Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

blog.phpfog.com

Post reply on HN
Print view View original

81–90 of 202 posts

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#81

Post by parfe »

dolinsky wrote: post #57
sriramk wrote: post #4

I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning. I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up…

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things.

PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading that article because it used the word blowjob."

I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame.

My dog shits in the house and it's my fault for not walking him sooner. If some children compromise every level of your company then getting mad at them is only trying to deflect the blame. PHPFog is the only responsible party in this mess. I feel for the customers who still trust them.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#82

Post by tptacek »

burrows wrote: post #65
jpadvo wrote: post #18

Earlier quoted context omitted.

Lucas and his team are amazing. Everyone makes mistakes, and no system will be perfectly secure. So in my mind the best parts of the entire post were these: "We have hired professional white hat hackers with government level security experience to attempt regular pen tests on our system, both as regular users as well as giving them special access and seeing if they can get through." and "If you find a security flaw a…

Hiring white hat hackers is a joke. They are the ultimate in hacks. Step 1. Open up Metasploit Step 2. Button Mash. ???? Step 3. Profit

I downvoted this too, but wish I hadn't. He has a point.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#83

Post by nbpoole »

parfe wrote: post #81
dolinsky wrote: post #57

Earlier quoted context omitted.

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

"PHPFog built a castle out of sand and you're upset that a wave came and demolished it."

Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own.

"I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame."

While some HN posters might feel the the 16 year olds involved in this incident have the same mental capacity as your dog, I'd like to give them slightly more credit. ;)

I can only speak for myself here, but I do think the people involved in compromising PHP Fog should be punished. No, I don't think they should get life in prison (): I hope they can learn from their mistakes. However, they did commit a crime, as they've admitted both here and elsewhere online. They should be capable of understanding that their actions have consequences, so I think some consequences are in order. What those consequences should be is up to PHP Fog.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#84

Post by tptacek »

nbpoole wrote: post #37
citricsquid wrote: post #13

I mentioned this last time, but I don't think anyone was interested, but the "John" guy is compwhizii (same handle on Twitter) who runs the forums (facepunch.com) for garrysmod, a very popular game. I will be curious to see how garry (owner person) responds to this, or if he already has. Elliot is apparently VERY scared and blames John (compwhizii) (edit: not john, he blames someone else called supersnail1): http://w…

And here's Elliot's "official statement": http://elliotspeck.com/phpfog.html And for anyone who missed it, here's what Elliot posted in the previous HN discussion about the phpFog breach: http://news.ycombinator.com/item?id=2346161

Before I realized he'd posted those comments 2 days ago, I seriously considered trying to track down his parents. Do you think they even know? Their kid is arguing with people on message boards about a breach. And not arguing "I didn't do it". Crazy.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#85

Post by stanleydrew »

tptacek wrote: post #82
burrows wrote: post #65

Earlier quoted context omitted.

Hiring white hat hackers is a joke. They are the ultimate in hacks. Step 1. Open up Metasploit Step 2. Button Mash. ???? Step 3. Profit

I downvoted this too, but wish I hadn't. He has a point.

He could have made his point in a more intelligent way.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#86

Post by tptacek »

stanleydrew wrote: post #85
tptacek wrote: post #82

Earlier quoted context omitted.

I downvoted this too, but wish I hadn't. He has a point.

He could have made his point in a more intelligent way.

Just, do be aware that there are a lot of people that fit the description he gave; they are particularly numerous among the people who use the words "white hat" or "hacker" (with any modifier) in their services.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#87

Post by dolinsky »

parfe wrote: post #81
dolinsky wrote: post #57

Earlier quoted context omitted.

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

I'm sorry, but in between your Straw Man argument and your indirect Ad Hominem attack, I fail to see you address the point that these kids caused harm to a business. Nowhere did I say that PHPFog bears no responsibility for the security of their service, but that doesn't excuse what these kids did one bit. I'm just much more impressed with the way that PHPFog is handling their business after the fact than these kids are. Nowhere did I suggest that these kids lives should be destroyed, however I do believe they most definitely need to be held accountable for their actions. PHPFog will be held accountable for their actions by whether or not businesses decide to do business with them going forward.

Both parties bear responsibility, and it's absurd to think otherwise.

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#88

Post by [deleted] »

CGamesPlay wrote: post #69
eel wrote: post #68

I am bothered by some of the language in this post: - we were aware of the potential security threat behind post-deploy hooks and were about to disable them [...] but... - we were days away from replacing this server - They were a short-term stopgap measure we had been planning to replace To me, it sounds like the real problem could have been stated as "We were lax on security," but almost worse than that is the lack…

The article starts out in that tone, but it changes to be pretty remorseful after that. For example the "why it won't happen again" part.

[deleted]

Re: How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

#90

Post by dasil003 »

parfe wrote: post #81
dolinsky wrote: post #57

Earlier quoted context omitted.

What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist. Maybe then…

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading t…

> PHPFog built a castle out of sand and you're upset that a wave came and demolished it.

Technology analogies invariably suck, but I'm pretty sure this is provably better:

When a teenager smashes in a storefront window, do we say they should've had bars over it?

Post reply on HN