where I live, a lot of employers will check the sheriff's website for public arrest records. These aren't convictions, they're arrests. People are being denied jobs based on accusations.

I've never gotten so much as a speeding ticket, but even I realize what a load of shit this all is.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#165

Post by merijnv »

nakkiel wrote: post #94
nbpoole wrote: post #60

Earlier quoted context omitted.

Personally, I'm a fan of some of his post-hoc justification: " Following this, I took a hold of their Twitter account and posted a couple of bits to draw attention to the fact. This did two things. One, it showed people the system was insecure, but on the other hand people always subconsciously root for the underdog; I drew attention to the company and the product. I know a number of people have actually registered (…

The last bit is priceless. The mere fact that the kid doesn't show any sort of adequate moral judgement should justify prosecution.

Isn't the lack of adequate judgement (moral or other) the definition of being a kid?

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#166

Post by _delirium »

nbpoole wrote: post #83
parfe wrote: post #81

Earlier quoted context omitted.

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

" PHPFog built a castle out of sand and you're upset that a wave came and demolished it. " Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own. " I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame. " Whil…

Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own.

In terms of moral culpability, sure. But when I put systems on the internet, I basically treat "intrusion attempts" as in practice part of the environment, like "mosquito bites" are in Texas. Perhaps they're best thought of as kids knocking down sandcastles rather than ocean waves, but their ubiquity makes them feel more like ocean waves, because you can basically assume that there are tons of those kids, and they're going to kick at your sandcastle every day.

The fact that there's a whole ecosystem of bots running automated intrusion attempts makes them feel a little bit force-of-nature-ish as well. If you lived in some neighborhood where thousands of roving robots were constantly checking doors to see if they could find an unlocked one, you'd have to treat "roving robots" as a quasi force of nature. Well, either that, or come up with a policing method that finds the controller of the robots and shuts them down, but I have relatively low hopes for how much of a dent "cybercrime" policing will make in the overall online-intrusion ecosystem.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#167

Post by ErrantX »

parfe wrote: post #81
dolinsky wrote: post #57

Earlier quoted context omitted.

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

PHPFog fucked up security, that's a given. And they should be thinking carefully on the lessons learned from that.

But your post seems to imply that the kids who did this have no responsibility for their actions; "it was just waiting to happen". This I strongly disagree with (not least because I work with 16 year old kids and they are completely able to take some level of responsibility for their actions).

Sure, at 16 your world view is incomplete and you can make rash decisions ("for the lulz") that backfire bigger and faster than you imagine. On the other hand there is no doubt they knew the illegality and the ethical issues with undertaking this - even if only vaguely.

And if they do not completely understand those issues, do you not think they should be taught them? As responsible adults we should be getting across to them in a sensible fashion that this was not a nice thing to do, and that the impact could have been a lot wider than it was.

Because if we don't and next time they do some real damage, well, that was an opportunity lost.

FWIW I think he crossed the line by causing damage. If I caught a kid breaking into my house I would probably drag him home to face his parents. But if he started smashing plates I'd be a little more pissed, that is a wanton act and probably needs a more severe punishment.

Sure, criminal charges are a silly approach in this case (no need to ruin his life for one silly mistake). Call his parents, explain what has happened and then get him to do some sort of "community service". That's an important lesson in consequence.

In this modern world 16 year olds are not nicking alcohol from the corner shop any more; they are breaking into websites. And that has potential for much more dramatic and widespread impact. We need to stop saying "oh, they're only kids". Instead we should recognise that 16 year old "hackers" exist on the internet and think of ways to communicate with them (ideally in a way that gives them an avenue for their curiosity without risking too much damage :)).

Bottom line; a 16 year old kid is a far cry from your dog when it comes to the ability to "understand" what you have done.

Just my 2p :)

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#168

Post by jasonlotito »

parfe wrote: post #131
nbpoole wrote: post #127

Earlier quoted context omitted.

1. We don't treat them like adult criminals (necessarily), but we certainly treat them like criminals. Here are some examples (some harsher than others): Bank robber, 13, could get 21 years in US jail ( http://www.breitbart.com/article.php?id=CNG.cb17379375828ffc... ) Teen bank robber to be held for two years ( http://www.morningjournal.com/articles/2011/02/18/news/doc4d... ) Boy, 15, Charged in Armed Bank Robbery in…

You're conflating armed robbery, a violent crime, with hacking a web site? That's the end of this thread.

Dude, you started the metaphor with tour comment. Can't exactly blame someone for calling you out on it.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#169

Post by Kudos »

wooter wrote: post #79
nodoubt wrote: post #38

The blog post is riddled with the words "luck" and "timing" which brings doubt into my mind that the team can actually take full responsibility for their actions. "aware of the potential security threat " but they left it for the next week, who honestly here would do that? I have also seen comments around the web of migrating to Php Fog because of how they handled the situation. If you are one of these people please…

I couldn't agree more. The phpFog team cut corners to deliver quickly. We (devs) all do it. The important part is to clean up after yourself. The whole blog post seems a bit melodramatic. I mean seriously, who here hasn't spent 3 all nighters in a row fixing a mistake? sack up and do what you should've done before deploying other people's data. ...and who would seriously sue these kids? they handled it poorly but the…

Am I the only one who becomes functionally useless after the first 24 hours? I'm nearly 30 now, but the maximum I'd have done 10 years ago was 36 hours.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#170

Post by JonnieCache »

jarin wrote: post #54
jammur wrote: post #47

Earlier quoted context omitted.

I don't think you can draw those conclusion from the evidence presented. I would guess that quite a lot of the top white hat hackers today sharpened their skills early with some highly unethical behavior of their own. A good example of this would be how Chris Putnam got hired at Facebook. http://www.quora.com/How-did-Chris-Putnam-get-hired-at-Faceb...

Oh wow, I just realized that Chris Putnam is the same guy who used to post on the Something Awful forums back in 2003-2004 or so. I remember him getting trolled out of there after showing any kind of ambition beyond posting on the forums. Same thing happened to the guy who started Imageshack (originally an image host for the SA forums), Eli Hodapp (who later became one of the main TouchArcade writers), and probably s…

Damn. I had no idea that being run out of SA with your tail between your legs back in the day was such a predictor of success. Who'd have thought it?
Post reply on HN