Live data from Hacker News

Goldman Sachs sent a computer scientist to jail over 8MB of open source code

blog.garrytan.com

41–50 of 84 posts

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#42
post #23
post #5

Previous discussion here: https://news.ycombinator.com/item?id=6146446

I was disappointed in that previous discussion. Take away the off-topic stuff and it seemed like most reactions varied from "Good, throw the book at him" to "God that guy was dumb". If Lewis' portrayal is accurate, then Aleynikov is pretty clearly an otherworldly technical type. That doesn't mean he should be exempt from laws, but it's not irrelevant either. For one thing, to anyone who knows the type, it says someth…

According to the indictment the source code included Goldman's propriety stock option pricing algos.

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#43
post #37

Hmmm. Ok so this guy uploaded both OS and Goldman-authored code - as stated in the article. And uploading pure OS code wouldn't make sense anyway as it would be available anywhere. And did so immediately prior to taking a principle role at a competitor start up - no wonder they checked. He knew he was doing something wrong - as stated in the article - and his reason for deleting his bash history makes no sense (surel…

I assume he was performing some sort of authenticated action - e.g. against the svn repository - and providing the password as a command-line argument rather than interactively. This would not only leave the password in the history, but would make it visible to anyone else on the machine who runs ps whilst the command is executing. It's terrible security practice, but I've seen it done more times than I can count.

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#44
post #37

Hmmm. Ok so this guy uploaded both OS and Goldman-authored code - as stated in the article. And uploading pure OS code wouldn't make sense anyway as it would be available anywhere. And did so immediately prior to taking a principle role at a competitor start up - no wonder they checked. He knew he was doing something wrong - as stated in the article - and his reason for deleting his bash history makes no sense (surel…

> surely bash doesn't cache passwords

It does if you're careless enough to type them out in clear text, e.g. when connecting to a mysql database:

    mysql -h host -u user -pMyPassword database

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#45
post #37

Hmmm. Ok so this guy uploaded both OS and Goldman-authored code - as stated in the article. And uploading pure OS code wouldn't make sense anyway as it would be available anywhere. And did so immediately prior to taking a principle role at a competitor start up - no wonder they checked. He knew he was doing something wrong - as stated in the article - and his reason for deleting his bash history makes no sense (surel…

[deleted]

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#46
post #35

Earlier quoted context omitted.

a) I didn't read anything that suggested he was protesting the law. Perhaps you could point out that part of the story. b) He didn't release proprietary source code. Or did I miss that part?

(a)I was offering him the benefit of the doubt. You're correct. Other possibilities include that he's simply a criminal or merely dumb. (b) You did. Reread the third line of the post.

> (b) You did. Reread the third line of the post

Which third line of the post is this? I don't see anything about him releasing the source. And if you read up on the case, you will find that what he actually did was to upload encrypted archives that he then downloaded from home. I don't believe there's any allegation that he publicly distributed any of this source.

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#47

Link bait title -- It was open source code mixed with Goldman Sachs proprietary code . This is also a summery of a much larger and more complete Vanity Fair article [1]. [1] http://www.vanityfair.com/business/2013/09/michael-lewis-gol...

It was stealing proprietary code that could have cost Goldman hundreds of millions of dollars.

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#48
Seriously, this part (if true) doesn't really help him.

"He pulled up his browser and typed into it the words: Free Subversion Repository. Up popped a list of places that stored code, for free, and in a convenient fashion. He clicked the first link on the list. The entire process took about eight seconds."

Pushing "proprietary" code to a repo without knowing that it is a) secure and b) allowed feels like a great way do not follow a NDA.

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#49

Link bait title -- It was open source code mixed with Goldman Sachs proprietary code . This is also a summery of a much larger and more complete Vanity Fair article [1]. [1] http://www.vanityfair.com/business/2013/09/michael-lewis-gol...

Also the 8MB is really debatable

A SSL key can be smaller than 1k (ok, today more like 4k maybe more) and be very valuable

Not to mention older source code that was smaller but very valuable (think IBM PC bios, or the first Apple II ROM)

Re: Goldman Sachs sent a computer scientist to jail over 8MB of open source code

#50
This guy has made two mistakes: 1. He used OS code without consulting first with legal departament of the company. 2. Transferred the source code outside the corporate network without consulting first with legal departament. His boss may be not competent in this field, but the legal departament must be and, I beleive, they already have a policy for OS solutions. This developer made a measurable damage to the company, which should now take some efforts to clean up the OS code or face possibility of being required to release it's own code under OS license. I clearly see this as a good reason to sue him.

The main problem with this situation is educational: "brilliant scientists" and "smart developers" (especially from ex-USSR countries) are not paying enough attention to the legal issues related to their jobs. They do not try to secure their rights and do not consider the possibility that they violate the other's rights by their technical actions. It would be great if CS courses in universities will include a short talk about what's good and what's bad in legal field. For now, the more attention will be paid to such cases, the better for everyone.

Post reply on HN