Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twin brothers wipe 96 government databases minutes after being fired

arstechnica.com

Post reply on HN
Print view View original

421–430 of 463 posts

Re: Twin brothers wipe 96 government databases minutes after being fired

#421

Post by ImPostingOnHN »

cubefox wrote: post #420
ImPostingOnHN wrote: post #397

Earlier quoted context omitted.

> Beliefs can't be "gross" of course they can, like believing that mexican people are inferior or something – gross > they can only be true or false, justified or unjustified this is incorrect > There is no such thing as a morally wrong belief this is also incorrect > That would be the confusion between fact and value. this, too, is incorrect

When you believe some belief to be "gross", this changes nothing about whether it is true or justified.

whether you personally believe some belief is "true" or "justified", changes nothing about whether it is gross

Re: Twin brothers wipe 96 government databases minutes after being fired

#422

Post by cubefox »

ImPostingOnHN wrote: post #421
cubefox wrote: post #420

Earlier quoted context omitted.

When you believe some belief to be "gross", this changes nothing about whether it is true or justified.

whether you personally believe some belief is "true" or "justified", changes nothing about whether it is gross

It also changes nothing about being true or justified. If it's "gross" according to your definition/taste that doesn't mean it's false or unjustified.

Re: Twin brothers wipe 96 government databases minutes after being fired

#423

Post by BrandoElFollito »

subscribed wrote: post #257
BrandoElFollito wrote: post #69

Earlier quoted context omitted.

And how exactly do you want to store passwords if not in plain text (and then encrypted of course)? 5k is a lot, the authorization process is broken, but this is not related to how the passwords are stored. The only solution is correct access segregation and a bastion

You don't store passwords . You store safely crafted hashes.

(I will be copy/paste this answer for the other comments)

My bad - I misread the post.

To clear things up: I am completely aware about how to store passwords in services that check against them. You are likely to have read some of my prose on that topic in OWASP or at a conference :)

My point, after misreading the article, was that in order to authenticate to a service (the one that holds the hashed version of that password) you need to have access to its cleartext version. This is VERY bad, should never be stored without special considerations etc.

I read the articlae as if they accessed the source of the passwords, the one used to access to services (a vault, with its encryption, access restrictions etc.). 5k was a lot but that could have been bearers or similar ones.

So my comment, and the comments to it, actually yelled at me (that's good!) the way I yell at actual implemententions sometimes :)

In all seriousness - thanks for the reaction, we need more of these. My next obsession are servies that require "only digits" or "strictly 8 to 11 chars" for credentials :)

Re: Twin brothers wipe 96 government databases minutes after being fired

#424

Post by BrandoElFollito »

jjk7 wrote: post #78
BrandoElFollito wrote: post #69

Earlier quoted context omitted.

And how exactly do you want to store passwords if not in plain text (and then encrypted of course)? 5k is a lot, the authorization process is broken, but this is not related to how the passwords are stored. The only solution is correct access segregation and a bastion

Assuming you're serious? Store passwords with salted one-way hashes.

(I will be copy/paste this answer for the other comments)

My bad - I misread the post.

To clear things up: I am completely aware about how to store passwords in services that check against them. You are likely to have read some of my prose on that topic in OWASP or at a conference :)

My point, after misreading the article, was that in order to authenticate to a service (the one that holds the hashed version of that password) you need to have access to its cleartext version. This is VERY bad, should never be stored without special considerations etc.

I read the articlae as if they accessed the source of the passwords, the one used to access to services (a vault, with its encryption, access restrictions etc.). 5k was a lot but that could have been bearers or similar ones.

So my comment, and the comments to it, actually yelled at me (that's good!) the way I yell at actual implemententions sometimes :)

In all seriousness - thanks for the reaction, we need more of these. My next obsession are servies that require "only digits" or "strictly 8 to 11 chars" for credentials :)

Re: Twin brothers wipe 96 government databases minutes after being fired

#425

Post by BrandoElFollito »

kjs3 wrote: post #139
BrandoElFollito wrote: post #69

Earlier quoted context omitted.

And how exactly do you want to store passwords if not in plain text (and then encrypted of course)? 5k is a lot, the authorization process is broken, but this is not related to how the passwords are stored. The only solution is correct access segregation and a bastion

I don't think those words mean what you think they mean.

(I will be copy/paste this answer for the other comments)

My bad - I misread the post.

To clear things up: I am completely aware about how to store passwords in services that check against them. You are likely to have read some of my prose on that topic in OWASP or at a conference :)

My point, after misreading the article, was that in order to authenticate to a service (the one that holds the hashed version of that password) you need to have access to its cleartext version. This is VERY bad, should never be stored without special considerations etc.

I read the articlae as if they accessed the source of the passwords, the one used to access to services (a vault, with its encryption, access restrictions etc.). 5k was a lot but that could have been bearers or similar ones.

So my comment, and the comments to it, actually yelled at me (that's good!) the way I yell at actual implemententions sometimes :)

In all seriousness - thanks for the reaction, we need more of these. My next obsession are servies that require "only digits" or "strictly 8 to 11 chars" for credentials :)

Re: Twin brothers wipe 96 government databases minutes after being fired

#426

Post by kaycey2022 »

game_the0ry wrote: post #41
chatmasta wrote: post #6

> At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” This article is hilarious. The two bickering brothers remind me of the guys in the Oceans movies played by Casey Affleck and Scott Caan. It’s amazing they got this close to sensitive data.

> At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?” So many red flags, I can't even.

Those are not red flags. Those are the actual thing. I think red flag is a heuristic that warns you about a course of action.

Re: Twin brothers wipe 96 government databases minutes after being fired

#428

Post by [deleted] »

latexr wrote: post #365
r3trohack3r wrote: post #153

Earlier quoted context omitted.

Murder by computer keyboard: https://www.deseret.com/1997/7/6/19322063/mother-charged-wit... Murder by ethernet cable: https://www.gainesvilletimes.com/news/dead-woman-found-in-pa... Murder by laptop: https://www.riverfronttimes.com/william-lynn-gunter-sentence... Murder by cellphone charger: https://lawandcrime.com/crime/pennsylvania-man-admits-to-str... Murder by desk lamp: https://www.pressdemocrat.com/2009/01/08/…

The fact that you had to find an article from three decades ago for an instance of killing with a keyboard is telling. All the others aren’t exactly that recent and are mostly isolated cases. Meanwhile, on gun related deaths, there are entire Wikipedia pages for it: https://en.wikipedia.org/wiki/List_of_countries_by_firearm-r... https://en.wikipedia.org/wiki/Lists_of_mass_shootings_in_the... There are more mass shoot…

[deleted]

Re: Twin brothers wipe 96 government databases minutes after being fired

#429

Post by wahnfrieden »

pretzel5297 wrote: post #297
soVeryTired wrote: post #44

> On March 12, 2025, a search warrant was executed at Sohaib’s home in Alexandria. Agents grabbed plenty of tech gear but also turned up seven firearms and 370 rounds of .30 caliber ammunition. Given his former crimes, Sohaib should have had none of this. For god's sake, don't commit crimes while you're committing crimes.

> Given his former crimes, Sohaib should have had none of this. Nobody should have a personal armory.

Why

Re: Twin brothers wipe 96 government databases minutes after being fired

#430

Post by kjs3 »

BrandoElFollito wrote: post #425
kjs3 wrote: post #139

Earlier quoted context omitted.

I don't think those words mean what you think they mean.

(I will be copy/paste this answer for the other comments) My bad - I misread the post. To clear things up: I am completely aware about how to store passwords in services that check against them . You are likely to have read some of my prose on that topic in OWASP or at a conference :) My point, after misreading the article, was that in order to authenticate to a service (the one that holds the hashed version of that…

You should have stuck with the 'My bad...' and left out the eye-roll inducing humble brags and inscrutable non-clarifications. But what do I know...I've only been an infosec practitioner since the early 90s...I'm sure 'conference experience' trumps that.

(I will not 'be copy/paste' (?) this response everywhere you spammed someone who pointed out the glaringly obvious)

Post reply on HN