Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

211–220 of 350 posts

Re: When your classmates threaten you with felony charges

#211

Earlier quoted context omitted.

This is one of those cases, like "Zero Trust Networking" where you can't derive the meaning of a term axiomatically from the individual words. There is "responsible" and "irresponsible" disclosure, too, but "responsible disclosure" is also a specific, Orwellian basket of vendor-friendly policies that have little to do with ethics or responsibility.

"Responsible" and "irresponsible" are slippier words in the disclosure context. In the civil legal context, "responsibility" implies blameworthiness and liability arising out of a duty of care and a breach of the duty. But in the vulnerability disclosure context, since there's no duty prescribed by law, it has come to mean "social" vs. "antisocial" - getting along vs. being at odds.

My point is that it doesn't matter how slippery the underlying words are, because you're not meant to piece together the meaning of the statement from those words --- or rather, you are, but deceptively, by attributing them to the policy preferences of the people who coined the term.

Logomachy aside: "ethical hacking" was a term invented by huge companies in the 1990s to co-opt security research, which was at the time largely driven by small independent firms. You didn't want to engage just anybody, the logic went, because lots of those people were secretly criminals. No, you wanted an "ethical hacker" (later: a certified ethical hacker), who you could trust not to commit crimes while working for you.

Re: When your classmates threaten you with felony charges

#212
The story has greatly reduced value without knowing who the individuals behind Fizz really are. So that we can avoid doing business with them. It would be different if Fizz was a product of a megacorporation.

“Keep calm” and “be responsible” and “speak to a lawyer” are things I class as common sense. The gold nugget I was looking for was the red flashing shipwreck bouy/marker over the names.

Re: When your classmates threaten you with felony charges

#213

Earlier quoted context omitted.

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

Everyone that is doing security research without permission, and doesn't catch charges, is just luckier (or less annoying) than weev: https://www.wired.com/2013/03/att-hacker-gets-3-years/

Re: When your classmates threaten you with felony charges

#214
post #204

Earlier quoted context omitted.

A forensics investigation is usually required by insurers. It's not an arbitrary amount of money, it's just an amount you're not happy with. I understand why you feel that way, but it's not the way the law works.

> This seems like a problem with the existing law, if that's how it works. > I understand why you feel that way, but it's not the way the law works. OP was saying they don't think the law should work that way.

Wait'll they learn about the Eggshell Skull Rule.

Re: When your classmates threaten you with felony charges

#215

> Stay calm. I can’t tell you how much I wanted to curse out the Fizz team over email. But no. We had to keep it professional — even as they resorted to legal scare tactics. Your goal when you get a legal threat is to stay out of trouble. To resolve the situation. That’s it. The temporary satisfaction of saying “fuck you” isn’t worth giving up the possibility of an amicable resolution. Maybe it's because I'm getting…

> Maybe it's because I'm getting old

Yup, that's it :) These kids are either in college or just graduated. They were smart enough to get themselves legal help before saying anything stupid, which is impressive. Cut them some slack!

Re: When your classmates threaten you with felony charges

#216

Earlier quoted context omitted.

there is a carve out in the law for 'puffery', ie exaggerations. So 'the best hamburger in town' would be puffery.

In the US?

Yup. https://www.legalmatch.com/law-library/article/puffery-laws....

If a reasonable person would understand the claim to be exaggeration (ex. World's best coffee) the law doesn't consider it false advertising.

Re: When your classmates threaten you with felony charges

#217
post #200

Earlier quoted context omitted.

> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated In a right-to-work state, what protections can an individual realistically expect to receive from a contract?

The employment of an individual that has an employment contract is governed by the strictest set of rules between the right-to-work state's laws and the employment contract. Literally every permissible provision of an employment contract can be a protection: golden parachutes, vacation days, sick days, payout of the same, IP guarantees for hobby work, employment benefits, etc. Right to work at its most generic level…

> golden parachutes

Nobody has these except top execs who are already in a huge position of power.

> vacation days, sick days, payout of the same

Nope, not anymore: nothing is guaranteed with "flexible time off". I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR. Yes, my raises are tied to this performance goal. Yes, it's probably illegal, but who cares? Nobody is ever going to do anything about it. This is every company with FTO. Who gets "paid out" for PTO anymore?

> IP guarantees for hobby work

You're joking, right? Most employment contracts claim that they own the slam poetry you write on your napkin at 2:00 am on a Saturday while high on your couch. Every mention of IP in an employment contract is as greedy as possible.

> employment benefits

Ok but in a right to work state these can be terminated any time anyway.

Literally nothing about an employment contract is ever written in favor of the actual employee. Of course it's not: they wrote it. If every company in an industry does this and they all refuse to negotiate, workers have no choice but to sign it. It's crazy to me to think that a U.S. company would voluntarily ever do anything in the interest of any of its employees, ever. This is the whole reason why ambiguities are supposed to go in favor of the party that didn't write it. Voiding any part of an employee contract can therefore only ever benefit the employee (except possibly the part where they get paid). If you want protections for employees, look to regulation and unions, not contracts written by the employer.

Re: When your classmates threaten you with felony charges

#218
post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

A friend points out that the limb EFF was out on was sturdy indeed, since DOJ has issued a policy statement saying they're not going after good-faith security research. https://www.justice.gov/opa/pr/department-justice-announces-...

I remember when the DOJ announced that and it still isn't good enough to protect security researchers by saying “we won’t prosecute, trust us”

Re: When your classmates threaten you with felony charges

#219
post #137

Earlier quoted context omitted.

It is true that leaving your door unlocked does not give burglars permission to burgle you, but how is an open door different than a closed door? Legally, I think it's also true that an open door looks more like an invitation to enter (and it's different from burglary to simply poke your head in the door, see if anything is wrong, and not breaking or taking anything) If an API is served on a public network and your c…

This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…

> You can be convicted of breaking & entering through an open door.

That does not appear to be the case in Massachusetts. Here are the jury instructions relevant to B&E in the nighttime, with the full link below:

To prove the defendant guilty of this offense, the Commonwealth must prove four things beyond a reasonable doubt:

First: That the defendant broke into someone else’s (building) (ship) (vessel) (vehicle);

Second: That the defendant entered that (building) (ship) (vessel) (vehicle);

...

To prove the first element, the Commonwealth must prove beyond a reasonable doubt that the defendant exerted physical force, however slight, and thereby removed an obstruction to gaining entry into someone else’s (building) (ship) (vessel) (vehicle). Breaking includes moving in a significant manner anything that barred the way into the (building) (ship) (vessel) (vehicle). Examples would include such things as (opening a closed door whether locked or unlocked) (opening a closed window whether locked or unlocked) (going in through an open window that is not intended for use as an entrance). On the other hand, going through an unobstructed entrance such as an open door does not constitute a breaking.

(Italicized emphasis is mine.) Entering through an open door appears to be an entering (the second element of the crime), but not a breaking (the first element). IANAL.

https://www.mass.gov/doc/8100-breaking-and-entering-a-buildi...

Re: When your classmates threaten you with felony charges

#220

Earlier quoted context omitted.

> I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". This concept of severability exists in basically all contracts, and is generally limited to sections that are not fundamental to the nature of the agreement. (The extent of what qualifies as fundamental is, as you said, up to a court to interpret.) In your specific…

> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated In a right-to-work state, what protections can an individual realistically expect to receive from a contract?

An employment contract is intended to backstop everything you were promised or negotiated during the hiring process. It doesn't really matter if you're in a right-to-work state or not, an employment contract provides you with recourse if the terms are not upheld by your employer. In the case of a breach, that is something you can remedy in court. (Whether or not it is worthwhile to pursue that legal case depends entirely on the context)

* anything you negotiated during hiring like RSU or sign-on bonuses

* stating your salary, benefits, vacation is the basis for protecting you from theft of that compensation.

* IP ownership clauses can protect your independent, off the clock work

* work location, if you are hired remote and then threatened with termination due to new RTO policies

I am just pulling from the top of my head general examples.

Post reply on HN