Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

221–230 of 350 posts

Re: When your classmates threaten you with felony charges

#221

Post by asynchronous »

Buttons840 wrote: post #159
lamontcg wrote: post #97

Earlier quoted context omitted.

The problem is that it is still entirely illegal to do this kind of hacking without any permission. The fact that a lot of companies have embraced bug bounties and encourage this kind of stuff against them unfortunately teaches "kids" that this kind of thing is perfectly legal/moral/ethical/etc. As this story shows though you're really rolling the dice, even though it worked out in this case. > Discussions in forums…

Yeah, when it comes to cyber-security, we put our national security at risk so companies can avoid being embarrassed. (See my rant in another comment.)

As much as I hate using regulation as a hammer to fix things, if we did make software companies legally required to a level of security, then vulnerability testing like this could be prosecuted similar to SEC or OSHA violations and would work quite nicely

Re: When your classmates threaten you with felony charges

#222

Post by [deleted] »

feoren wrote: post #217
abduhl wrote: post #200

Earlier quoted context omitted.

The employment of an individual that has an employment contract is governed by the strictest set of rules between the right-to-work state's laws and the employment contract. Literally every permissible provision of an employment contract can be a protection: golden parachutes, vacation days, sick days, payout of the same, IP guarantees for hobby work, employment benefits, etc. Right to work at its most generic level…

> golden parachutes Nobody has these except top execs who are already in a huge position of power. > vacation days, sick days, payout of the same Nope, not anymore: nothing is guaranteed with "flexible time off". I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR. Yes, my raises are tied to this performance goal. Yes, it's probably illegal, but who cares? Nobody is eve…

[deleted]

Re: When your classmates threaten you with felony charges

#223

Post by valbaca »

dundarious wrote: post #21
seiferteric wrote: post #3

How can you legally threaten someone and not face consequences, but if you threaten someone with physical violence you can go to jail?

Your sentiment is silly. In general, with important caveats I will not state here, you can of course voice a threat to do an action that is legal (file a lawsuit), and may not voice a threat to do an action that is illegal (physical assault).

If it's a threat, then that's literally blackmail.

It's only legal to use the legal action, period. Once you pull in a THREAT, it becomes blackmail/extortion.

Re: When your classmates threaten you with felony charges

#224

Post by [deleted] »

abduhl wrote: post #200
Buttons840 wrote: post #151

Earlier quoted context omitted.

> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated In a right-to-work state, what protections can an individual realistically expect to receive from a contract?

The employment of an individual that has an employment contract is governed by the strictest set of rules between the right-to-work state's laws and the employment contract. Literally every permissible provision of an employment contract can be a protection: golden parachutes, vacation days, sick days, payout of the same, IP guarantees for hobby work, employment benefits, etc. Right to work at its most generic level…

[deleted]

Re: When your classmates threaten you with felony charges

#226

Post by valbaca »

gruez wrote: post #19
seiferteric wrote: post #3

How can you legally threaten someone and not face consequences, but if you threaten someone with physical violence you can go to jail?

IANAL, but: 1. threatening violence is explicitly a crime 2. at a higher level, threatening violence is a crime because the underlying act (committing violence) is also a crime. threatening to do a legal act is largely legal. it's not illegal to threaten reporting to the authorities, for instance.

> threatening to do a legal act is largely legal. it's not illegal to threaten reporting to the authorities, for instance.

It absolutely can be illegal, in the case of extortion. If you say "do this or I turn you in" that's extortion.

Re: When your classmates threaten you with felony charges

#227

Post by utexaspunk »

dahfizz wrote: post #117
emilecantin wrote: post #94

Earlier quoted context omitted.

I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

What about just trying the doorknob to see if it's locked. Is that illegal?

Re: When your classmates threaten you with felony charges

#228

Post by nephanth »

jrockway wrote: post #128
dahfizz wrote: post #117

Earlier quoted context omitted.

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

That's my understanding of the law. Even the "merge this PR without review using your administrator privileges" is potentially a crime if the company policy doesn't allow you to take that action. Basically, what the code does or intends is not a factor at all, only the potentially-implicit authorization policy controls. If I tell you "the password on the postgres account at postgres.jrock.us is blahblah42" and you re…

I will not take out cash in public transport because I don't want to be pickpocketed

Now, does that mean that if I did, you'd have the right to pickpocket me?

Re: When your classmates threaten you with felony charges

#229

Post by whimsicalism »

Ajedi32 wrote: post #203
tptacek wrote: post #139

Earlier quoted context omitted.

A friend points out that the limb EFF was out on was sturdy indeed, since DOJ has issued a policy statement saying they're not going after good-faith security research. https://www.justice.gov/opa/pr/department-justice-announces-...

To me that reads less as "this is legal" and more as "this is illegal, but we (the executive branch of the government) will be nice and not go after you for it as long as we think you're a good guy". That's (arguably) better than nothing, but not exactly an ideal way to structure our justice system in my opinion.

You aren’t a lawyer, right?

Re: When your classmates threaten you with felony charges

#230

Post by whimsicalism »

tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

All that matters is whether it’s a prosecutable charge
Post reply on HN