9 ms·

I disagree. Once again, we can find a scapegoat at the lowest possible level and "stone" them or we can do a proper post mortem and try to learn from it. Why d

I disagree. Once again, we can find a scapegoat at the lowest possible level and "stone" them or we can do a proper post mortem and try to learn from it. Why did this happen? How can we prevent it from happening in the future? These are the questions we need to stress. In particular, why does an ex-employee still have access to production? I say when something like this happens and heads must roll, they must roll at the top. Fire the CEO. Fire the board. Leave the sysadmin alone. This is a civil matter. My tax dollars should not pay for a criminal lawsuit. Screw that. Oh and by the way if you're reading this: please help repeal cfaa.

kelnos 9y ago
I think someone at the org needs to be responsible for not ensuring former employees' access is not revoked, but that doesn't mean an employee who takes advantage of that lapse isn't responsible for his/her actions. Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear. Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.
- thanksgiving 9y ago
  I disagree. The point of focus should be verelox and the criminal negligence on their part. Verelox is the criminal, not the victim. The clients may be the victims. We should not equivocate on cfaa. It is good for nothing. Full and unconditional repeal should be our only demand.
  - kelnos 9y ago
    > The point of focus should be verelox and the criminal negligence on their part. Verelox is the criminal Nope. The affected customers probably have grounds for a civil suit, but no sane prosecutor would think bringing criminal proceedings against Verelox to make sense at all. The ex-employee who perpetrated this is at fault as well and must bear responsibility for his destructive actions. Having the ability to do something (even due to a lapse in security) does not make that action moral or legal.
walshemj 9y ago
If some one hacked your bank account and stole 20k you'd be singing a different tune.
- scrollaway 9y ago
  If someone hacked my bank account through no fault of my own, I'd be taking it up with my bank.
  - walshemj 9y ago
    And in a lot of cases the bank would say Fuck you as with the increasing number of frauds committed in the UK where crims impersonate a house buyers solicitor and steal large sums of monney http://www.telegraph.co.uk/news/uknews/crime/12090890/Revealed-Gangs-netting-millions-from-house-purchase-email-scam.html http://www.telegraph.co.uk/news/uknews/crime/12090890/Reveal...
    - scrollaway 9y ago
      If the bank does say fuck you, I'd file a complaint. If they still say fuck you, I'll reach out to the financial ombudsman service. And if they still say fuck you after that, I'll take them to small claims court. What do you expect me to do? Investigate the matter myself? Buy myself an unlicensed firearm and look for the hacker to get it back at gunpoint?
      - walshemj 9y ago
        In the multiple cases mentioned above the bank says not our problem and only reacted when it was on the front page of the daily telegraph
    - prodmerc 9y ago
      That's not exactly hacking, I've had a similar problem (paid rent by bank transfer and the "landlord" just vanished). The bank said "you transferred the money yourself, there's nothing we can do, it's like paying cash". Which is ridiculous, but technically it's not the bank's fault :/
imron 9y ago
> why does an ex-employee still have access to production? Maybe he became an ex-employee after (and as a result of) wiping production.
- kijin 9y ago
  Thanks for pointing it out. That is certainly a possibility given the ambiguity in the announcement. In fact, it's not even clear at this time whether wiping production was intentional or not. I've heard stories where employees wiped production by accident and promptly became ex-employees, followed by their ex-employer trying to put all blame on them. We don't have enough information at this time to determine whether this is what happened at Verelox.
cortesoft 9y ago
If you are a nefarious administrator, you don't think you could install something on your machines that would let you back in after they revoked your access?
Dylan16807 9y ago
> I disagree. Once again, we can find a scapegoat at the lowest possible level and "stone" them or we can do a proper post mortem and try to learn from it. If he did it (intentionally wiping the servers), then he is a criminal and a bad person. If he is a scapegoat, then he didn't do it, so that's a totally different situation. I don't see how you can disagree with either of these statements. And discussion of how he still had access is an unrelated matter.
ufmace 9y ago
> I say when something like this happens and heads must roll, they must roll at the top. Fire the CEO. Fire the board. Leave the sysadmin alone. IIRC, the Soviet Union had a policy rather like this, referred to as something like the Vertical Stroke, where anytime there was a screw-up at a low level, they would fire the screw-up-ee's manager, and manager's manager, and so on, up to a very high level. The practical result was a drastic decrease in innovation and risk-taking. CEOs and others at that level usually aren't close enough to the guys actually doing direct work to supervise them all closely enough to ensure they don't make mistakes. All they can do is create a culture where there's a book of rules, and you don't deviate from the rules ever, for any reason, no matter what. So that's what they do, and that's the resulting culture and economy that you get. Maybe we shouldn't rush to judge either sysadmins or CEOs, but instead figure out who, if anyone, actually did something malicious, and let everyone else take the lessons they've already learned from what happened.
- valuearb 9y ago
  The Soviets wouldn't actually fire them. They just lost their jobs due to missed time in Siberia or from having bullets in their brains.
  - defined 9y ago
    Ah, well, that's ok then!
    - thanksgiving 9y ago
      If corporations want us to treat them like people, I'm all for treating them like people. This means they are able to defend themselves in a criminal lawsuit and the board is willing to go to prison or the chair for the scrims of the organization. They can't have it both ways.
simonh 9y ago
>This is a civil matter. My tax dollars should not pay for a criminal lawsuit. Screw that. So if an aggrieved ex employee does enough damage that the company has insufficient resources to sue, or has enough resources themselves to make that difficult, it's all good? Individuals and companies should not be vulnerable to attacks like this based on their resources. It's in all our interests to ensure this sort if activity is dealt with severely because we are all vulnerable. Mutual defence in the form of criminal prosecution of offenders is the way they go IMHO.
- thanksgiving 9y ago
  Absolutely. Let's deal with it severely. Let's put the CEO and the board behind bars. I don't see how verelox is a victim. It is like saying a police officer who leaves his keys in the patrol car is a victim when someone takes of with the patrol car. The patrol car isn't his! Similarly, the data isn't verelox's! Let's be practical. What is our end goal? Is it vengeance or is it prevention? If it is the latter, our actions must not be centered on retribution but rather on logic and reasoning. We should ask what can we do to prevent this from happening again? Throwing someone in prison is not the answer IMO.
michaelmrose 9y ago
We have no reason to suppose that the ex employees actions were justified. None whatsoever. He committed both a civil wrong and a crime and the default assumption ought to be that he ought to face both civil and criminal penalties. You tax dollars pay for punishing people who vandalize a car, I have no idea why they ought not to pay for punishing someone who vandalizes a server. We may remain open to additional information without presuming that uncivil and illegal vandalism was justified indeed without inventing a narrative from whole cloth as you have done. The logical conclusion is that drawing from your own life experience you identify so strongly with the narrative of the wronged sysadmin that you desire to fit a narrative to sparse facts that has no basis in fact. We are merely commenting on a story on hacker news. We aren't members of the jury and don't face the same burden or power. I'm down with repealing the cfaa because its badly written, I'm down with figuring out who dropped the ball as far as giving the sysadmin access post firing, but as to the sysadmin himself, burn the witch!

kelnos 9y ago

I think someone at the org needs to be responsible for not ensuring former employees' access is not revoked, but that doesn't mean an employee who takes advantage of that lapse isn't responsible for his/her actions. Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear. Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.

thanksgiving 9y ago
I disagree. The point of focus should be verelox and the criminal negligence on their part. Verelox is the criminal, not the victim. The clients may be the victims. We should not equivocate on cfaa. It is good for nothing. Full and unconditional repeal should be our only demand.
- kelnos 9y ago
  > The point of focus should be verelox and the criminal negligence on their part. Verelox is the criminal Nope. The affected customers probably have grounds for a civil suit, but no sane prosecutor would think bringing criminal proceedings against Verelox to make sense at all. The ex-employee who perpetrated this is at fault as well and must bear responsibility for his destructive actions. Having the ability to do something (even due to a lapse in security) does not make that action moral or legal.

walshemj 9y ago

If some one hacked your bank account and stole 20k you'd be singing a different tune.

scrollaway 9y ago
If someone hacked my bank account through no fault of my own, I'd be taking it up with my bank.
- walshemj 9y ago
  And in a lot of cases the bank would say Fuck you as with the increasing number of frauds committed in the UK where crims impersonate a house buyers solicitor and steal large sums of monney http://www.telegraph.co.uk/news/uknews/crime/12090890/Revealed-Gangs-netting-millions-from-house-purchase-email-scam.html http://www.telegraph.co.uk/news/uknews/crime/12090890/Reveal...
  - scrollaway 9y ago
    If the bank does say fuck you, I'd file a complaint. If they still say fuck you, I'll reach out to the financial ombudsman service. And if they still say fuck you after that, I'll take them to small claims court. What do you expect me to do? Investigate the matter myself? Buy myself an unlicensed firearm and look for the hacker to get it back at gunpoint?
    - walshemj 9y ago
      In the multiple cases mentioned above the bank says not our problem and only reacted when it was on the front page of the daily telegraph
  - prodmerc 9y ago
    That's not exactly hacking, I've had a similar problem (paid rent by bank transfer and the "landlord" just vanished). The bank said "you transferred the money yourself, there's nothing we can do, it's like paying cash". Which is ridiculous, but technically it's not the bank's fault :/

imron 9y ago

> why does an ex-employee still have access to production? Maybe he became an ex-employee after (and as a result of) wiping production.

kijin 9y ago
Thanks for pointing it out. That is certainly a possibility given the ambiguity in the announcement. In fact, it's not even clear at this time whether wiping production was intentional or not. I've heard stories where employees wiped production by accident and promptly became ex-employees, followed by their ex-employer trying to put all blame on them. We don't have enough information at this time to determine whether this is what happened at Verelox.

cortesoft 9y ago

If you are a nefarious administrator, you don't think you could install something on your machines that would let you back in after they revoked your access?

Dylan16807 9y ago

> I disagree. Once again, we can find a scapegoat at the lowest possible level and "stone" them or we can do a proper post mortem and try to learn from it. If he did it (intentionally wiping the servers), then he is a criminal and a bad person. If he is a scapegoat, then he didn't do it, so that's a totally different situation. I don't see how you can disagree with either of these statements. And discussion of how he still had access is an unrelated matter.

ufmace 9y ago

> I say when something like this happens and heads must roll, they must roll at the top. Fire the CEO. Fire the board. Leave the sysadmin alone. IIRC, the Soviet Union had a policy rather like this, referred to as something like the Vertical Stroke, where anytime there was a screw-up at a low level, they would fire the screw-up-ee's manager, and manager's manager, and so on, up to a very high level. The practical result was a drastic decrease in innovation and risk-taking. CEOs and others at that level usually aren't close enough to the guys actually doing direct work to supervise them all closely enough to ensure they don't make mistakes. All they can do is create a culture where there's a book of rules, and you don't deviate from the rules ever, for any reason, no matter what. So that's what they do, and that's the resulting culture and economy that you get. Maybe we shouldn't rush to judge either sysadmins or CEOs, but instead figure out who, if anyone, actually did something malicious, and let everyone else take the lessons they've already learned from what happened.

valuearb 9y ago
The Soviets wouldn't actually fire them. They just lost their jobs due to missed time in Siberia or from having bullets in their brains.
- defined 9y ago
  Ah, well, that's ok then!
  - thanksgiving 9y ago
    If corporations want us to treat them like people, I'm all for treating them like people. This means they are able to defend themselves in a criminal lawsuit and the board is willing to go to prison or the chair for the scrims of the organization. They can't have it both ways.

simonh 9y ago

>This is a civil matter. My tax dollars should not pay for a criminal lawsuit. Screw that. So if an aggrieved ex employee does enough damage that the company has insufficient resources to sue, or has enough resources themselves to make that difficult, it's all good? Individuals and companies should not be vulnerable to attacks like this based on their resources. It's in all our interests to ensure this sort if activity is dealt with severely because we are all vulnerable. Mutual defence in the form of criminal prosecution of offenders is the way they go IMHO.

thanksgiving 9y ago
Absolutely. Let's deal with it severely. Let's put the CEO and the board behind bars. I don't see how verelox is a victim. It is like saying a police officer who leaves his keys in the patrol car is a victim when someone takes of with the patrol car. The patrol car isn't his! Similarly, the data isn't verelox's! Let's be practical. What is our end goal? Is it vengeance or is it prevention? If it is the latter, our actions must not be centered on retribution but rather on logic and reasoning. We should ask what can we do to prevent this from happening again? Throwing someone in prison is not the answer IMO.

michaelmrose 9y ago

We have no reason to suppose that the ex employees actions were justified. None whatsoever. He committed both a civil wrong and a crime and the default assumption ought to be that he ought to face both civil and criminal penalties. You tax dollars pay for punishing people who vandalize a car, I have no idea why they ought not to pay for punishing someone who vandalizes a server. We may remain open to additional information without presuming that uncivil and illegal vandalism was justified indeed without inventing a narrative from whole cloth as you have done. The logical conclusion is that drawing from your own life experience you identify so strongly with the narrative of the wronged sysadmin that you desire to fit a narrative to sparse facts that has no basis in fact. We are merely commenting on a story on hacker news. We aren't members of the jury and don't face the same burden or power. I'm down with repealing the cfaa because its badly written, I'm down with figuring out who dropped the ball as far as giving the sysadmin access post firing, but as to the sysadmin himself, burn the witch!