331–340 of 350 posts
Earlier quoted context omitted.
You get that the legal situation for this stuff is even gnarlier in Europe, right?
Belgium legalises ethical hacking: https://www.law.kuleuven.be/citip/blog/belgium-legalises-eth... HN thread from 4 months ago: https://news.ycombinator.com/item?id=35847860
Earlier quoted context omitted.
You were talking about both but you were mistaken about the rule as well. Your focus on causation suggests you’re struggling with the idea that a second order event stemming from a breach could be compensatory damages, but of course it would fall within consequential damages if causation was found to be sufficiently attenuated.
You're just misreading the post. The "victim" doesn't calculate the damages, but a rule that makes the damages depend on actions the corporation voluntarily chooses to take allows them to vindictively maximize the penalties on someone who merely embarrassed them. Which is a perverse incentive that should be removed.
Earlier quoted context omitted.
You were talking about both but you were mistaken about the rule as well. Your focus on causation suggests you’re struggling with the idea that a second order event stemming from a breach could be compensatory damages, but of course it would fall within consequential damages if causation was found to be sufficiently attenuated.
You're just misreading the post. The "victim" doesn't calculate the damages, but a rule that makes the damages depend on actions the corporation voluntarily chooses to take allows them to vindictively maximize the penalties on someone who merely embarrassed them. Which is a perverse incentive that should be removed.
Earlier quoted context omitted.
> I've seen examples of an employee contract, with things like "if any piece of this contract is invalid it doesn't invalidate the rest of the contract". This concept of severability exists in basically all contracts, and is generally limited to sections that are not fundamental to the nature of the agreement. (The extent of what qualifies as fundamental is, as you said, up to a court to interpret.) In your specific…
> especially the ones that protect you as the individual - will remain in force even if a sub section is invalidated In a right-to-work state, what protections can an individual realistically expect to receive from a contract?
Earlier quoted context omitted.
I don’t know what to say in response to your complaints except negotiate better working conditions next time you get hired. The company wrote it. You accepted it. You can always ask for different terms and walk away if they don’t agree, start your own company, or change industries to one where companies are willing to negotiate. If you want protections for employees, sure you can (erroneously, in my opinion) look to…
> You can always ask for different terms and walk away if they don’t agree, start your own company, or change industries to one where companies are willing to negotiate. I suspect you have lived a very privileged life if you really believe these options are actually open to most employees in the U.S. Switch industries? Start your own company? Those are both extreme life-altering multi-year responses to losing PTO pay…
If my employer wants to change the terms of my employment, I absolutely would make sure I actually agreed to the changes before doing anything else. If I didn't I'd refuse to sign anything, and leave the employer with the choice to either A) fire me (under the terms of the old contract) B) leave me with the old agreement C) fire me under the new terms and get sued or D) come back with a better offer.
This is tech. There's no shortage of jobs for people with any experience whatsoever. That's leverage in not getting railed in your employment terms.
Earlier quoted context omitted.
Good analysis. I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do. The OP doesn’t seem to have a “mea culpa” so I hope they learned this lesson even if the piece is more meme-worthy with a “can you believe what these guys tried to do?” tone. While their intent seems good, they were pretty clearly breaking the law.
You may want to read this, as it explains why no mea culpa was necessary: https://www.justice.gov/opa/pr/department-justice-announces-... TL;DR: it was good faith security research, and the US DoJ doesn't prosecute that.
Personally I'd still probably not engage in unsolicited (still illegal by the letter of the law) pentesting with just the promise that the DoJ won't prosecute as long as they agree it was in good faith. But I agree that pinkie promise does make it a bit less risky.
Earlier quoted context omitted.
Not really, many professional researchers notify law enforcement when engaging in something that could be viewed as illegal or generate calls to the police. What should happen is the addition of a "reasonable" standard and using existing case law policy positions to not prosecute people who have a reasonable basis supporting their claim of security research. Instead we'll be left with the lazy lawmakers doing nothing…
I hate the use of "reasonable" in law. Who's to define what's reasonable?
Earlier quoted context omitted.
This isn't complicated. You can be convicted of breaking & entering through an open door. At trial, your defense will have to convince a jury that a reasonable person would believe they were entitled to go through the door. If the door was to, say, a Starbucks, that defense will be compelling indeed. If it is to a private home owned by strangers, you'll be convicted. I think that's roughly how it will play out in a C…
I don't think it's that simple. The prosecution will have to prove the intent to commit a crime. If it looks like a service that should require authorization, and the door is swinging wide open, I think there's a decent argument to be made that you can't prove a reasonable neighbor's intent wasn't to perform a welfare check, and with no criminal intent there is no crime of burglary. If my neighbor leaves his door ope…
Friendly amendment: Generally, the prosecution must prove only the intent to take the action that's proscribed by law (and sometimes, the intent to achieve the specific outcome of the action). Proving that the actor intended to commit a crime is usually not part of the prosecution's burden. [0]
[0] https://www.nolo.com/legal-encyclopedia/general-vs-specific-...
I'm not a lawyer, but I am professionally interested in this weird branch of the law, and it seems like EFF's staff attorney went a bit out on a limb here: * Fizz appears to be a client/server application (presumably a web app?) * The testing the researchers did was of software running on Fizz's servers * After identifying a vulnerability, the researchers created administrator accounts using the database activity the…
I presume that the "limb" the EFF attorney went on is basically what would've been disputed in a court of law. It's easily argued that if an app is so badly configured that just _following the Firebase protocol_ can give you write access to the database, you haven't actually circumvented any security measures, because _there weren't any to circumvent_. It reminds me of the case where AT&T had their iPad data subscrib…
Earlier quoted context omitted.
IANAL, but the law does not require you to "circumvent" anything[1]. Simply, anyone who "accesses a computer without authorization ... and thereby obtains ... information from any protected computer" is in violation of the CFAA. If the researchers in question did not download any customer data, nor cause any "damages", I am not sure they are guilty of anything. BUT, if they had, "the victim had insufficient security…
This is such a horrible standard. Imagine I put up a web server and only intend myself to access it. I put no security on the pages. Is Google guilty of a CFAA violation for visiting the site?