Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

141–150 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#141

Post by jezfromfuture »

ajays wrote: post #113
meowface wrote: post #110

Earlier quoted context omitted.

Whether it's the server's or the client's fault doesn't matter that much from a legal perspective. Intent plays a big role: if you knew that ending a URL with "\" causes `rm -rf /*` to be run, and intentionally run that on a server, you could likely be prosecuted and convicted if it were proven that you did it intentionally. If it were done accidentally by a client, they would (likely, and hopefully) not be convicted…

No, Weev did not "exploit" anything. He _requested_ information from a server. If the server owner had so desired, they could have made the data private by adding a password. They chose not to. In the end, the decision to offer Weev the data was made _by the server_ . And if you're going to bring up the UserAgent spoofing, let me remind you that most browsers have done something like that for > 15 years.

dude what part of he gave the info away to a third party before reporting it do you not understand to put ur bullshit out there >

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#142

Post by jlgreco »

PhasmaFelis wrote: post #122
lolwutf wrote: post #64

Earlier quoted context omitted.

OH MY GOD ARE YOU SERIOUS.

I have heard that America's bizarre obsession with keeping your salary secret is not shared by rest of the world. I haven't checked myself, though. I'm deeply suspicious of the "tradition" either way since working at a place where it was actually a policy violation to tell a coworker what your salary was . Because then they would know if they were getting stiffed, and they might ask a raise.

I have friends who make somewhere in the general neighborhood of several times less than I do, and other friends who make likely as much as twice what I do.

The result of having a wide range of salaries in your social circles is that salary becomes taboo. There is little good to come of talking about it with non-coworker friends, somebody is just going to end up feeling bad, or jealous, or self-conscious, or asked for a personal loan... Even more closely guarded than salary is personal worth, for many of the same reasons, and more.

If this taboo doesn't exist outside the US (and I rather doubt claims that it really doesn't), I would nevertheless refuse to participate in non-anonymized discussions about salary in those settings. What good could come of it?

This taboo carries over to the workplace and into interactions between coworkers who arguably could benefit from discussing salary. If it were born just from employee handbook rules, then nobody would respect it. There are plenty of other rules in those things that nobody reads.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#143

Post by Robin_Message »

msandford wrote: post #42
res0nat0r wrote: post #37

Earlier quoted context omitted.

>This was a PUBLIC website... you are supposed to be able to visit it. If you make a request to a server without providing authentication and it returns data, that is not your fault. That is what you are SUPPOSED to do to servers. If it asks for authentication and tells you you are unauthorized, but you brute force the password or find an exploit, then THAT is a crime. There was not authentication in this case. Unfor…

If I find a $50 bill on a sidewalk I can INTEND to steal it as much as I want. But no matter how badly I WANT to steal it I cannot because at that point it's not a thing that can be stolen. There is no way to trace it back to it's former owner and as such, the first person to find it is legitimately the new owner. Weev might have said that he "stole" the information or that he "intented" to perform an unauthorized ac…

Ahem, http://en.wikipedia.org/wiki/Theft_by_finding

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#144

Post by ivanhoe »

MacsHeadroom wrote: post #73
daenz wrote: post #59

Earlier quoted context omitted.

> Private property is private property Except in many cases the private property is being made accessible. Imagine going to an open house and the owner accidentally left the basement unlocked. You open the door and walk down, then get arrested for breaking and entering.

More applicably, imagine there is no door, not even hinges where a door should be; just an opening to the basement. But you get arrested for walking down there anyway. Then the police tell you you're under arrest because "The owner didn't intend for you to go there."

well, all these analogies are interesting, but hackers don't get there by accident. They don't just spot the door, because these doors are invisible to regular visitor, right? You have to actively look for "doors", which implies that you have a premeditated intent of finding the "secret doors". And you also know very well that owner didn't want you in there...

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#145

Post by Zak »

patio11 wrote: post #69
mintplant wrote: post #60

Earlier quoted context omitted.

So if I ask the librarian for a copy of the book with ISBN 1; DROP TABLE books; -- is that okay because, technically, the server let my request through?

This is currently downmodded because people don't like the implication. And they shouldn't, because it quickly forces someone into either a) agreeing with the law or b) saying that SQL injections must be, ipso facto, legal. Including ones like: 1 AND ("1" = SUBSTRING(select social_security_number from employees where employee_name = 'Angela Smith', 1, 1)) You can use variations on this to... a) Ask our librarian for…

I think SQL injection in many cases[0] demonstrates a clear difference in intent from a GET request for a resource the user legitimately expects to exist. There's no good analog in describing the behavior of a librarian because humans generally know not to follow arbitrary instructions from random people.

The closest analog I can think of would be giving the giving the librarian drugs to modify his behavior before asking him to perform some act or provide some information he normally would not. Giving the librarian a brownie before requesting access to the staff lounge would probably not alter his behavior nor be treated as a crime. Giving him a brownie laced with scopolamine before requesting access to the staff lounge would be, even if scopolamine had no dangerous side-effects.

[0] One might reasonably expect an SQL injection string to return a legitimate resource on a documentation site or general-purpose search engine, for example.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#146

Post by tedunangst »

jrockway wrote: post #117
tedunangst wrote: post #107

Earlier quoted context omitted.

If only there were some way to determine what was meant. Barring that, maybe it's best not go around saying such things if you can't even convince one out of twelve people that you weren't serious. Regardless of whether you truly intend to carry out the threat, the threat itself is a form of violence. It imposes your will on an unwilling subject. If you rob a bank with an unloaded gun, you can't claim afterwards, "oh…

No, you missed my point. My point is that anyone can accuse anyone of a crime, so the law has to reduce the incentive for someone to make something up to get attention or revenge. "He said he would kill me," is nearly impossible to prove, so if you punish it severely, you create a cure that's worse than the disease. If you restrict it to certified letters, though, then you have a better balance.

Don't we already have laws against filing a false report? I think I agree with you, but I'm not sure that the problem you described exists.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#147

Post by GotAnyMegadeth »

mylorse wrote: post #76
mintplant wrote: post #66

Earlier quoted context omitted.

Not if I tricked the librarian into setting fire to the library.

Then that is a poor librarian. A good librarian should have just said: 400 BAD REQUEST Whomever staffed that librarian, should interview or train their staff better.

You shouldn't have to train your staff not to burn down the building they are working in...

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#148

Post by msandford »

Robin_Message wrote: post #143
msandford wrote: post #42

Earlier quoted context omitted.

If I find a $50 bill on a sidewalk I can INTEND to steal it as much as I want. But no matter how badly I WANT to steal it I cannot because at that point it's not a thing that can be stolen. There is no way to trace it back to it's former owner and as such, the first person to find it is legitimately the new owner. Weev might have said that he "stole" the information or that he "intented" to perform an unauthorized ac…

Ahem, http://en.wikipedia.org/wiki/Theft_by_finding

Ahem, there are no less than three examples in the wikipedia page you're trying to cite that back me up:

and cases where the circumstances were held to show no larceny: R. v. Wood (1848) 3 Cox C. C. 277 (banknote found on open land) R. v. Dixon (1855) 7 Cox C. C. 35, 25 L. J. M. C. 39 (lost note without mark) R. v. Shea (1856) 7 Cox C. C. 147; R. v. Christopher (1858) Bell C. C. 27, 169 E. R. 1153 (unmarked notes and purse found in public place)

I used a $50 bill (which is implied to be unmarked) purposefully.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#149

Post by tekacs »

meowface wrote: post #111
jrockway wrote: post #83

Earlier quoted context omitted.

I approach this from a different angle. If someone broke into my web app by injecting SQL, I'd be mad that I allowed them to do so. If someone broke into my apartment by smashing the window with a brick, I wouldn't be mad at myself for not using thicker glass. Therefore, I see SQL injections as sloppy programming, but physical break-ins as sloppy ethics. IMHO YMMV IANAL KTHXBYE.

Where do you draw the line? What if your site uses Wordpress or some CMS, and it has a SQL injection zero day that is then exploited to gain access? Even if you did due diligence, kept your kernel and all your software up to date, and generally secured the server and the application as best you could, you could still be entirely unaware of flaws lurking within. It'd be more comparable to the lock on your front door b…

If you actually cared about your data being taken care of in this instance you should probably be running an IDS-esque or similar to notice and stop that form f attack in a blanket fashion (these certainly exist for SQLi attacks, names escape me in this moment).

When using a proprietary, paid for web service or app you can blame the service provider.

When hosting OSS code on your own server, exactly this is what the NO WARRANTY section in the license is about, thus making it fully your responsibility to go over the code or to accept that bugs and security vulnerabilities happen.

Edit:

To all those talking about the skill level of the individual - if you are using a proprietary service, you can easily point the finger at the service provider. In the case of OSS code, the license is there to remind you that you are taking responsibility for being competent enough to use the code yourself.

If your house was broken into because the lock was shoddily installed by a locksmith, you might have some legal recourse (though, IIRC, you may be required to validate & disclaim the install) but if you were to install the lock yourself, you have nobody to blame.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#150

Post by andrewaylett »

usaphp wrote: post #56

Here is my analogy: 1. You just finished your workout and went to a locker room at your gym (he went to a public website) 2. You opened up your own locker and took your stuff from it (checked his account) 3. You found out that very few people are using locks in the gym locker room (figured the account id in url ) 4. You know that it is not your belongings in other people lockers, but they are not locked just because…

How about replacing step three with "You notice that all the lockers have glass tops" and following that with a story about taking photographs?
Post reply on HN