5 ms·

It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. He could have sold the domain to someone not concerned with

by narag 7y ago

It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. He could have sold the domain to someone not concerned with the "legally" part.

shawnz 7y ago
But they would be under the same constraints as him. And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. Plus, wouldn't knowingly selling it to a bad actor be a violation of his due diligence?
- newswasboring 7y ago
  > And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. They can't seize a domain because you were running some service on it, can they?
  - angus-prune 7y ago
    They frequently seize domain names used for malware or controlling botnets. Just one example: https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear/ https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-...
    - bagacrap 7y ago
      But this site would not be running a botnet. It would only be accepting data that others willfully send its way. If this is illegal, then I can shut down any site by sending my private data to it. Of course actually doing anything with the received private data might be illegal, but that would be harder to track. How would the owner of a misconfigured network ever figure out how their data got "hacked"; whether the owner of corp.com did something or nothing with it? Hence ancestor's use of "ethically" rather than "legally".
      - snowwrestler 7y ago
        > It would only be accepting data that others willfully send its way. Human knowledge and intent matters in legal matters. If a technology is accidentally misconfigured to send sensitive data to a third party, and that third party knows that the data they are receiving was not intended for them, then they are still responsible for not willfully misusing that data. That's clearly the case with corp.com. > If this is illegal, then I can shut down any site by sending my private data to it. No, if you knowingly choose to send your data somewhere, then you can't turn around and blame the people receiving your data. Again: human knowledge and intent matter for the law. As an example, a charge of trespassing depends on permission (human knowledge and intent), not whether you leave your gate open (how a system is configured).
        bagacrap 7y ago
        You seem to be trying to contradict that it is legal to own corp.com, but actually you are saying that misusing collected data is illegal, which I never denied. The point is that it would be hard-to-impossible to go after someone who owns corp.com even if they use it for nefarious purposes because the actual nefarious action would be so hard to discover or prove. Besides which, the bad actor here could easily live somewhere without an extradition treaty to the US or simply remain pseudo anonymous (via shell companies, bitcoin, etc). So, it would be possible for an unethical owner of corp.com to find a buyer who intends to use it for ill.
        BlueDingo 7y ago
        Don't the issues of intent only come up after some legal kerfuffle? What law-breaking event would cause an investigation here?
      - im3w1l 7y ago
        As shawnz hinted at there is a protocol dance that happens before the data is sent over. I don't know exactly what it consists of, but I suspect it's more than just tcp-level responses saying the port is open and ready to receive. Playing along in that dance is arguably unethical and shows intent.
  - Beefin 7y ago
    If you violate the law, yes: https://www.justice.gov/usao-sc/pr/federal-court-orders-seizure-67-website-domains-involved-smuggling-and-selling-misbranded https://www.justice.gov/usao-sc/pr/federal-court-orders-seiz...
  - thefounder 7y ago
    Lol...tens of thousands are taken down every single day. Facebook sues the providers that don't take them down "fast enough" https://news.ycombinator.com/item?id=22497391 https://news.ycombinator.com/item?id=22497391
- mywacaday 7y ago
  I'm surprised NSA/CIA/China weren't looking to purchase. Would be a list of free backdoors at a very cheap price.

by narag 7y ago

It's not like O'Connor can do anything (legally) with the sensitive data that's hitting his domain. He could have sold the domain to someone not concerned with the "legally" part.

shawnz 7y ago

But they would be under the same constraints as him. And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. Plus, wouldn't knowingly selling it to a bad actor be a violation of his due diligence?

newswasboring 7y ago
> And it would be easy to see if they tried anything (are those ports accepting connections or not?) at which point it would have been quickly seized. They can't seize a domain because you were running some service on it, can they?
- angus-prune 7y ago
  They frequently seize domain names used for malware or controlling botnets. Just one example: https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear/ https://www.cyberscoop.com/vpnfilter-botnet-fbi-seizure-apt-...
  - bagacrap 7y ago
    But this site would not be running a botnet. It would only be accepting data that others willfully send its way. If this is illegal, then I can shut down any site by sending my private data to it. Of course actually doing anything with the received private data might be illegal, but that would be harder to track. How would the owner of a misconfigured network ever figure out how their data got "hacked"; whether the owner of corp.com did something or nothing with it? Hence ancestor's use of "ethically" rather than "legally".
    - snowwrestler 7y ago
      > It would only be accepting data that others willfully send its way. Human knowledge and intent matters in legal matters. If a technology is accidentally misconfigured to send sensitive data to a third party, and that third party knows that the data they are receiving was not intended for them, then they are still responsible for not willfully misusing that data. That's clearly the case with corp.com. > If this is illegal, then I can shut down any site by sending my private data to it. No, if you knowingly choose to send your data somewhere, then you can't turn around and blame the people receiving your data. Again: human knowledge and intent matter for the law. As an example, a charge of trespassing depends on permission (human knowledge and intent), not whether you leave your gate open (how a system is configured).
      - bagacrap 7y ago
        You seem to be trying to contradict that it is legal to own corp.com, but actually you are saying that misusing collected data is illegal, which I never denied. The point is that it would be hard-to-impossible to go after someone who owns corp.com even if they use it for nefarious purposes because the actual nefarious action would be so hard to discover or prove. Besides which, the bad actor here could easily live somewhere without an extradition treaty to the US or simply remain pseudo anonymous (via shell companies, bitcoin, etc). So, it would be possible for an unethical owner of corp.com to find a buyer who intends to use it for ill.
      - BlueDingo 7y ago
        Don't the issues of intent only come up after some legal kerfuffle? What law-breaking event would cause an investigation here?
    - im3w1l 7y ago
      As shawnz hinted at there is a protocol dance that happens before the data is sent over. I don't know exactly what it consists of, but I suspect it's more than just tcp-level responses saying the port is open and ready to receive. Playing along in that dance is arguably unethical and shows intent.
- Beefin 7y ago
  If you violate the law, yes: https://www.justice.gov/usao-sc/pr/federal-court-orders-seizure-67-website-domains-involved-smuggling-and-selling-misbranded https://www.justice.gov/usao-sc/pr/federal-court-orders-seiz...
- thefounder 7y ago
  Lol...tens of thousands are taken down every single day. Facebook sues the providers that don't take them down "fast enough" https://news.ycombinator.com/item?id=22497391 https://news.ycombinator.com/item?id=22497391
mywacaday 7y ago
I'm surprised NSA/CIA/China weren't looking to purchase. Would be a list of free backdoors at a very cheap price.