Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You May Not Like Weev, But Your Online Freedom Depends on His Appeal

wired.com

Post reply on HN
Print view View original

21–30 of 145 posts

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#21

Post by betterunix »

davidw wrote: post #17
betterunix wrote: post #14

Earlier quoted context omitted.

"What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?" Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?

If they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.

Sure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#22

Post by res0nat0r »

sneak wrote: post #12
nicholassmith wrote: post #9

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly…

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the s…

>It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended.

The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#23

Post by sneak »

stfu wrote: post #4

I, for one like Weev. He is a boundary pusher. Many even around here on hn might perceive his stuff as tasteless. But I sincerely wished more people were as dedicated to their "ideals" as Weev is. Defending free speech means standing up for people who have controversial views - no matter how unease you personally are with these views.

http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may...

I think he's despicable, but he's also my friend if only because he is willing to do whatever is necessary to stand up for what he believes in.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#24

Post by dorkitude »

davidw wrote: post #7
lesslaw wrote: post #3

It is a terrible decision curl http://domain.com/showdocument?[00000-99999] should not be a crime!!

What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account? Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right? Yes, it's their fault too for leaving i…

That would be a crime, because then the email addresses would've been "possessed" or "transferred" "in connection with" another distinct and separate crime.

But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#25

Post by twoodfin »

betterunix wrote: post #15
IanCal wrote: post #10

Earlier quoted context omitted.

Should I be allowed to brute force passwords then?

Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.

You and sneak seem to be proposing a legal regime under which no "hacking" of any kind is illegal. If the system will perform action B given request A, issuing request A, no matter the intent, cannot be a crime?

If I'm missing an important distinction you'd make, I'd very much like to hear what it is.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#26

Post by davidw »

betterunix wrote: post #21
davidw wrote: post #17

Earlier quoted context omitted.

If they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.

Sure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?

> Why are we acting like AT&T is an innocent victim?

No one here is. I'm not sure why no one has done anything to them, legally. It'd be interesting if someone who actually knows what they're talking about in terms of the legal system about could comment on it.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#27

Post by sneak »

res0nat0r wrote: post #22
sneak wrote: post #12

Earlier quoted context omitted.

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the s…

>It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.

You're right, the law can't. That's why we should let the final verdict for authorized/unauthorized lie IN THE CODE DEPLOYED BY THE OWNER, not the law (or the owner's retroactive statements).

It's pretty simple, really. This would be a non-issue if you programmed your cyborg to go pick up milk from the store and it started handing out $20s to strangers in the dairy aisle. Obviously that's no fault but your own.

Why is it different for a webserver?

It is massively unfair to expect someone to make assumptions about the intent of a remote system, programmed, configured, and deployed by people they have never met or communicated with, in order to avoid criminal liability.

I'm not sure what the problem is here. It seems like simple common sense to me.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#28

Post by FlyingAvatar »

davidw wrote: post #17
betterunix wrote: post #14

Earlier quoted context omitted.

"What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?" Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?

If they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.

I think that the problem with this thinking is:

(a) Even altering a parameter once in the address could be considered illegal under the current laws.

(b) The access of information in and of itself would not be illegal alone. Say I kept a bunch of people's information in paper files in file cabinets. Then I gave you access to retrieve yours from the file drawer yourself. It is sleazy, but not necessarily illegal to look at other files in the drawer, as I have given you access to their container.

(c) Even if you want to make the action in (b) illegal, the reasonable punishment is almost certainly not a double digit prison sentence.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#29

Post by vertex-four »

sneak wrote: post #12
nicholassmith wrote: post #9

I agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly…

It doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the s…

So, if somebody has SSH open on port 22, root password login enabled, and a root password of Pa$$w0rd, and I guess that and log in, should that be legal? If so, what about a more complex password? Should we legalise other remote attacks on systems?

It could very reasonably be argued that in the case of AT&T's system, device IDs count as passwords for accessing the system.

Simplifying things a little, there was an API, which looked somewhat like this:

    GET http://example.com/get-email?device-id=123456
    > example@example.com
Now, if we replaced that with some sort of bespoke raw socket interface that somebody would have to reverse-engineer:

    CONNECT example.com:4567
    > 123456
    example@example.com
Would you still be arguing "it's on the web"?

What if I added a field named "password" which always had to be the same value, which was distributed to all devices?

What if it wasn't email addresses, but instead credit card data, or sensitive data such as your race, religion, sexuality, political leanings, medical information...?

I'm not attacking you, simply stating that in my opinion, it's not as simple as "if you can access it, it's public". There's an expectation of privacy for many types of data, especially when the data owner is not explicitly intending to publish the data.

Re: You May Not Like Weev, But Your Online Freedom Depends on His Appeal

#30

Post by betterunix »

twoodfin wrote: post #25
betterunix wrote: post #15

Earlier quoted context omitted.

Yes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.

You and sneak seem to be proposing a legal regime under which no "hacking" of any kind is illegal. If the system will perform action B given request A, issuing request A, no matter the intent, cannot be a crime? If I'm missing an important distinction you'd make, I'd very much like to hear what it is.

I would prefer if the system punished people for what they did with their access to data, not simply for having that access; organizations that hold private or sensitive information should be punished if unauthorized people can access it by any means. Having email addresses or credit card numbers should not be the crime, regardless of how you obtained that information. Committing credit card fraud or selling credit card information to other unauthorized people should be crimes (or failing to secure your computer where you store said information).

So Weev should not be punished for downloading the email addresses. AT&T should be punished for making the list available to him (and likewise, if Weev made the list available to others, he should be punished for that).

Post reply on HN