5 ms·

>> Mr. Auernheimer said he did not hack into the printers, but activated them using remote access. > Or maybe universities and organizations could teach their

by 21 11y ago

>> Mr. Auernheimer said he did not hack into the printers, but activated them using remote access. > Or maybe universities and organizations could teach their employees to handle network security better. I don't think this is grounds for a criminal case. Actually it is. If you try my car/house door and it's unlocked it doesn't mean you can enter it. That being said, a fine would be appropriate in this case since minimal harm was done.

newjersey 11y ago
> If you try my car/house door and it's unlocked it doesn't mean you can enter it. I'd say breaking into a computer is more like breaking into someone's mind (something like inception if it exists) rather than breaking into their home. I know it sounds counterproductive to the case in hand but that's because I have no intention of defending weev. I just want us to get out of this idea that we have to somehow tie everything in computers with an analogy like breaking and entering a house.
waterlesscloud 11y ago
Here's what I consider a balanced response- prosecute him for some kind of hacking crime, and at the same time fire the system administrators for gross incompetence.
- jessaustin 11y ago
  Apparently this happened many times in many places. You can't fire that many people. Who would replace them?
  - waterlesscloud 11y ago
    Start firing people for screwing up and their peers will learn not to screw up.
    - Karunamon 11y ago
      Even the most careful, thoughtful, and professional person will screw up at their job sometimes. It's only if the same screwup is made twice that jobs should be on the line. The first time is a learning experience, the second time is a demonstration of incompetence. If you can all your competent people the first time they make a mistake, suddenly you won't have competent people anymore in your misguided quest for perfection.
    - kndyry 11y ago
      Their peers will learn that 'screw ups' on whatever arbitrary scale, which are as common as human, will be punished by loss of employment, plus all of the negatives that status carries. This will teach them to become militantly risk averse and, by proxy, utterly afraid of and resistant to change. Meanwhile, the folks you let go, the ones who truly learned the lesson, end up using their newfound experience to improve processes elsewhere.
      - waterlesscloud 11y ago
        OK. Sure. Downvote away. And this will keep happening. Grats on that. Keep fighting with reality, let's see how that goes.
  - mikeash 11y ago
    It's not like people just stop working after they're fired. You can just hire replacements from the people who were fired at other schools. Everybody wins!
biot 11y ago
> If you try my car/house door and it's unlocked it doesn't > mean you can enter it. If you have a publicly available web server and I make a "GET /" request on it, am I hacking? If you have a publicly available print server and I make a "PRINT flyer.pdf" request to it, am I hacking?
- wfo 11y ago
  Interestingly enough the person the article about was convinced and jailed for making GET requests on publicly available websites, because he knew he did not have permission to access them. I think a print server at a university is pretty obviously not fair game. If you forget to lock up your business overnight and someone walks in and prints off a couple thousand pages using your printer it's definitely illegal.
  - biot 11y ago
    Yeah, I made an analogy 3 years ago when the Weev case came up: https://news.ycombinator.com/item?id=6435092 https://news.ycombinator.com/item?id=6435092 contrasting a publicly accessible web server with a librarian at a public library. Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access. Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"? To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.
    - wfo 11y ago
      I think a better analogy would be if a library accidentally placed a paper copy of their members' records in the library alongside the books, you found it, and instead of informing the library of the horrible mistake you took it over to the library photocopy machine and made a copy for yourself and showed it to everyone to humiliate the library for their mistake. Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it. It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.
justinsaccount 11y ago
> Actually it is. Specifically what law did he break? If someone leaves you a voicemail with a message you don't agree with, is that a crime? If someone sends you a fax with the same message, is that a crime? [1] If someone sends you an email with the same message, is that a crime? If you connect a printer to the internet and someone sends the printer a document with the same message, is that a crime? I'm sure someone can find a way to apply the CFAA to this, but at the end of the day a printer is not a house. A printer connected to the internet is a server that turns files into paper documents. If you don't want people using your printer, don't place it on the internet with zero authentication or access controls. [1] advertisements are illegal, not sure about arbitrary messages.
- jessaustin 11y ago
  Yeah the fax analogy is spot-on. Nowadays the fax and printer are often the same machine.
  - mikeash 11y ago
    The fax analogy is terrible. It's normal to set up a fax machine that anybody can send stuff to without authentication. Nobody ever does that with internet connected printers. If you find one accessible and unsecured, you know it was done by accident.
    - jessaustin 11y ago
      TFA seems to contradict at least your "nobody ever does that". ISTM that while many of the unsecured printers were mistakenly so, many others were intentionally so. But we don't need to speculate about motivations. There is very little functional difference between a fax machine and an unsecured printer. The addressing scheme and transmission protocol are different, and the fax is limited to B&W, but those are the only differences of form or function. The differences are in the expectations that some people have. They'd shred obnoxious faxes without comment, but at least for now they won't do that for obnoxious printouts.

by 21 11y ago

newjersey 11y ago

> If you try my car/house door and it's unlocked it doesn't mean you can enter it. I'd say breaking into a computer is more like breaking into someone's mind (something like inception if it exists) rather than breaking into their home. I know it sounds counterproductive to the case in hand but that's because I have no intention of defending weev. I just want us to get out of this idea that we have to somehow tie everything in computers with an analogy like breaking and entering a house.

waterlesscloud 11y ago

Here's what I consider a balanced response- prosecute him for some kind of hacking crime, and at the same time fire the system administrators for gross incompetence.

jessaustin 11y ago
Apparently this happened many times in many places. You can't fire that many people. Who would replace them?
- waterlesscloud 11y ago
  Start firing people for screwing up and their peers will learn not to screw up.
  - Karunamon 11y ago
    Even the most careful, thoughtful, and professional person will screw up at their job sometimes. It's only if the same screwup is made twice that jobs should be on the line. The first time is a learning experience, the second time is a demonstration of incompetence. If you can all your competent people the first time they make a mistake, suddenly you won't have competent people anymore in your misguided quest for perfection.
  - kndyry 11y ago
    Their peers will learn that 'screw ups' on whatever arbitrary scale, which are as common as human, will be punished by loss of employment, plus all of the negatives that status carries. This will teach them to become militantly risk averse and, by proxy, utterly afraid of and resistant to change. Meanwhile, the folks you let go, the ones who truly learned the lesson, end up using their newfound experience to improve processes elsewhere.
    - waterlesscloud 11y ago
      OK. Sure. Downvote away. And this will keep happening. Grats on that. Keep fighting with reality, let's see how that goes.
- mikeash 11y ago
  It's not like people just stop working after they're fired. You can just hire replacements from the people who were fired at other schools. Everybody wins!

biot 11y ago

> If you try my car/house door and it's unlocked it doesn't > mean you can enter it. If you have a publicly available web server and I make a "GET /" request on it, am I hacking? If you have a publicly available print server and I make a "PRINT flyer.pdf" request to it, am I hacking?

wfo 11y ago
Interestingly enough the person the article about was convinced and jailed for making GET requests on publicly available websites, because he knew he did not have permission to access them. I think a print server at a university is pretty obviously not fair game. If you forget to lock up your business overnight and someone walks in and prints off a couple thousand pages using your printer it's definitely illegal.
- biot 11y ago
  Yeah, I made an analogy 3 years ago when the Weev case came up: https://news.ycombinator.com/item?id=6435092 https://news.ycombinator.com/item?id=6435092 contrasting a publicly accessible web server with a librarian at a public library. Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access. Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"? To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.
  - wfo 11y ago
    I think a better analogy would be if a library accidentally placed a paper copy of their members' records in the library alongside the books, you found it, and instead of informing the library of the horrible mistake you took it over to the library photocopy machine and made a copy for yourself and showed it to everyone to humiliate the library for their mistake. Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it. It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.

justinsaccount 11y ago

> Actually it is. Specifically what law did he break? If someone leaves you a voicemail with a message you don't agree with, is that a crime? If someone sends you a fax with the same message, is that a crime? [1] If someone sends you an email with the same message, is that a crime? If you connect a printer to the internet and someone sends the printer a document with the same message, is that a crime? I'm sure someone can find a way to apply the CFAA to this, but at the end of the day a printer is not a house. A printer connected to the internet is a server that turns files into paper documents. If you don't want people using your printer, don't place it on the internet with zero authentication or access controls. [1] advertisements are illegal, not sure about arbitrary messages.

jessaustin 11y ago
Yeah the fax analogy is spot-on. Nowadays the fax and printer are often the same machine.
- mikeash 11y ago
  The fax analogy is terrible. It's normal to set up a fax machine that anybody can send stuff to without authentication. Nobody ever does that with internet connected printers. If you find one accessible and unsecured, you know it was done by accident.
  - jessaustin 11y ago
    TFA seems to contradict at least your "nobody ever does that". ISTM that while many of the unsecured printers were mistakenly so, many others were intentionally so. But we don't need to speculate about motivations. There is very little functional difference between a fax machine and an unsecured printer. The addressing scheme and transmission protocol are different, and the fax is limited to B&W, but those are the only differences of form or function. The differences are in the expectations that some people have. They'd shred obnoxious faxes without comment, but at least for now they won't do that for obnoxious printouts.