Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

241–250 of 350 posts

Re: When your classmates threaten you with felony charges

#241

Post by giantg2 »

deepsun wrote: post #208
Ajedi32 wrote: post #203

Earlier quoted context omitted.

To me that reads less as "this is legal" and more as "this is illegal, but we (the executive branch of the government) will be nice and not go after you for it as long as we think you're a good guy". That's (arguably) better than nothing, but not exactly an ideal way to structure our justice system in my opinion.

Yes, but I don't see a better solution. If we make "security research" legal, then any hacker can just say "oh I was just going to disclose my findings to them".

Not really, many professional researchers notify law enforcement when engaging in something that could be viewed as illegal or generate calls to the police.

What should happen is the addition of a "reasonable" standard and using existing case law policy positions to not prosecute people who have a reasonable basis supporting their claim of security research.

Instead we'll be left with the lazy lawmakers doing nothing and the executive saying they'll prosecute only the people who "deserve" it.

Re: When your classmates threaten you with felony charges

#242

Post by dahfizz »

supermatt wrote: post #237
dahfizz wrote: post #117

Earlier quoted context omitted.

IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…

> accesses a computer without authorization They were authorized, as per the permissions that fizz gave users of the app on firebase. A group of users noticed that it was overly permissive and reported it to them. > Leaving your door unlocked does not give burglars permission to burgle you. This is more like giving your stuff away and then reporting it as theft.

It's nothing like that. Fizz did not want these people making admin accounts on their server. That's the bottom line. They failed to prevent it (forgot to lock their door), but in no way did they actively "give their stuff away". No judge would see it that way.

Re: When your classmates threaten you with felony charges

#243

Post by seanw444 »

giantg2 wrote: post #241
deepsun wrote: post #208

Earlier quoted context omitted.

Yes, but I don't see a better solution. If we make "security research" legal, then any hacker can just say "oh I was just going to disclose my findings to them".

Not really, many professional researchers notify law enforcement when engaging in something that could be viewed as illegal or generate calls to the police. What should happen is the addition of a "reasonable" standard and using existing case law policy positions to not prosecute people who have a reasonable basis supporting their claim of security research. Instead we'll be left with the lazy lawmakers doing nothing…

I hate the use of "reasonable" in law. Who's to define what's reasonable?

Re: When your classmates threaten you with felony charges

#244

Post by _dain_ »

feoren wrote: post #217
abduhl wrote: post #200

Earlier quoted context omitted.

The employment of an individual that has an employment contract is governed by the strictest set of rules between the right-to-work state's laws and the employment contract. Literally every permissible provision of an employment contract can be a protection: golden parachutes, vacation days, sick days, payout of the same, IP guarantees for hobby work, employment benefits, etc. Right to work at its most generic level…

> golden parachutes Nobody has these except top execs who are already in a huge position of power. > vacation days, sick days, payout of the same Nope, not anymore: nothing is guaranteed with "flexible time off". I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR. Yes, my raises are tied to this performance goal. Yes, it's probably illegal, but who cares? Nobody is eve…

> I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR.

why not get another job?

Re: When your classmates threaten you with felony charges

#245

Post by meepmorp »

pc86 wrote: post #122
winter_blue wrote: post #83

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect th…

"To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.

Well, at that point, the legal threats stop being baseless. Problem solved!

Re: When your classmates threaten you with felony charges

#246

Post by feoren »

_dain_ wrote: post #244
feoren wrote: post #217

Earlier quoted context omitted.

> golden parachutes Nobody has these except top execs who are already in a huge position of power. > vacation days, sick days, payout of the same Nope, not anymore: nothing is guaranteed with "flexible time off". I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR. Yes, my raises are tied to this performance goal. Yes, it's probably illegal, but who cares? Nobody is eve…

> I literally cannot meet my performance goal if I take more than 1 day of sick/vacation day PER YEAR. why not get another job?

Because for all the bullshit I have to put up with, and all the things I hate about management, and all the things that could easily be better but for one asshole vice-president needing to cosplay Business Hero ... for all of that, the job is deeply interesting and I learn a ton every day. And virtually every other job on the market is mind-numbingly boring and pointless.

And because I like my immediate teammates a lot.

And because the issues I'm railing against are incredibly pervasive in most companies in the United States and probably beyond. Our capitalism has been completely taken over by a caste of parasitic leeches who enshittify everything they touch and I am under no illusion that any other job would be any different.

But I do also look for other jobs regularly. Finding a job that is both interesting (<1%) and not full of shithead management (<5%) is about 1 in 2,000.

Re: When your classmates threaten you with felony charges

#247

Post by [deleted] »

deepsun wrote: post #208
Ajedi32 wrote: post #203

Earlier quoted context omitted.

To me that reads less as "this is legal" and more as "this is illegal, but we (the executive branch of the government) will be nice and not go after you for it as long as we think you're a good guy". That's (arguably) better than nothing, but not exactly an ideal way to structure our justice system in my opinion.

Yes, but I don't see a better solution. If we make "security research" legal, then any hacker can just say "oh I was just going to disclose my findings to them".

[deleted]

Re: When your classmates threaten you with felony charges

#248

Post by philistine »

deepsun wrote: post #208
Ajedi32 wrote: post #203

Earlier quoted context omitted.

To me that reads less as "this is legal" and more as "this is illegal, but we (the executive branch of the government) will be nice and not go after you for it as long as we think you're a good guy". That's (arguably) better than nothing, but not exactly an ideal way to structure our justice system in my opinion.

Yes, but I don't see a better solution. If we make "security research" legal, then any hacker can just say "oh I was just going to disclose my findings to them".

Here’s a better solution: change the laws!

Knowing the audience of this forum, you’re probably American and under 35. You have lived your whole life with an inoperable legislator. The US Congress, through a mixture of time-honored traditions with unfathomable externalities (there can never be more than this amount of representatives) and disinterested sports-like politics, is unable to print new laws in a reactive fashion. This means that kludges, with their own unfathomable externalities, look like sane solutions. They’re not. A functioning democracy would set up a legal framework for ethical research.

Re: When your classmates threaten you with felony charges

#249

Post by ZoomerCretin »

whimsicalism wrote: post #229
Ajedi32 wrote: post #203

Earlier quoted context omitted.

To me that reads less as "this is legal" and more as "this is illegal, but we (the executive branch of the government) will be nice and not go after you for it as long as we think you're a good guy". That's (arguably) better than nothing, but not exactly an ideal way to structure our justice system in my opinion.

You aren’t a lawyer, right?

Laws are written by legislators, not the Department of Justice. An administrative decision by the executive branch does not change that fact. Accessing a computer system without explicit authorization or "hacking" is a federal crime. If you "hack", you can be charged with a felony for doing so at the discretion of federal prosecutors. The law isn't some magical too-incomprehensible-for-mortals text requiring magicians and soothsayers to interpret _literally_ every single clause and statement for you. As an adult citizen of a country (with an IQ above room temperature), you should be able to correctly interpret statements like the above, as was done by the person to whom you replied.

Re: When your classmates threaten you with felony charges

#250

Post by Buttons840 »

asynchronous wrote: post #221
Buttons840 wrote: post #159

Earlier quoted context omitted.

Yeah, when it comes to cyber-security, we put our national security at risk so companies can avoid being embarrassed. (See my rant in another comment.)

As much as I hate using regulation as a hammer to fix things, if we did make software companies legally required to a level of security, then vulnerability testing like this could be prosecuted similar to SEC or OSHA violations and would work quite nicely

Protecting white-hat hackers could be seen as a reduction in "regulation", since it permits the good guys to do good things. It allows people to do more, but some people will be not be legally shielded from embarrassment and accountability anymore.

In the current status quo, everyone except the good guys gets free reign: companies can stop legal scrutiny of their security, black-hats run wild and answer to no one, and the white-hats wring their hands "please sir, may I check for myself that the services I depend on are secure?" to which the companies respond "ha ha, no, but trust us, it's secure."

Post reply on HN