7 ms·

One prank would be egging cars. Clearly it's the car companies fault for building cars that have paint ruined if you don't wash it quickly. Another would be pu

One prank would be egging cars. Clearly it's the car companies fault for building cars that have paint ruined if you don't wash it quickly. Another would be putting a potato in the exhaust -- why don't they build potato proof exhausts? You can let car tyres down without causing an ounce of damage, what a hoot. It's the car company's fault that so many cars are susceptible.

who-knows95 8y ago
sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.
- watwut 8y ago
  Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.
  - who-knows95 8y ago
    the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
    - watwut 8y ago
      They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
      - who-knows95 8y ago
        "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
        isostatic 8y ago
        > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
        who-knows95 8y ago
        if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.
mindslight 8y ago
Analogs to the real world are compelling, but this line of reasoning is nonsensical when applied to the digital realm. The magnitude differences of "constant factors" make the Internet paradigm/philosophy wildly different. It's quite hard to accidentally put a potato in an exhaust pipe. One cannot write a script that mechanically puts a potato up every car in the world's tailpipe, in 5 minutes nonetheless! An appropriate real world analogy would be something like a maker of explosion-proof equipment forgoes designing any actual protection against those harsh environments, and then blames the ensuing explosion on all that dust in the air. The Internet was successful precisely due to scaling from the End to End principle. The Internet is hostile noise - as soon as something speaks IP, it must be capable of standing up for its own security rather than relying on some imagined benevolence or accountability. If a manufacturer is not up to this task, then there are plenty of non-globally-routing protocols (eg USB, bluetooth) that printers can use to communicate with a competent Internet node. (Furthermore ignoring the digital spookiness, the actual damage doesn't even add up to much. If we assume they hacked 30k printers, that's only 60 reams of paper - on the scale of petty larceny. And given that we allow junk mail and other advertising companies to do far more damage as their above-board business, it's questionable whether that integral even applies!)

who-knows95 8y ago

sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.

watwut 8y ago
Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.
- who-knows95 8y ago
  the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
  - watwut 8y ago
    They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
    - who-knows95 8y ago
      "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
      - isostatic 8y ago
        > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
        who-knows95 8y ago
        if you had a smart door, with a known vulnerability that has been reported, but the manufacturer says it not their problem. i then walk past, notice your door and the vulnerability, and then slide a note through your door explaining the vulnerability and how to fix it. you would be out of your mind to cry foul. Felix didn't encourage a crime, come on, act your age. just because you blindly hate someone doesn't mean you can twist their words without getting called out. i'll be the first to say that he's no saint, but he's way better than the average trash that floats around on the internet. doing charity fund raisers that are worth donating to, calling out abusive personal and companies, being the genuine face of a massive community he never asked to represent. Computer Misuse Act 1990 (1)A person is guilty of an offence if— -(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer [F1, or to enable any such access to be secured]. -(b)the access he intends to secure [F2, or to enable to be secured,] is unauthorised; and -(c)he knows at the time when he causes the computer to perform the function that that is the case. i don't believe using a google program to send out code to any device with the open ports falls under any of these, as the code didn't secure access to any program or data held, and wasn't malicious. as he wasn't securing access, he doesn't fall foul of these laws. as the bug had already been reported to google chrome, and they had stated it was user error, supplying the user with the means to fix it is a perfectly acceptable thing to do.

mindslight 8y ago

Analogs to the real world are compelling, but this line of reasoning is nonsensical when applied to the digital realm. The magnitude differences of "constant factors" make the Internet paradigm/philosophy wildly different. It's quite hard to accidentally put a potato in an exhaust pipe. One cannot write a script that mechanically puts a potato up every car in the world's tailpipe, in 5 minutes nonetheless! An appropriate real world analogy would be something like a maker of explosion-proof equipment forgoes designing any actual protection against those harsh environments, and then blames the ensuing explosion on all that dust in the air. The Internet was successful precisely due to scaling from the End to End principle. The Internet is hostile noise - as soon as something speaks IP, it must be capable of standing up for its own security rather than relying on some imagined benevolence or accountability. If a manufacturer is not up to this task, then there are plenty of non-globally-routing protocols (eg USB, bluetooth) that printers can use to communicate with a competent Internet node. (Furthermore ignoring the digital spookiness, the actual damage doesn't even add up to much. If we assume they hacked 30k printers, that's only 60 reams of paper - on the scale of petty larceny. And given that we allow junk mail and other advertising companies to do far more damage as their above-board business, it's questionable whether that integral even applies!)