Apparently this guy is just taking the credit for this, He didn't really do it..
Or so say the interwebs.
How to cause moral outrage from the entire Internet in ten lines of code
81–90 of 113 posts
Re: How to cause moral outrage from the entire Internet in ten lines of code
#82Earlier quoted context omitted.
How many customers did Amazon lose this weekend that will likely never hear that this was a hack? He directly and irreparably harmed the reputation of a company, how is this victimless at all?
You could also go out in the street with a sign that says "Amazon sucks" and it would probably deter as many people as this did.
Well, that's simply not true. If it was he wouldn't have done it.
While I admire the guile and technical reasoning required to pull this off, it's high time the community at large stop admiring this type of crap.
Authors of the books in question lost real money. It doesn't matter how much. Amazon lost credibility from all sides.
There is a difference between screaming that the Emperor has no clothes and stealing his wallet.
Re: How to cause moral outrage from the entire Internet in ten lines of code
#83Earlier quoted context omitted.
It's more like breaking into the store at night and changing all the signage to read "I molest little children".
Through a door that was left wide open, and in erasable marker.
And?
The intent is the same whether or not you walk through the open door or break the window.
Re: How to cause moral outrage from the entire Internet in ten lines of code
#84I'm mainly wondering if he can get his face sued off over this. I've got NO doubt that this is going to have a noticable negative impact on Amazon's profits. Not world shaking, but more than enough to make the lawyers angry. As another commenter mentioned, he's been in a NYT article, with his face and full name displayed. Amazon won't have any trouble finding him.
I should certainly hope not. While he's certainly mischievous and possibly malicious, he didn't actually do anything that I think should be illegal. He merely used Amazon's flawed system against them, at considerably personal expense. He hacked them, in other words. I can't agree with his aims in this case but you've got to hand it to him really - you don't have to like trolling in general to admit that was an amazin…
It shouldn't be illegal and he shouldn't be able to be sued.
If I was an author of those books, who would compensate me for my lost income? You?
Re: How to cause moral outrage from the entire Internet in ten lines of code
#85Earlier quoted context omitted.
It certainly would be reasonable for them to sue you if you had lied.
Then we have fundamentally different opinions of what should and should not be legally actionable. How the hell should anyone be able to drag someone through the courts on the grounds that they might have lied about about feeling sick or not? And what could you possibly do when he just says "I did feel sick" - "no you didn't"? Yes I did, no you didn't? I don't think you've given much thought to the complexities here.…
Libel and Slander are well-established legal concepts that have been around for ages.
Re: How to cause moral outrage from the entire Internet in ten lines of code
#86Earlier quoted context omitted.
He could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse. If Amazon has one CSRF vulnerability via an improper use of GET, there may well be more. This incident may help them tighten their systems against more malicious attacks.
How is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.
For 48-72 hours, some books appeared fewer places on Amazon's site.
Many of those same books got lots of extra attention from elsewhere, as examples of affected titles.
So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles).
If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.
Re: How to cause moral outrage from the entire Internet in ten lines of code
#87Can anyone point out the "report as inappropriate" he claims to have used? I can't find it on either current Amazon pages or Google Cached ones.
If it indeed points to an unsecured GET statement, that supports the claim. If it doesn't, that opposes. If it did and has been fixed in the past day, that's nearly proof.
Re: How to cause moral outrage from the entire Internet in ten lines of code
#88Earlier quoted context omitted.
He could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse. If Amazon has one CSRF vulnerability via an improper use of GET, there may well be more. This incident may help them tighten their systems against more malicious attacks.
Amazon is losing a lot of business in the GLBT community, historically a reliable demographic group in both online spending and books. (This actually wouldn't be so bad if they had been more forthcoming, and quickly made a statement apologizing profusely. However, just saying that there's a "glitch" after customer support had suggested that much of the material was indeed adult in various posts hovering around, this…
> As for me, I'm considering looking for a new default myself. Powells, here I come?
Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?
Re: How to cause moral outrage from the entire Internet in ten lines of code
#89Earlier quoted context omitted.
How is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.
For 48-72 hours, some books appeared fewer places on Amazon's site. Many of those same books got lots of extra attention from elsewhere, as examples of affected titles. So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles). If the loss to specific titles was significant, Amazon could easily restore the previous balance with a…
Perhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors.
It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself.
(Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)
Re: How to cause moral outrage from the entire Internet in ten lines of code
#90Earlier quoted context omitted.
Then we have fundamentally different opinions of what should and should not be legally actionable. How the hell should anyone be able to drag someone through the courts on the grounds that they might have lied about about feeling sick or not? And what could you possibly do when he just says "I did feel sick" - "no you didn't"? Yes I did, no you didn't? I don't think you've given much thought to the complexities here.…
Libel and Slander are well-established legal concepts that have been around for ages. http://en.wikipedia.org/wiki/Defamation
Yes, yes, but the question assumed that the poster had told the truth. With a criminal complaint there is an assumption of innocence such that you have significant legal protections even if you fail to show up. With a civil suit no such evidence is required to file and if you fail to show up you the default is you lose without any party trying to defend you.
I would suggest that a reasonable demonstration of evidence supporting the claim should be required before the other party is even notified and such a requirement have no impact on the actual case. Also a public defendant should be provided to defend you etc. Basically, a presumption of innocence until demonstrated otherwise.