3 ms·

There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running exper

There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...

kbenson 10y ago
Well, there was a small intrusion. It reports back a filtered command history (including just package install commands), the hardware info, and the list of installed modules (along with regular info, like system type, if there are admin privileges, etc). That's not nothing, but it is fairly benign. I was worried about the command history until I saw it was filtered, and that mostly allayed my misgivings.
placeybordeaux 10y ago
The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.
- billyhoffman 10y ago
  "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"
  - random28345 10y ago
    > "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'" The prosecuting attorney is going to tell a jury of twelve of your non-technical "peers" that it is hacking. Your client can either go to trial for seventeen thousand two hundred and eighty nine counts of felony hacking, and risk half a million years in prison, or they can plea bargain to 5 years in prison and a felony on his record. Or your client can hang himself, but I'm pretty sure a federal prosecutor counts that as a win too.
    - cplease 10y ago
      Yup. I'm surprised an advisor would sign off on this thesis.
  - flashman 10y ago
    That's an interesting point. Is there any case law on negligence versus malice?
- codedokode 10y ago
  What about Android apps (like Facebook) that collect phone numbers, contact lists, geolocation data, record sound without any user authorization?

kbenson 10y ago

Well, there was a small intrusion. It reports back a filtered command history (including just package install commands), the hardware info, and the list of installed modules (along with regular info, like system type, if there are admin privileges, etc). That's not nothing, but it is fairly benign. I was worried about the command history until I saw it was filtered, and that mostly allayed my misgivings.

placeybordeaux 10y ago

The research got computers to execute code on them without authorization and extracted information from them. That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.

billyhoffman 10y ago
"Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'"
- random28345 10y ago
  > "Your honor, my client created and published a software library. The so-called victims here wrote code that specifically referenced my client's software library, by name mind you. My client in no way compelled or solicited the victims to do so. Now how can that be called 'without authorization?'" The prosecuting attorney is going to tell a jury of twelve of your non-technical "peers" that it is hacking. Your client can either go to trial for seventeen thousand two hundred and eighty nine counts of felony hacking, and risk half a million years in prison, or they can plea bargain to 5 years in prison and a felony on his record. Or your client can hang himself, but I'm pretty sure a federal prosecutor counts that as a win too.
  - cplease 10y ago
    Yup. I'm surprised an advisor would sign off on this thesis.
- flashman 10y ago
  That's an interesting point. Is there any case law on negligence versus malice?
codedokode 10y ago
What about Android apps (like Facebook) that collect phone numbers, contact lists, geolocation data, record sound without any user authorization?