Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

151–160 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#151

Earlier quoted context omitted.

Yeah that's the immediate counter analogy to what I'm suggesting. I think the way I would go about arguing against it is that people on the street/sidewalk have no expectation of privacy. There are literally no access controls of any kind. Anyone can walk on the street; billionaires and homeless alike. There are no societal conventions that privacy is assured on the street and if you end up in someone else's picture…

I don't understand your argument. You seem to agree that the reason the unlocked house is not like the street is shared social conventions. That house across the street is definitely private property whether it's signed that way or not, and I'm expected to know that because, duh, it's a house. At least, that's how I understood this: > So the right of the owner of a house to control access to his house is fairly well…

Basically I'm trying to draw out the differences and similarities.

In meatspace private property is default-closed (with certain exceptions) but some ability to in good faith. For example I can walk on your land to walk up to your front door and knock. You could then tell me I need to leave or you'll call the police. This is how it's worked for a long time and thus we think it's normal. You have this right even without building a fence around your property. Again, default-closed.

On the 'net the same rules of private property don't apply because the default on the 'net tends to be default-open. What I mean by this is that the simplest configuration for any webserver tends to have no access controls. So it'll serve up whatever it can to whoever asks. Furthermore the default on the internet for a long time was everyone can access everything since it was originally designed for precisely that purpose: sharing knowledge. The internet defaults to a street.

If you want to make your internet site NOT like a street (which is what it defaults to) you have to take steps to make that happen because HTTP doesn't have the mechanisms built in to do so. You have to build your access control on top of HTTP. If you do not, I would argue that we are right to assume that you meant for it to be a street for two reasons. First is that's how HTTP works and we've got some 20 years of history backing this up. Second is that to argue otherwise would place an incredible burden on everyone to have to divine the intent of the person/organization that served up the page.

What I'm getting at is to argue that weev "should have known better" strikes me as really nuts. In meatspace it would be like secretly passing a new law that divvied up all the roads to the landowners that border them so that I own the street in between my lot-lines and up to the middle of the road. Nobody knows about this so everyone keeps driving and nobody's the wiser. Then a real douchebag drives down the road in front of a rich guy's house. He hates it so he calls the cops and because he's rich and influential the DA manages to dig up this secret law and prosecute the douchebag with it.

If that law were to become non-secret and enforceable it would turn the world upside down in the US as nobody would be able to drive anywhere, walk anywhere, or generally do anything without the express permission of all the millions of people who now own the streets, sidewalks, etc. Even if you live in a big city and you could take the subway (which perhaps is still public) you wouldn't be able to walk to it unless the entrance happened to be on your land.

I think this would clearly be insanity as it would turn however many hundreds or thousands of years of convention on it's head. And to me, this is what the prosecutors are trying to argue. I understand that they probably don't really understand the technical aspects of it but to me it's really clear and their arguments sound like nonsense. But that's because we're looking at it from completely different viewpoints.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#152
post #109

Earlier quoted context omitted.

You: Can you provide me with Angela Smith's email address? Librarian: Sure, here you go. Later, Librarian's manager: You weren't supposed to give out that information! Librarian: Oops. I had the wrong access rules. Librarian's manager: Let's call the cops on that guy. It's his fault that you gave him the information he wasn't supposed to have.

Later, when I crack your bank password, Me: Can you provide me with all of guelo's money? Bank: Sure, here you go. Also, when I approach your house, Me: I have these lock picks. Will you let me in? Lock: Sure thing, boss!

> Later, when I crack your bank password, > Me: Can you provide me with all of guelo's money? > Bank: Sure, here you go.

For me this is rather a good argument against using home banking (which I indeed don't use for security reasons - and as a computer scientist I'm surely not technologically backward).

UPDATE: if money is lying around on the street you are not be allowed to keep it (the same as I should not be allowed to keep the "money lying around in the internet"), but you can claim for getting the legitimate finder's reward.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#154
post #109

Earlier quoted context omitted.

You: Can you provide me with Angela Smith's email address? Librarian: Sure, here you go. Later, Librarian's manager: You weren't supposed to give out that information! Librarian: Oops. I had the wrong access rules. Librarian's manager: Let's call the cops on that guy. It's his fault that you gave him the information he wasn't supposed to have.

Later, when I crack your bank password, Me: Can you provide me with all of guelo's money? Bank: Sure, here you go. Also, when I approach your house, Me: I have these lock picks. Will you let me in? Lock: Sure thing, boss!

My bank won't give you any money with just a password. You also have to claim to be me. That's the illegal bit.

My lock isn't authorised to give permission to anyone. Lock picks are forcing it, not requesting it.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#155

Earlier quoted context omitted.

Later, when I crack your bank password, Me: Can you provide me with all of guelo's money? Bank: Sure, here you go. Also, when I approach your house, Me: I have these lock picks. Will you let me in? Lock: Sure thing, boss!

> Later, when I crack your bank password, > Me: Can you provide me with all of guelo's money? > Bank: Sure, here you go. For me this is rather a good argument against using home banking (which I indeed don't use for security reasons - and as a computer scientist I'm surely not technologically backward). UPDATE: if money is lying around on the street you are not be allowed to keep it (the same as I should not be allow…

[deleted]

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#156
post #35

Everyone throws out analogies about walking into unlocked houses and such. Those are fairly poor analogies, so let me offer one which I think is far better at conveying what really happens. Imagine you walked into a public library and struck up a conversation with the librarian: You: Can you tell me general information about this library? Librarian: Certainly, this library was built in 1990, has a million books on it…

I challenge you to actually try to do this and see whether or not the librarian calls security.

That is actually a strength, not a weakness, of the librarian analogy. If there had been a WAF in place that alarmed when it saw Weev incrementing his way through the customers, we wouldn't be having this conversation.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#157
post #128
post #109

Earlier quoted context omitted.

You: Can you provide me with Angela Smith's email address? Librarian: Sure, here you go. Later, Librarian's manager: You weren't supposed to give out that information! Librarian: Oops. I had the wrong access rules. Librarian's manager: Let's call the cops on that guy. It's his fault that you gave him the information he wasn't supposed to have.

As is often the case, and is often ignored, the key is intent . There is a difference between: You: Can you give me the email address of user 50? Librarian: Sure, here you go Librarian: Oh balls, I wasn't supposed to hand that over, that could have been anyone! And You: Can you give me the email address of user 50? Librarian: Sure, here you go You: Hmm You-irc: Hey guise! The librarian is giving out everyones email a…

This is the issue I have with all of this. Everybody is defending HOW he did what he did with no thought as to WHAT he actually did - as if it shouldn't matter.

He knew what he was doing was illegal and didn't care, he got caught and tried to justify his actions by blaming AT&T for having a faulty configured server.

Not good enough for me and the jury agreed.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#158
post #155

Earlier quoted context omitted.

> Later, when I crack your bank password, > Me: Can you provide me with all of guelo's money? > Bank: Sure, here you go. For me this is rather a good argument against using home banking (which I indeed don't use for security reasons - and as a computer scientist I'm surely not technologically backward). UPDATE: if money is lying around on the street you are not be allowed to keep it (the same as I should not be allow…

[deleted]

http://abclocal.go.com/kabc/story?section=news/national_worl...

It happens.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#159

Earlier quoted context omitted.

Later, when I crack your bank password, Me: Can you provide me with all of guelo's money? Bank: Sure, here you go. Also, when I approach your house, Me: I have these lock picks. Will you let me in? Lock: Sure thing, boss!

> Later, when I crack your bank password, > Me: Can you provide me with all of guelo's money? > Bank: Sure, here you go. For me this is rather a good argument against using home banking (which I indeed don't use for security reasons - and as a computer scientist I'm surely not technologically backward). UPDATE: if money is lying around on the street you are not be allowed to keep it (the same as I should not be allow…

> UPDATE: if money is lying around on the street you are not be allowed to keep it (the same as I should not be allowed to keep the "money lying around in the internet"), but you can claim for getting the legitimate finder's reward.

It's actually a bit more complicated than that. Property (chattels) can be lost, mislaid, or abandoned. The distinction between lost and mislaid is that you mislay something when you intentionally put it somewhere but forget to retrieve it. That doesn't really apply to currency in the street -- it's unlikely that someone would intentionally leave money in the street.

So we are dealing with lost property. At common law the rule was that the finder of a chattel in a public place had a superior title to anyone except the true owner, and that if such a possessor knew or could reasonably ascertain the owner's identity he had a duty to notify the owner. A breach of that duty could result in either tort or criminal liability or both. In the case of fungible currency in the street, I'd say there's a good argument that it is not reasonable to ascertain the true owner.

However this common law rule has been modified in most jurisdictions by statute. Illinois has a typical such statute:

(765 ILCS 1020/27-8)

Sec. 27. If any person or persons find any lost goods, money, bank notes, or other choses in action, of any description whatever, such person or persons shall inform the owner thereof, if known, and shall make restitution of the same, without any compensation whatever, except such compensation as shall be voluntarily given on the part of the owner. If the owner is unknown and if such property found is of the value of $100 or upwards, the finder or finders shall, within 5 days after such finding file in the circuit court of the county, an affidavit of the description thereof, the time and place when and where the same was found, that no alteration has been made in the appearance thereof since the finding of the same, that the owner thereof is unknown to the affiant and that the affiant has not secreted, withheld or disposed of any part thereof. The court shall enter an order stating the value of the property found as near as the court can ascertain. A certified copy of such order and the affidavit of the finder shall, within 10 days after the order was entered, be transmitted to the county clerk to be recorded in his estray book, and filed in the office of the county clerk. ...

Sec. 28. In all cases where such lost goods, money, bank notes or other choses in action shall not exceed the sum of $100 in value and the owner thereof is unknown, the finder shall advertise the same at the court house, and if the owner does not claim such money, goods, bank notes or other choses in action within 6 months from the time of such advertisement, the ownership of such property shall vest in the finder and the court shall enter an order to that effect.

If the value thereof exceeds the sum of $100, the county clerk, within 20 days after receiving the certified copy of the court's order shall cause a notice thereof to be published for 3 weeks successively in some public newspaper printed in this county and if the owner of such goods, money, bank notes, or other choses in action does not claim the same and pay the finder's charges and expenses within one year after the advertisement thereof as aforesaid, the ownership of such property shall vest in the finder and the court shall enter an order to that effect.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#160
post #47

Earlier quoted context omitted.

Really, you are going to give people crap for bad analogies, and then try to compare the actions of a conscious human being to an automated computer system?

An automated computer system can only do what it's told. It perfectly carries out the instructions it is given. A human being can really screw everything up using their judgement and coming to the wrong conclusion. The problem here is that AT&T employed a human being to design an automated system who didn't know enough about the automated system to ensure that it was correct. And then this automated system did exactl…

The bad analogy can be extended to mechanical devices, such as a lock. The lock is also an automated system, and it is a system that will also perfectly do what it is told with even higher fidelity than a computer due to its relative simplicity.

I with my lockpick tell pin 1 to move up so many millimeters, I tell pin 2 to move up so many millimeters, and so on, and suddenly the lock opens. Suddenly I'm in, and it should be legal because the lock wasn't designed as well as it could have been and because all I did was follow a legal protocol with the lock.

Bad analogies like this are so common here when discussing technology issues, and it is a never ending irritating game of come up with the least-worst (but still bad) analogy. People here also often confuse their understanding of technology with legal/ethical sagacity, which is laughable.

Post reply on HN