7 ms·

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand an

by parfe 16y ago

Maybe then they'll stop with the half-assed apologies and recognize that there's a right way and a wrong way to do things. PHPFog built a castle out of sand and you're upset that a wave came and demolished it. I'm always surprised at how thin-skinned a lot of HN commentary is. "Oh, Zed shouldn't be so rude" "These kids' lives should be destroyed for playing games with an wholly insecure website." "I stopped reading that article because it used the word blowjob." I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame. My dog shits in the house and it's my fault for not walking him sooner. If some children compromise every level of your company then getting mad at them is only trying to deflect the blame. PHPFog is the only responsible party in this mess. I feel for the customers who still trust them.

nbpoole 16y ago
"PHPFog built a castle out of sand and you're upset that a wave came and demolished it." Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own. "I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame." While some HN posters might feel the the 16 year olds involved in this incident have the same mental capacity as your dog, I'd like to give them slightly more credit. ;) I can only speak for myself here, but I do think the people involved in compromising PHP Fog should be punished. No, I don't think they should get life in prison (</hyperbole>): I hope they can learn from their mistakes. However, they did commit a crime, as they've admitted both here and elsewhere online. They should be capable of understanding that their actions have consequences, so I think some consequences are in order. What those consequences should be is up to PHP Fog.
- Helianthus16 16y ago
  From the perspective of security protection, intrusions are an act of nature. You should be no more surprised at an especially strong wave than you are at an exceptionally immature child.
  - nbpoole 16y ago
    I don't think we're using the same definition of "act of nature": http://en.wikipedia.org/wiki/Act_of_God http://en.wikipedia.org/wiki/Act_of_God "Act of God is a legal term for events outside of human control, such as sudden floods or other natural disasters, for which no one can be held responsible" Do you think nobody can be held responsible for this breach?
    - Helianthus16 16y ago
      You're right, we're not using the same definition. That doesn't mean I don't have a point.
      - nbpoole 16y ago
        Of course. I guess I'm not clear what your point is though.
        Helianthus16 16y ago
        My point is that you must treat intrusions as an inevitability when trying to counteract intrusion. And anyone who builds a sandcastle should be aware of the ocean. The kid's breaking into this account is embarrassing. Just because we can hold individual humans accountable (and should) doesn't mean we shouldn't have the perspective of "CONSTANT VIGILANCE."
        jamesbkel 16y ago
        Still, does that really hold up? Certainly should have to treat intrusions as inevitable in designing the system, but there still is responsibility on the part of the intruder. I lock my door because I consider it inevitable that someone will eventually try and break in. However, if someone does break into and vandalize my apartment, I sure as hell would consider them responsible and not consider in an act of God.
        pyre 16y ago
- _delirium 16y ago
  Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own. In terms of moral culpability, sure. But when I put systems on the internet, I basically treat "intrusion attempts" as in practice part of the environment, like "mosquito bites" are in Texas. Perhaps they're best thought of as kids knocking down sandcastles rather than ocean waves, but their ubiquity makes them feel more like ocean waves, because you can basically assume that there are tons of those kids, and they're going to kick at your sandcastle every day. The fact that there's a whole ecosystem of bots running automated intrusion attempts makes them feel a little bit force-of-nature-ish as well. If you lived in some neighborhood where thousands of roving robots were constantly checking doors to see if they could find an unlocked one, you'd have to treat "roving robots" as a quasi force of nature. Well, either that, or come up with a policing method that finds the controller of the robots and shuts them down, but I have relatively low hopes for how much of a dent "cybercrime" policing will make in the overall online-intrusion ecosystem.
dolinsky 16y ago
I'm sorry, but in between your Straw Man argument and your indirect Ad Hominem attack, I fail to see you address the point that these kids caused harm to a business. Nowhere did I say that PHPFog bears no responsibility for the security of their service, but that doesn't excuse what these kids did one bit. I'm just much more impressed with the way that PHPFog is handling their business after the fact than these kids are. Nowhere did I suggest that these kids lives should be destroyed, however I do believe they most definitely need to be held accountable for their actions. PHPFog will be held accountable for their actions by whether or not businesses decide to do business with them going forward. Both parties bear responsibility, and it's absurd to think otherwise.
- parfe 16y ago
  >I fail to see you address the point that these kids caused harm to a business Very well. These kids caused harm to a business. So what's that change? The business screwed up, badly. The agent of destruction is quite irrelevant. Had it been a power failure, backup failure, permissions failure, data leak, or data corruption would PHPFog deserve any less blame? This need to shift some responsibility to a bunch of kids is nauseating. >I'm just much more impressed with the way that PHPFog is handling their business after the fact than these kids are. This is another example of the weird HN mentality when it comes to companies "apologizing" (Like WakeMate blaming their Chinese manufacturer for flunky power supplies). Are you actually impressed that a corporation has better PR than a bunch of children? Does that even make sense to you? I'd be impressed if they had managed to actually apologize while accepting all the blame without trying to pawn off the responsibility for their mistakes on some kids.
  - lambda 16y ago
    > This need to shift some responsibility to a bunch of kids is nauseating. They aren't shifting responsibility. The kids are responsible for their own actions. They did something illegal. They are responsible for it. Now, PHPFog is also responsible for protecting their customers; they are supposed to provide a secure hosting environment. PHPFog is a victim here, but has also acted irresponsibly with regards to security (not criminally irresponsibly, but if harm did come to their customers due to this, there could be possible civil liability). The fact that PHPFog bears some blame for their security practices doesn't take responsibility off the kids who broke in and vandalized their systems.
dasil003 16y ago
> PHPFog built a castle out of sand and you're upset that a wave came and demolished it. Technology analogies invariably suck, but I'm pretty sure this is provably better: When a teenager smashes in a storefront window, do we say they should've had bars over it?
- parfe 16y ago
  >When a teenager smashes in a storefront window, do we say they should've had bars over it? Depends what's behind the storefront windows. On the other hand I can certainly agree that we stop with the technology analogies before a car analogy is let loose and someone gets hurt.
- jammur 16y ago
  The major problem with your analogy is that storefront windows don't have hundred or thousands of bricks thrown at them everyday. Web hosts are basically under constant attack. Would you suggest that the CIA, NSA, etc. not worry too much about their computer security? If not, then I don't see why you would imply a web host shouldn't be expected to secure their servers as much as possible either. If a storefront was under constant attack, then yes, they should have bars over it. In fact, in my hometown, there was a streak of vandalisms where kids were throwing bricks through windows. After getting hit 3 times, one store replaced their huge glass windows with smaller plexiglass ones.
  - nbpoole 16y ago
    I think you're missing the point of the analogy. Check out http://en.wikipedia.org/w/index.php?title=Victim_blaming&oldid=419679081 http://en.wikipedia.org/w/index.php?title=Victim_blaming&#38...
    - parfe 16y ago
      Let's not forget that the victim here is PHPFog's (potential) customers and not PHPFog itself.
      - 16y ago
lambda 16y ago
This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, rifling through a bunch of people's personal belongings, sticking signs in the windows saying "this building's landlords suck," and changing the locks on some of the doors to make it hard to clean up the whole mess. They absolutely are the responsible party; you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves. If I accidentally leave my door unlocked one day, that does not make it suddenly OK to come in and take my stuff and it's my fault for not having locked my door, instead of yours for taking my stuff. Now, in this case PHPFog does bear some responsibility, because they have a duty to protect their customers as well as possible, and from reading about how this happened, it sounds like they were amazingly sloppy and irresponsible about it (passwords stored in the clear on the server, passwords shared between various accounts, leaving unsecured shared systems running after beta launch, etc). But that doesn't reduce the culpability of the attackers; they acted maliciously, with full knowledge of what they were doing, vandalized systems, changed passwords, and bragged about it.
- Confusion 16y ago
  These are 16 year old kids, old enough to know right from wrong [..] These kids were being assholes, but that does not warrant federal charges. The problem is that we can choose between unsatisfactory public shaming or thoroughly ruining their lives. There is no middle way, where they get an appropriate punishment, fitting the damage done. If harsh punishments were a deterrent, these kids would already have been deterred, because there are plenty of examples of teenagers harshly punished for relatively minor computerrelated crimes. I'd rather see them grow up to become, probably average, members of society. Also, whether they know right from wrong is a question whose answer definitely isn't as clear-cut as you make it out to be. There's a reason we don't consider them adults yet.
- Prisen 16y ago
code_duck 16y ago
It's pretty simple: both parties are to blame. PHP Fog did not do due diligence in securing their servers, and the attackers committed illegal and distasteful acts. If I leave my front door unlocked and someone walks in, there are several possibilities. If they just look around and leave, or say lock the knob behind them and walk out, that is one thing. If they smash my furniture and knock over all my plants, that was their choice, right? That action is illegal and immoral regardless of the fact that it was my negligence which made it possible. We all know these dumb kids should have reported the vulnerability responsibly. That would have benefited everyone, especially themselves. They might have been getting job offers instead of bad reputations.
ErrantX 16y ago
PHPFog fucked up security, that's a given. And they should be thinking carefully on the lessons learned from that. But your post seems to imply that the kids who did this have no responsibility for their actions; "it was just waiting to happen". This I strongly disagree with (not least because I work with 16 year old kids and they are completely able to take some level of responsibility for their actions). Sure, at 16 your world view is incomplete and you can make rash decisions ("for the lulz") that backfire bigger and faster than you imagine. On the other hand there is no doubt they knew the illegality and the ethical issues with undertaking this - even if only vaguely. And if they do not completely understand those issues, do you not think they should be taught them? As responsible adults we should be getting across to them in a sensible fashion that this was not a nice thing to do, and that the impact could have been a lot wider than it was. Because if we don't and next time they do some real damage, well, that was an opportunity lost. FWIW I think he crossed the line by causing damage. If I caught a kid breaking into my house I would probably drag him home to face his parents. But if he started smashing plates I'd be a little more pissed, that is a wanton act and probably needs a more severe punishment. Sure, criminal charges are a silly approach in this case (no need to ruin his life for one silly mistake). Call his parents, explain what has happened and then get him to do some sort of "community service". That's an important lesson in consequence. In this modern world 16 year olds are not nicking alcohol from the corner shop any more; they are breaking into websites. And that has potential for much more dramatic and widespread impact. We need to stop saying "oh, they're only kids". Instead we should recognise that 16 year old "hackers" exist on the internet and think of ways to communicate with them (ideally in a way that gives them an avenue for their curiosity without risking too much damage :)). Bottom line; a 16 year old kid is a far cry from your dog when it comes to the ability to "understand" what you have done. Just my 2p :)
gsk 16y ago
Wow, never seen condescension clothed so well before. You should realize that by saying "PHPFog is the only responsible party", you are open to some perverse accusations (like, if your kid turns out to be a criminal, you and the victims are completely to blame).
projectileboy 16y ago
If you were walking down the street and my 9-year-old daughter were to run up to you and stab you in the eye, is it your fault for not wearing a helmet? Everything is penetrable given enough time, money and patience. I agree that PHPFog made some mistakes, but it's not like they were being willfully negligent.

by parfe 16y ago

nbpoole 16y ago

"PHPFog built a castle out of sand and you're upset that a wave came and demolished it." Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own. "I don't get angry at my dog when he shits in the house. Being angry at something that can't understand only satisfies the urge to shift blame." While some HN posters might feel the the 16 year olds involved in this incident have the same mental capacity as your dog, I'd like to give them slightly more credit. ;) I can only speak for myself here, but I do think the people involved in compromising PHP Fog should be punished. No, I don't think they should get life in prison (</hyperbole>): I hope they can learn from their mistakes. However, they did commit a crime, as they've admitted both here and elsewhere online. They should be capable of understanding that their actions have consequences, so I think some consequences are in order. What those consequences should be is up to PHP Fog.

Helianthus16 16y ago
From the perspective of security protection, intrusions are an act of nature. You should be no more surprised at an especially strong wave than you are at an exceptionally immature child.
- nbpoole 16y ago
  I don't think we're using the same definition of "act of nature": http://en.wikipedia.org/wiki/Act_of_God http://en.wikipedia.org/wiki/Act_of_God "Act of God is a legal term for events outside of human control, such as sudden floods or other natural disasters, for which no one can be held responsible" Do you think nobody can be held responsible for this breach?
  - Helianthus16 16y ago
    You're right, we're not using the same definition. That doesn't mean I don't have a point.
    - nbpoole 16y ago
      Of course. I guess I'm not clear what your point is though.
      - Helianthus16 16y ago
        My point is that you must treat intrusions as an inevitability when trying to counteract intrusion. And anyone who builds a sandcastle should be aware of the ocean. The kid's breaking into this account is embarrassing. Just because we can hold individual humans accountable (and should) doesn't mean we shouldn't have the perspective of "CONSTANT VIGILANCE."
        jamesbkel 16y ago
        Still, does that really hold up? Certainly should have to treat intrusions as inevitable in designing the system, but there still is responsibility on the part of the intruder. I lock my door because I consider it inevitable that someone will eventually try and break in. However, if someone does break into and vandalize my apartment, I sure as hell would consider them responsible and not consider in an act of God.
        pyre 16y ago
_delirium 16y ago
Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else's sandcastle because he can't build his own. In terms of moral culpability, sure. But when I put systems on the internet, I basically treat "intrusion attempts" as in practice part of the environment, like "mosquito bites" are in Texas. Perhaps they're best thought of as kids knocking down sandcastles rather than ocean waves, but their ubiquity makes them feel more like ocean waves, because you can basically assume that there are tons of those kids, and they're going to kick at your sandcastle every day. The fact that there's a whole ecosystem of bots running automated intrusion attempts makes them feel a little bit force-of-nature-ish as well. If you lived in some neighborhood where thousands of roving robots were constantly checking doors to see if they could find an unlocked one, you'd have to treat "roving robots" as a quasi force of nature. Well, either that, or come up with a policing method that finds the controller of the robots and shuts them down, but I have relatively low hopes for how much of a dent "cybercrime" policing will make in the overall online-intrusion ecosystem.

dolinsky 16y ago

I'm sorry, but in between your Straw Man argument and your indirect Ad Hominem attack, I fail to see you address the point that these kids caused harm to a business. Nowhere did I say that PHPFog bears no responsibility for the security of their service, but that doesn't excuse what these kids did one bit. I'm just much more impressed with the way that PHPFog is handling their business after the fact than these kids are. Nowhere did I suggest that these kids lives should be destroyed, however I do believe they most definitely need to be held accountable for their actions. PHPFog will be held accountable for their actions by whether or not businesses decide to do business with them going forward. Both parties bear responsibility, and it's absurd to think otherwise.

parfe 16y ago
>I fail to see you address the point that these kids caused harm to a business Very well. These kids caused harm to a business. So what's that change? The business screwed up, badly. The agent of destruction is quite irrelevant. Had it been a power failure, backup failure, permissions failure, data leak, or data corruption would PHPFog deserve any less blame? This need to shift some responsibility to a bunch of kids is nauseating. >I'm just much more impressed with the way that PHPFog is handling their business after the fact than these kids are. This is another example of the weird HN mentality when it comes to companies "apologizing" (Like WakeMate blaming their Chinese manufacturer for flunky power supplies). Are you actually impressed that a corporation has better PR than a bunch of children? Does that even make sense to you? I'd be impressed if they had managed to actually apologize while accepting all the blame without trying to pawn off the responsibility for their mistakes on some kids.
- lambda 16y ago
  > This need to shift some responsibility to a bunch of kids is nauseating. They aren't shifting responsibility. The kids are responsible for their own actions. They did something illegal. They are responsible for it. Now, PHPFog is also responsible for protecting their customers; they are supposed to provide a secure hosting environment. PHPFog is a victim here, but has also acted irresponsibly with regards to security (not criminally irresponsibly, but if harm did come to their customers due to this, there could be possible civil liability). The fact that PHPFog bears some blame for their security practices doesn't take responsibility off the kids who broke in and vandalized their systems.

dasil003 16y ago

> PHPFog built a castle out of sand and you're upset that a wave came and demolished it. Technology analogies invariably suck, but I'm pretty sure this is provably better: When a teenager smashes in a storefront window, do we say they should've had bars over it?

parfe 16y ago
>When a teenager smashes in a storefront window, do we say they should've had bars over it? Depends what's behind the storefront windows. On the other hand I can certainly agree that we stop with the technology analogies before a car analogy is let loose and someone gets hurt.
jammur 16y ago
The major problem with your analogy is that storefront windows don't have hundred or thousands of bricks thrown at them everyday. Web hosts are basically under constant attack. Would you suggest that the CIA, NSA, etc. not worry too much about their computer security? If not, then I don't see why you would imply a web host shouldn't be expected to secure their servers as much as possible either. If a storefront was under constant attack, then yes, they should have bars over it. In fact, in my hometown, there was a streak of vandalisms where kids were throwing bricks through windows. After getting hit 3 times, one store replaced their huge glass windows with smaller plexiglass ones.
- nbpoole 16y ago
  I think you're missing the point of the analogy. Check out http://en.wikipedia.org/w/index.php?title=Victim_blaming&oldid=419679081 http://en.wikipedia.org/w/index.php?title=Victim_blaming&#38...
  - parfe 16y ago
    Let's not forget that the victim here is PHPFog's (potential) customers and not PHPFog itself.
    - 16y ago

lambda 16y ago

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, rifling through a bunch of people's personal belongings, sticking signs in the windows saying "this building's landlords suck," and changing the locks on some of the doors to make it hard to clean up the whole mess. They absolutely are the responsible party; you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves. If I accidentally leave my door unlocked one day, that does not make it suddenly OK to come in and take my stuff and it's my fault for not having locked my door, instead of yours for taking my stuff. Now, in this case PHPFog does bear some responsibility, because they have a duty to protect their customers as well as possible, and from reading about how this happened, it sounds like they were amazingly sloppy and irresponsible about it (passwords stored in the clear on the server, passwords shared between various accounts, leaving unsecured shared systems running after beta launch, etc). But that doesn't reduce the culpability of the attackers; they acted maliciously, with full knowledge of what they were doing, vandalized systems, changed passwords, and bragged about it.

Confusion 16y ago
These are 16 year old kids, old enough to know right from wrong [..] These kids were being assholes, but that does not warrant federal charges. The problem is that we can choose between unsatisfactory public shaming or thoroughly ruining their lives. There is no middle way, where they get an appropriate punishment, fitting the damage done. If harsh punishments were a deterrent, these kids would already have been deterred, because there are plenty of examples of teenagers harshly punished for relatively minor computerrelated crimes. I'd rather see them grow up to become, probably average, members of society. Also, whether they know right from wrong is a question whose answer definitely isn't as clear-cut as you make it out to be. There's a reason we don't consider them adults yet.
Prisen 16y ago

code_duck 16y ago

It's pretty simple: both parties are to blame. PHP Fog did not do due diligence in securing their servers, and the attackers committed illegal and distasteful acts. If I leave my front door unlocked and someone walks in, there are several possibilities. If they just look around and leave, or say lock the knob behind them and walk out, that is one thing. If they smash my furniture and knock over all my plants, that was their choice, right? That action is illegal and immoral regardless of the fact that it was my negligence which made it possible. We all know these dumb kids should have reported the vulnerability responsibly. That would have benefited everyone, especially themselves. They might have been getting job offers instead of bad reputations.

ErrantX 16y ago

PHPFog fucked up security, that's a given. And they should be thinking carefully on the lessons learned from that. But your post seems to imply that the kids who did this have no responsibility for their actions; "it was just waiting to happen". This I strongly disagree with (not least because I work with 16 year old kids and they are completely able to take some level of responsibility for their actions). Sure, at 16 your world view is incomplete and you can make rash decisions ("for the lulz") that backfire bigger and faster than you imagine. On the other hand there is no doubt they knew the illegality and the ethical issues with undertaking this - even if only vaguely. And if they do not completely understand those issues, do you not think they should be taught them? As responsible adults we should be getting across to them in a sensible fashion that this was not a nice thing to do, and that the impact could have been a lot wider than it was. Because if we don't and next time they do some real damage, well, that was an opportunity lost. FWIW I think he crossed the line by causing damage. If I caught a kid breaking into my house I would probably drag him home to face his parents. But if he started smashing plates I'd be a little more pissed, that is a wanton act and probably needs a more severe punishment. Sure, criminal charges are a silly approach in this case (no need to ruin his life for one silly mistake). Call his parents, explain what has happened and then get him to do some sort of "community service". That's an important lesson in consequence. In this modern world 16 year olds are not nicking alcohol from the corner shop any more; they are breaking into websites. And that has potential for much more dramatic and widespread impact. We need to stop saying "oh, they're only kids". Instead we should recognise that 16 year old "hackers" exist on the internet and think of ways to communicate with them (ideally in a way that gives them an avenue for their curiosity without risking too much damage :)). Bottom line; a 16 year old kid is a far cry from your dog when it comes to the ability to "understand" what you have done. Just my 2p :)

gsk 16y ago

Wow, never seen condescension clothed so well before. You should realize that by saying "PHPFog is the only responsible party", you are open to some perverse accusations (like, if your kid turns out to be a criminal, you and the victims are completely to blame).

projectileboy 16y ago

If you were walking down the street and my 9-year-old daughter were to run up to you and stab you in the eye, is it your fault for not wearing a helmet? Everything is penetrable given enough time, money and patience. I agree that PHPFog made some mistakes, but it's not like they were being willfully negligent.