Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

191–200 of 350 posts

Re: When your classmates threaten you with felony charges

#191

Post by Jka9rhnDJos »

theptip wrote: post #112
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.

> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do.

Because bug bounties?

Re: When your classmates threaten you with felony charges

#192

Post by doctorpangloss »

tptacek wrote: post #139
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

A friend points out that the limb EFF was out on was sturdy indeed, since DOJ has issued a policy statement saying they're not going after good-faith security research. https://www.justice.gov/opa/pr/department-justice-announces-...

So then you’d concede that all that’s left is these Fizzbuzz people are liars and are bad people, and that their product is crap and should not be used, and you don’t need to have personally used the app nor met them personally to know any of that, since it’s all clear from their extremely obnoxious, self destructive conduct, and that that’s just an opinion and not a forecast on whether or not their useless investors will get a return?

Re: When your classmates threaten you with felony charges

#193

Post by tptacek »

otterley wrote: post #190
tptacek wrote: post #63

Earlier quoted context omitted.

(a) There's no such thing as "ethical hacking" (that's an Orwellian term designed to imply that testing conducted in ways unfavorable to vendors is "unethical"). (b) You don't require permission to test software running on hardware you control (absent some contract that says otherwise). (c) But you're right, in this case, the researchers presumably did need permission to conduct this kind of testing lawfully.

I disagree with (a). Activities can be deemed ethical or unethical, and those norms are presumably reflected in our laws (as unauthorized hacking is). When they're not constrained by law (as certain publication and experimentation practices aren't), then they are constrained by social convention.

This is one of those cases, like "Zero Trust Networking" where you can't derive the meaning of a term axiomatically from the individual words. There is "responsible" and "irresponsible" disclosure, too, but "responsible disclosure" is also a specific, Orwellian basket of vendor-friendly policies that have little to do with ethics or responsibility.

Re: When your classmates threaten you with felony charges

#195

Post by tptacek »

doctorpangloss wrote: post #192
tptacek wrote: post #139

Earlier quoted context omitted.

A friend points out that the limb EFF was out on was sturdy indeed, since DOJ has issued a policy statement saying they're not going after good-faith security research. https://www.justice.gov/opa/pr/department-justice-announces-...

So then you’d concede that all that’s left is these Fizzbuzz people are liars and are bad people, and that their product is crap and should not be used, and you don’t need to have personally used the app nor met them personally to know any of that, since it’s all clear from their extremely obnoxious, self destructive conduct, and that that’s just an opinion and not a forecast on whether or not their useless investors…

Perhaps you missed this line from my original comment:

I think the good guys prevailed here.

Re: When your classmates threaten you with felony charges

#196

Post by manicennui »

sleepybrett wrote: post #145
manicennui wrote: post #90

Earlier quoted context omitted.

I don't think the demands of Fizz have much legal standing. We care more about corporations than citizens in the US. Advertising in the US is full of false claims. We ignore this because we pretend like words have no meaning.

there is a carve out in the law for 'puffery', ie exaggerations. So 'the best hamburger in town' would be puffery.

In the US?

Re: When your classmates threaten you with felony charges

#197

Post by gsdofthewoods »

tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

Good analysis. One important caveat is that, while this may technically have been a CFAA violation, it's almost certainly not one the Department of Justice would prosecute.

Last year, the department updated its CFAA charging policy to not pursue charges against people engaged in "good-faith security research." [1] The CFAA is famously over-broad, so a DOJ policy is nowhere near as good as amending the law to make the legality of security research even clearer. Also, this policy could change under a new administration, so it's still risky—just less risky than it was before they formalized this policy.

[1] https://www.justice.gov/opa/pr/department-justice-announces-...

Re: When your classmates threaten you with felony charges

#198

Post by yebyen »

tptacek wrote: post #164
yebyen wrote: post #158

Earlier quoted context omitted.

I don't think it's that simple. The prosecution will have to prove the intent to commit a crime. If it looks like a service that should require authorization, and the door is swinging wide open, I think there's a decent argument to be made that you can't prove a reasonable neighbor's intent wasn't to perform a welfare check, and with no criminal intent there is no crime of burglary. If my neighbor leaves his door ope…

The crime in this case is accessing software running on someone else's computer without their authorization. The "someone else" in this case vehemently objects to the access at issue. The burden of proof is on the prosecution, but their argument is compelling enough that it's the defendant who'd have to do the explaining. No: you will not get convicted checking on your neighbor. Everybody involved in that fact patter…

> Now change the fact pattern slightly: you're not a neighbor at all, but rather some random person walking

It's times like these I regret that neighbors don't talk to each other anymore. How can we even have functioning internet if we don't have network neighborhood...

Re: When your classmates threaten you with felony charges

#199

Post by pseg134 »

seiferteric wrote: post #80
gruez wrote: post #61

Earlier quoted context omitted.

>If we lived in a world where lawyers were more cautions about what they attached there name to out of concern for losing their license we would probably be better off. That's already the case. Lawyers can be disbarred for filing frivolous lawsuits.

I'm aware, and yet this letter was written and signed by a lawyer who probably knew better and will likely face no consequences.

You seem to have the facts of this case incorrect. They definitely broke the law by hacking this app without prior authorization. You may disagree with the law but I don’t understand how you made the leap to calling for the suspension of specific attorneys.

Re: When your classmates threaten you with felony charges

#200

Post by abduhl »

Buttons840 wrote: post #151
mentalpiracy wrote: post #78

Earlier quoted context omitted.

> I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". This concept of severability exists in basically all contracts, and is generally limited to sections that are not fundamental to the nature of the agreement. (The extent of what qualifies as fundamental is, as you said, up to a court to interpret.) In your specific…

> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated In a right-to-work state, what protections can an individual realistically expect to receive from a contract?

The employment of an individual that has an employment contract is governed by the strictest set of rules between the right-to-work state's laws and the employment contract. Literally every permissible provision of an employment contract can be a protection: golden parachutes, vacation days, sick days, payout of the same, IP guarantees for hobby work, employment benefits, etc.

Right to work at its most generic level means freedom from being forced into a union, not freedom from being held to a contract.

Post reply on HN