Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heartbleed hack case sees first arrest in Canada

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Heartbleed hack case sees first arrest in Canada

#21

Post by maxerickson »

dmix wrote: post #20
maxerickson wrote: post #17

Earlier quoted context omitted.

Why not let him choose to publicize his defense or have a trial first? Edit: parent comment was edited after I posted this.

No part of my comment accused him of being guilty. His name is on every news site around the world. I found the fact he is a CS student relevant to the news article. As is the fact he has a git repo where he coded a Java crypto library, when he's being accused of exploiting a crypto library.

I didn't accuse you of accusing him of being guilty.

There will be plenty of time to rummage through his life, internet and not, no need to rush into it.

"Person accused of hacking good with computers, uses them" isn't exactly a revelation.

Re: Heartbleed hack case sees first arrest in Canada

#22

Post by at-fates-hands »

Interesting the difference between this article and other articles reporting on more recent hacks. Those articles always point out how much jail time the hacker is facing.

I suspect the Canadian authorities aren't as ruthless with their computer crime laws as the prosecutors are here, but you never know. Any idea what the kid is facing in terms of punishment??

Re: Heartbleed hack case sees first arrest in Canada

#23

Post by [deleted] »

maxerickson wrote: post #21
dmix wrote: post #20

Earlier quoted context omitted.

No part of my comment accused him of being guilty. His name is on every news site around the world. I found the fact he is a CS student relevant to the news article. As is the fact he has a git repo where he coded a Java crypto library, when he's being accused of exploiting a crypto library.

I didn't accuse you of accusing him of being guilty. There will be plenty of time to rummage through his life, internet and not, no need to rush into it. "Person accused of hacking good with computers, uses them" isn't exactly a revelation.

[deleted]

Re: Heartbleed hack case sees first arrest in Canada

#24

Post by ArcticCelt »

maxerickson wrote: post #21
dmix wrote: post #20

Earlier quoted context omitted.

No part of my comment accused him of being guilty. His name is on every news site around the world. I found the fact he is a CS student relevant to the news article. As is the fact he has a git repo where he coded a Java crypto library, when he's being accused of exploiting a crypto library.

I didn't accuse you of accusing him of being guilty. There will be plenty of time to rummage through his life, internet and not, no need to rush into it. "Person accused of hacking good with computers, uses them" isn't exactly a revelation.

>Their will be plenty of time to rummage through his life, internet and not, no need to rush into it.

If find that those type of comments, event if well intended, in the end they are not helpful. First because dmix wasn't "rummaging through his life" but pointing out public facts related to his abilities has a coder.

Second because I wonder when will be the time to discuss this? Once nobody talk about it anymore and it becomes completely irrelevant and forgotten? Now is the exact time to discuss this.

Re: Heartbleed hack case sees first arrest in Canada

#25

Post by dmix »

at-fates-hands wrote: post #22

Interesting the difference between this article and other articles reporting on more recent hacks. Those articles always point out how much jail time the hacker is facing. I suspect the Canadian authorities aren't as ruthless with their computer crime laws as the prosecutors are here, but you never know. Any idea what the kid is facing in terms of punishment??

“Unauthorized Use of Computer” is maximum 10 years in prison in Canada, which is pretty much equivalent to American law. The additional mischief charge will probably get dropped.

https://en.wikibooks.org/wiki/Canadian_Criminal_Law/Offences...

> is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years, or is guilty of an offence punishable on summary conviction.

Re: Heartbleed hack case sees first arrest in Canada

#26

Post by maxerickson »

ArcticCelt wrote: post #24
maxerickson wrote: post #21

Earlier quoted context omitted.

I didn't accuse you of accusing him of being guilty. There will be plenty of time to rummage through his life, internet and not, no need to rush into it. "Person accused of hacking good with computers, uses them" isn't exactly a revelation.

>Their will be plenty of time to rummage through his life, internet and not, no need to rush into it. If find that those type of comments, event if well intended, in the end they are not helpful. First because dmix wasn't "rummaging through his life" but pointing out public facts related to his abilities has a coder. Second because I wonder when will be the time to discuss this? Once nobody talk about it anymore and…

There is little need for the internet at large to discuss anything about this teenager.

Re: Heartbleed hack case sees first arrest in Canada

#28

Post by cbhl »

maxerickson wrote: post #17
dmix wrote: post #16

Googled his name and found his Github profile: https://github.com/Stephsolis He mentions a school assignment for "CS2212" which means he is likely a CS student at Western University in Canada.

Why not let him choose to publicize his defense or have a trial first? Edit: parent comment was edited after I posted this.

Ehh, maybe someone wants to hire the kid.

Re: Heartbleed hack case sees first arrest in Canada

#29

Post by Zombieball »

mindslight wrote: post #14
meowface wrote: post #12

Earlier quoted context omitted.

Intent should count, but if someone broke into a company's building at night, picked the lock to a manager's desk, and stole all the papers he could see and ran out...obviously a theft has occurred. Even if he was not looking for anything in particular, or did not plan on using any of the information found in the papers, he's committed a felony. In this case I don't think it's clear whether or not he went ahead to pa…

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

I like your analogy in that it portrays the fact that nothing was physically stolen, much similar to arguments used in piracy issues.

However, my understanding of heartbleed is it can take many thousands of requests before interesting / meaningful data is returned. I doubt 900 SINs were returned in a single response (I could be wrong). So I suppose this is analogous to repeatedly sticking your head in & out of the wide open window at street-level.

So what I am curious about is where the line is drawn. Is one malicious packet considered enough for an arrest? 1 million?

Re: Heartbleed hack case sees first arrest in Canada

#30

Post by unreal37 »

mindslight wrote: post #14
meowface wrote: post #12

Earlier quoted context omitted.

Intent should count, but if someone broke into a company's building at night, picked the lock to a manager's desk, and stole all the papers he could see and ran out...obviously a theft has occurred. Even if he was not looking for anything in particular, or did not plan on using any of the information found in the papers, he's committed a felony. In this case I don't think it's clear whether or not he went ahead to pa…

Yeah uh, your analogy is terribly wrong and just serves to perpetuate life-destroying punishments for innocuous actions. It's more like a street-level window was left open, and this guy stuck his head in and saw a bunch of papers strewn out on a desk, all while wearing a commonly-worn head-mounted camera. Any seriousness of the situation is related to his ultimate intent, not the hacking itself.

Wow, you seem to be condoning theft here. The CRA website was hacked, using a hacking technique just discovered. It is not like "leaving a street-level window open". It's more like, a new way to pick a lock was discovered that no one knew existed, and he went around picking locks to see what he could find.

He knew he was hacking the CRA when he did it. He can't claim to have done it accidentally. The CRA did everything reasonable to secure their servers.

That said, he's a smart teenager playing with technology and did something he shouldn't have. As long as no one was harmed, and his intentions were just curiosity, I think he should get off pretty light. Hate to see his life ruined.

But you can't deny he hacked the CRA. He did.

Post reply on HN