Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

31–40 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#31

Post by bandushrew »

derleth wrote: post #17
msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

its like walking into someone's home, that had signs up over a bunch of open doors along a wall saying 'come in, all visitors welcome'. After wandering around a bit, you notice another door in the same wall has been left open, but there is no sign. Curious - you look in.

BANG. Jail Time.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#32

Post by LargeWu »

sneak wrote: post #16
austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Weev's a right shithead, you're absolutely right. I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending: "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundr…

There's a huge gap between unpopular speech and harassment, which is illegal, and in many cases criminal. I agree he should not be in jail for the crime he was convicted of, but he almost certainly deserves to be there otherwise.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#33

Post by rpgmaker »

austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Woah, I am still against his prosecution but I don't really feel sorry for him now. Some people are just sick, why would he do that to a person for no reason?

FTA: "His rise as a folk hero is a sign of how desensitized to the abuse of women online people have become," Sierra said. "I get so angry at the tech press, the way they try to spin him as a trickster, a prankster. It’s like they feel they have to at least say he’s a jerk. Openly admitting you enjoy ‘ruining lives for lulz’ is way past being a ‘jerk’. And it wasn’t just my life. He included my kids in his work. I think he does belong in prison for crimes he has committed, but what he’s in for now is not one of those crimes. I hate supporting the Free Weev movement, but I do."

She is so much better person than I am.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#34

Post by PhasmaFelis »

sneak wrote: post #16
austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Weev's a right shithead, you're absolutely right. I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending: "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundr…

By "unpopular speech", do you mean the AT&T bit, or the harassment bit? If the latter, I disagree. A free and fair society can certainly draw a line between "unpopular speech" and "criminal harassment."

If I were to threaten to murder you, you wouldn't expect the police to say "Eh, nothing we can do, he's got a right to free speech. Call us back after he shoots you, you'll have a case then."

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#35

Post by biot »

Everyone throws out analogies about walking into unlocked houses and such. Those are fairly poor analogies, so let me offer one which I think is far better at conveying what really happens.

Imagine you walked into a public library and struck up a conversation with the librarian:

        You: Can you tell me general information about this library?
  Librarian: Certainly, this library was built in 1990, has a million
             books on its shelves, and...
        You: What are the hours?
  Librarian: Monday to Saturday, 10AM to 8PM. Sunday, 10AM to 5PM.
        You: Frothy bacon generates utilitarian synapses!
  Librarian: I'm sorry, that's not really a proper question I can help
             you with.
        You: Can I borrow book identified by ISBN 4961357406830?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 6498794651315?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 9840546790354?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 3168706780943?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 7893781056145?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 2764894617987?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 9764660911970?
  Librarian: Sure, here you go.
        You: Can I borrow book identified by ISBN 6666666666666?
  Librarian: Sorry, that book doesn't exist.
        You: Can I borrow book identified by ISBN 8669177714641?
  Librarian: Sorry, you've been requesting too many books lately.
        You: Can you let me into the Staff lounge?
  Librarian: Sorry, you'll need to show me your staff credentials when
             asking.
        You: Can you provide me with a list of all employees and their
             salaries?
  Librarian: Sorry, you are not allowed to have that information.
        You: Can I use the general conference room on the third floor?
  Librarian: Actually, that was moved. It's now on the second floor.
As you can no doubt see, these translate directly into HTTP requests:

  GET /
  200 OK - This library was built in 1990, has a million books...
  GET /hours
  200 OK - Monday to Saturday, 10AM to 8PM. Sunday, 10AM to 5PM.
  POST /frothy-bacon-generates-utilitarian-synapses
  400 BAD REQUEST
  GET /books/4961357406830
  200 OK - [contents]
  GET /books/6498794651315
  200 OK - [contents]
  GET /books/9840546790354
  200 OK - [contents]
  GET /books/3168706780943
  200 OK - [contents]
  GET /books/7893781056145
  200 OK - [contents]
  GET /books/2764894617987
  200 OK - [contents]
  GET /books/9764660911970
  200 OK - [contents]
  GET /books/6666666666666
  404 NOT FOUND
  GET /books/8669177714641
  429 TOO MANY REQUESTS
  GET /admin
  401 UNAUTHORIZED
  GET /employees/salaries
  403 FORBIDDEN
  GET /floor/3/conference
  301 MOVED; Location: /floor/2/conference
In both cases, we have a gatekeeper (librarian / web server) which is capable of responding to requests, can authorize various requests, can require credentials for sensitive requests, can limit the rate at which requests come in, can deny requests altogether, and can identify when requests for certain things have moved to new locations.

The librarian is smart enough to not hand out things like access to the staff lounge, a list of employees and their salaries, or even things like an arbitrary library member's borrowing history. The web server has been configured to not hand out things like admin access or other things which are deemed sensitive, but the owners of the web server have taken the position "Well, nobody's going to be guessing ISBN numbers, so we'll let anybody on the internet request the contents of those books."

When is the onus on the web server owner to configure their security properly? When is a "200 OK" response actually not okay? This is the "mind reader" aspect the article mentions.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#36

Post by meritt »

austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

You're missing the point. The point is the government is charging him under the CFAA and that will set an extremely dangerous precedent.

If they want to charge him under any other numerous crimes (data theft, attempted extortion, being an asshat) then I wouldn't have a problem with it either because those are things he's guilty/might-be-guilty of.

Hacking and violating the CFAA is not one of his crimes.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#37

Post by res0nat0r »

cortesoft wrote: post #19
derleth wrote: post #17

Earlier quoted context omitted.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

I don't think it is like walking into a private home because the door is unlocked... this is more like someone walking into a store, looking around, and then getting in trouble for looking at a specific display shelf that was in the back corner. The shelf wasn't labeled as off limits, you just were wondering around where you were supposed to and happen to see it. The store can't get mad and say "well yeah, but we put…

>This was a PUBLIC website... you are supposed to be able to visit it. If you make a request to a server without providing authentication and it returns data, that is not your fault. That is what you are SUPPOSED to do to servers. If it asks for authentication and tells you you are unauthorized, but you brute force the password or find an exploit, then THAT is a crime. There was not authentication in this case.

Unfortunately none of these excuses are valid. He knew he was accessing something he shouldn't have been. If he did it once or twice and stopped that is one thing, intent is a major part of the law, and he intended to exploit something he knew he should not have been. That is why he is being found guilty.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#40

Post by bcoates »

austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

That link is baffling, the first few paragraphs sound like bad things happening but they don't form any sort of coherent narrative and the link to the New York Times article is a story about someone else entirely.

It has the form of an outrage article without any actual content, as if someone fed Tumblr and Vice magazine into a Markov text generator.

Post reply on HN