Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

91–100 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#91

Post by rcsorensen »

rayiner wrote: post #74
msandford wrote: post #45

Earlier quoted context omitted.

You totally nailed it. 100% right. Distilled it down to the essentials of how the internet works and the nature of a protocol as a contract. Bravo.

His whole analogy only works because the librarian is a human, and if a human with some apparent authority lets you do something, you can reasonably infer that you have permission to do it. But you can't anthropomorphize a server like that. It's not a gatekeeper, capable of granting permission, just a dumb lock which may be flawed. Only humans can consent. To repurpose his analogy, if you sneak into the staff room an…

The problem is that the people who wrote the code are human. The people who deployed the code are human. The people who paid for the internet connection that lets you connect to their service are human.

There are any number of explicit steps that are taken to put code on an HTTP service on the internet.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#92

Post by mmatants »

jlgreco wrote: post #68
mintplant wrote: post #66

Earlier quoted context omitted.

Not if I tricked the librarian into setting fire to the library.

What really is the line between tricked and asked? Deceit? Lets go with deceit. So is asking for book ISBN '1; DROP TABLE books; --' deceitful? Perhaps, that's not an ISBN after all. Is asking for book ISBN [some valid ISBN that you pulled out of your ass, but happens to exist] deceitful? I don't think so. If you are just asking for randomly chosen ISBNs and getting responses, I don't think there is any trickery invo…

The line is in the intent.

If I hand the librarian a piece of paper with that SQL-injecting ISBN my culpability depends on whether I was aware of the likely gravity of my actions or whether e.g. I was told to get that piece of paper by a trusted source (e.g. my supervisor) and didn't even read it.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#93

Post by mylorse »

legutierr wrote: post #21
derleth wrote: post #17

Earlier quoted context omitted.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

> Or is it like walking into someone's private home because they left the door open? Or merely unlocked? It's more like if you were to walk into a retail establishment where the employees left the door unlocked after heading home for the day. You can't buy anything because the cash register is locked, and taking something would clearly be stealing, but if sign posted says "we're open", can you be faulted for looking…

Correct, and thank you.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#94

Post by mylorse »

bandushrew wrote: post #31
derleth wrote: post #17

Earlier quoted context omitted.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

its like walking into someone's home, that had signs up over a bunch of open doors along a wall saying 'come in, all visitors welcome'. After wandering around a bit, you notice another door in the same wall has been left open, but there is no sign. Curious - you look in. BANG. Jail Time.

No, because AT&T is a open Business, which needs to be in business zones, following business statues, not personal computers connected to ISP servers. It's more like the brothel analogy I just made: https://news.ycombinator.com/item?id=6435769

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#95

Post by mylorse »

tikhonj wrote: post #29
derleth wrote: post #17

Earlier quoted context omitted.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

I think it's more like walking onto your neighbor's private land when they don't have fences or a "keep-out" sign, but also don't have any obvious sign allowing people in either. Still a crime, but not particularly severe or abhorrent; whether it merits serious punishment probably depends on particular details.

Read above. Linked just in case: https://news.ycombinator.com/item?id=6435845

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#96

Post by rubythurs »

angersock wrote: post #81
rayiner wrote: post #74

Earlier quoted context omitted.

His whole analogy only works because the librarian is a human, and if a human with some apparent authority lets you do something, you can reasonably infer that you have permission to do it. But you can't anthropomorphize a server like that. It's not a gatekeeper, capable of granting permission, just a dumb lock which may be flawed. Only humans can consent. To repurpose his analogy, if you sneak into the staff room an…

People boil down to dumb locks--if presented with the correct context and input, if they are rational they should by definition grant access. This library analogy was the best way I've seen the issue put, and one that is actually accurate.

I agree with library analogy

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#97

Post by mylorse »

freyrs3 wrote: post #8
austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Of course he deserves to be in jail, but he should be in jail under harassment and identity theft laws instead of the hacking charges.

Exactly! In the United States, there are protections for that: Libel & Slander

Which is why he was convicted of. Harassment laws could also be implemented, depending on the jurisdiction.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#98

Post by Liru »

usaphp wrote: post #56

Here is my analogy: 1. You just finished your workout and went to a locker room at your gym (he went to a public website) 2. You opened up your own locker and took your stuff from it (checked his account) 3. You found out that very few people are using locks in the gym locker room (figured the account id in url ) 4. You know that it is not your belongings in other people lockers, but they are not locked just because…

Your analogy starts to break down somewhere around point 3 or 4. It's not that few people use a lock on their locker. A closer analogy would be that the gym installed an electronic lock on each locker, but didn't actually make sure they worked.

It also wildly disconnects around point 6. You make it sound like he stole everything that the users had in the accounts. In reality, he just copied their info. He didn't give himself anything from their accounts, like transferring credits to give himself free cable or something like that. Instead of stealing everything and selling it on eBay, it was more like him going through people's lockers, taking a picture of what they have inside, and then selling the pictures.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#99

Post by jussij »

jrockway wrote: post #83
patio11 wrote: post #69

Earlier quoted context omitted.

This is currently downmodded because people don't like the implication. And they shouldn't, because it quickly forces someone into either a) agreeing with the law or b) saying that SQL injections must be, ipso facto, legal. Including ones like: 1 AND ("1" = SUBSTRING(select social_security_number from employees where employee_name = 'Angela Smith', 1, 1)) You can use variations on this to... a) Ask our librarian for…

I approach this from a different angle. If someone broke into my web app by injecting SQL, I'd be mad that I allowed them to do so. If someone broke into my apartment by smashing the window with a brick, I wouldn't be mad at myself for not using thicker glass. Therefore, I see SQL injections as sloppy programming, but physical break-ins as sloppy ethics. IMHO YMMV IANAL KTHXBYE.

So does that mean if someone picked the lock on your front door and just had a look around your apartment, without doing any damage; you’d be ok with that and just be mad at yourself for not installing a better lock?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#100

Post by mylorse »

mangoman wrote: post #28

I love the use of analogy to describe the situation to those who may not understand exactly what Weev did. But can we decide law simply on analogy? Which analogy is a more accurate tale of what Weev did? What I like about this article is it explains what Weev did and how incredibly common his techniques were, without too much analogy. Analogies may be much more effective, but a direct explanation feels a lot more gen…

How about mines?: https://news.ycombinator.com/item?id=6435769

You are welcome to critique, not harass⸮:

Post reply on HN