Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your classmates threaten you with felony charges

miles.land

Post reply on HN
Print view View original

281–290 of 350 posts

Re: When your classmates threaten you with felony charges

#281

Post by gnicholas »

utopcell wrote: post #273

Given the aggressive response from this company, it is less likely that it will become the target of any security researchers in the future (who wants the hassle ?). That by itself makes their app less secure in the long term. Also, who'd want to support founders with this "I will destroy you!, even though you helped me improve my system" mentality ? I wouldn't be surprised if this startup dies off from this info. Ku…

Alternatively, it will attract the attention of less-noble researchers who won't bother with responsible disclosure rules — they'll just leak data or tinker with the system. But I agree that well-intentioned security researchers will be less likely to look into this platform.

Re: When your classmates threaten you with felony charges

#282

Post by singleshot_ »

buttercraft wrote: post #251
seanw444 wrote: post #243

Earlier quoted context omitted.

I hate the use of "reasonable" in law. Who's to define what's reasonable?

Judges and juries

You are right, but there is more to it.

Judges typically consider matters of law. Usually “reasonable” is a cue that you are discussing a matter of fact, which is the province of the jury.

Sometimes you will have something called a bench trial, where it is agreed that the judge will also serve the role of the fact finder, and there will be no jury.

Re: When your classmates threaten you with felony charges

#283

Post by otterley »

tptacek wrote: post #211
otterley wrote: post #201

Earlier quoted context omitted.

"Responsible" and "irresponsible" are slippier words in the disclosure context. In the civil legal context, "responsibility" implies blameworthiness and liability arising out of a duty of care and a breach of the duty. But in the vulnerability disclosure context, since there's no duty prescribed by law, it has come to mean "social" vs. "antisocial" - getting along vs. being at odds.

My point is that it doesn't matter how slippery the underlying words are, because you're not meant to piece together the meaning of the statement from those words --- or rather, you are, but deceptively, by attributing them to the policy preferences of the people who coined the term. Logomachy aside: "ethical hacking" was a term invented by huge companies in the 1990s to co-opt security research, which was at the tim…

I guess what I'm trying to say is that there is, and can be, such a thing as "ethical hacking," but perhaps it's not coterminous what vendors and others might claim it to be. The meanings of words evolve over time, sometimes for the worse (cough "literally"), and sometimes for the better. Groups have also reclaimed derogatory words through concerted action.

Re: When your classmates threaten you with felony charges

#284

Post by adolph »

bawolff wrote: post #258
adolph wrote: post #181

Earlier quoted context omitted.

Did you check with the target before you "checked whether we could set `isAdmin` to `true` on our existing accounts?" If you did not get consent from a subject, you are not a researcher. If you see a door and check to see if it is unlocked without its owner authorizing you to do so, you are on the ethical side of burglary even if you didn't burgle. Helpfully the "technical writeup" post links to "industry best practi…

I disagree with this take. There are certainly lines of what is and is not ethical behaviour (where they are is highly debatable), but the vendor doesn't have a monopoly on deciding that.

The ostensible researchers didn’t follow the ethos to which they claimed and linked. Do you disagree with that?

Re: When your classmates threaten you with felony charges

#285

Post by singleshot_ »

AnthonyMouse wrote: post #123
tptacek wrote: post #57

I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…

> this is subtle: you can easily rack up 5-6 figure damage numbers from unauthorized security research, but Fizz was so small and new that I'm assuming nobody even contemplating retaining a forensics firm or truing things up with their insurers, who probably did not exist This seems like a problem with the existing law, if that's how it works. It puts the amount of "damages" in the hands of the "victim" who can choos…

Strange things happen every day but in my experience the jury decides on the damages, not the plaintiff.

Re: When your classmates threaten you with felony charges

#287

Post by dmvdoug »

dannyphantom wrote: post #252
seanw444 wrote: post #243

Earlier quoted context omitted.

I hate the use of "reasonable" in law. Who's to define what's reasonable?

That's fair. The use of "reasonable" in generally used to qualify some standard of behavior or conduct that is expected from individuals in specific situations. Because "reasonable" is inherently subjective, the responsibility for making the determination is (generally) passed over to a jury who will weigh what the prosecution and defense have presented which entails previous cases, the specific fact pattern of the c…

I don’t think you’re viewing it quite correctly. Reasonableness standards usually exist in order to funnel legal compulsion into a narrower range than would exist without them. It can bracket out behavior that to the average, ordinary, everyday member of that particular community would be extreme on one end or the other. You generally don’t want the law to require people to behave in extraordinarily heroic or extraordinarily cautious ways compared to how an ordinary person under similar circumstances would act. And “ordinary” here is also context-sensitive. What’s reasonable for an ordinary teenager may be extremely impulsive or foolish for an ordinary adult. Or what’s reasonable for an ordinary expert in a field may be wildly dangerous, say, for an ordinary layman.

All that said, though, reasonableness standards exist all over the law and don’t all necessarily serve the same purpose or function exactly in the same way, when you get into the weeds.

Re: When your classmates threaten you with felony charges

#288

Post by lightedman »

Those classmates committed felony extortion with their threat, just as an aside.

That would've been a better legal threat to put on them as a offensive move, instead of using the EFF. "Sure you can attempt to have me jailed but your threat is clear-cut felony extortion. See you in the jail cell right there with me!"

Re: When your classmates threaten you with felony charges

#289

Post by pie_flavor »

davesque wrote: post #276

I think I might be a bit of an outlier on this, but I struggle to see the value of imposing an embargo date in a security disclosure unless it's sent to a large institution that is used to a formal process like that. In most cases, if you're trying to communicate to someone that you've found a vulnerability under the pretense that you're doing it for the greater good, why begin by the relationship with a deadline bef…

It doesn't give them any wiggle room to lead you on, it doesn't give you any wiggle room to say 'unacceptable or I blow the whistle tomorrow', it removes your judgement of the situation from the disclosure entirely. It is the safest option for people who are great at finding things worth disclosing but not so great at situation-judging.

It's not about personal branding, it's about protecting the users of the app. Either the app fixes the vulnerability so the users are no longer in danger, or the users are made aware that they are in danger.

Re: When your classmates threaten you with felony charges

#290

Post by dmvdoug »

singleshot_ wrote: post #282
buttercraft wrote: post #251

Earlier quoted context omitted.

Judges and juries

You are right, but there is more to it. Judges typically consider matters of law. Usually “reasonable” is a cue that you are discussing a matter of fact, which is the province of the jury. Sometimes you will have something called a bench trial, where it is agreed that the judge will also serve the role of the fact finder, and there will be no jury.

> Usually “reasonable” is a cue that you are discussing a matter of fact, which is the province of the jury.

And then there are motions for a JMOL (see FRCP 50), where a judge has to decide whether a “reasonable jury” could have a legally sufficient basis to find in favor of a party.

Law as the verkehrte Welt of itself. :)

Post reply on HN