5 ms·

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhoo

Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situation.

cm2187 6y ago
I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.
- gwright 6y ago
  Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.
  - wolco 6y ago
    Thr victims are the unaware customers who's data has been stolen because the company wasn't providing security. If a business left the store open with the customers credit cards details on display. Anyone passing by can go in and copy that info. Someone sees this and burns the exposed records. Perhaps they helped the victim. Remember no one burned the store down or the table holding the records. They burned only the exposed records.
    - gwright 6y ago
      You don't know who was the storage vendor and who's data was being deleted and you have no idea what that data represents or what the consequences are of having to restore it. You are making several unfounded assumptions.
      - wolco 6y ago
        No one knows more information than the article presents. When you state that victims exist or that the data being deleted is important you are also making unfounded assumptions. You can't have it both ways.
        gwright 6y ago
        I think it is entirely reasonable to start with the presumption that people have a right to their data and to their property, that it is valuable to them.
        wolco 6y ago
        If a site/service has a right to allow a person to delete data. The machine can be setup however they like. These are not hacked databases. The system said welcome what do you want to do? You can read everything or delete everything or add anything. So they did.
        cryptoz 6y ago
        > These are not hacked databases. Yes they are. The method of the hack was 'simple' to you, but that doesn't mean it's just magically not a hack any more. These are hacked databases. > The system said welcome what do you want to do? You can read everything or delete everything or add anything. I don't understand this. Are you suggesting that the attackers were greeted by the database with an English-language legal directive of what legal permissions they had in the database? What do you mean by this statement? Surely the databases said no such thing. If you're implying that a private door with no lock is not private but actually shared property that can be destroyed or added to in any way, then I think you're wrong. None of this comment makes sense to me. An unsecured database holding private data, or an unlocked door to a private business or building, is not an open legal invitation for vandalism.
        wolco 6y ago
        If you attempt to connect to a database the database will greet you. It can be configured to ask for a login. It can be configured to have no login. If it doesn't have a login and gives you a welcome prompt it's not called hacking. In order to hack something it needed to be secured to start with. Databases do greet users in mostly english. Need help? Type help. On the list of things the system allows deleting data appeared to be one. If you knock on a door and the door opens and says welcome what do you want to do (delete data, read data) and you pick delete it doesn't mean it's illegal vandalism.
  - deleted 6y ago
    [deleted]
  - ThrowawayR2 6y ago
    These aren't victims; they were harmed through their own gross negligence or the gross negligence of the developer they employed.
    - gwright 6y ago
      They aren't victims? If you forget to lock your car door and it is stolen or something inside it is stolen are you also not a victim by your logic?
rytis 6y ago
Except that I didn’t leave the doors open. Someone I trusted with the keys, left them in their safe. Unlocked. So I rather have their whole place burned down and MY keys melted at the same time.
- gwright 6y ago
  You are suggesting that it was just "keys" but that isn't the case here. You don't know what type of data is being destroyed. A better example might be a storage unit service that left the front gate unlocked. If someone torches the place to illustrate that they need better security would you be comfortable with that? Isn't there a better approach that we should encourage or is OK to encourage people to destroy things that aren't protected to teach people "lessons"?
  - rytis 6y ago
    Maybe. However, if this was my diary or photoalbum, bank statements, medical reports or anything of that sort I’d rather have them destroyed than knowing that they may have been copied... The lesson is not for the people, it’s for the companies that take shortcuts to save money. It for the MBA’s that think things don’t have to be properly engineered.
    - gwright 6y ago
      So you are rationalizing a crime because it teaches companies a lesson? That is a crazy rejection of the rule of law. Would you be comfortable in applying that logic to all crimes?
      - smichel17 6y ago
        I'm not gp, but let's take a step back for a sec. (I've mostly lived in the northeastern US) I live in a small (~20k population) rural technically-city (but... it's a town) where crime is not much of an issue; my car sits unlocked in my driveway and I seldom lock my house -- when I do, it's almost always when I'm at home (alone) -- it's about a feeling of security, not any real risk of a break-in. I've lived this way in this town for many years and have never experienced a robbery. I think it's pretty low risk, not irresponsible. I've also lived in a larger city. There, I absolutely locked my doors. And I've traveled to tourist-y locations known for pickpockets, and kept an even closer watch on my belongings. The internet is two orders of magnitude larger than the world's largest city and policing it is exceptionally difficult, since it spans national borders. There will be crime. I wish this weren't the case. I much prefer living in a safe place where I don't have to worry about locking my doors when I go out. But when crime is common, it's negligent not to protect against it.
sinsterizme 6y ago
I think the major difference is that losing my house along with all my belongings is much worse than losing just some of my belongings. Also data being exposed publicly can be used nefariously by multiple parties, so is likely worse in most scenarios compared to just outright deletion of the data
- gwright 6y ago
  Ok, but losing "just some of your belongings" is bad also, right? When thinking about the culpability of the person deleting the data or storing the data, we have to start from the assumption that the owner of the data values it. Whatever analysis you want to put on the situation I don't think it is reasonable to start with the idea that some of the data might not be that valuable.
  - zentiggr 6y ago
    Either the data is something public (name, address, etc) in which case, whatever. Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience. Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.
    - gwright 6y ago
      Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.
      - jessaustin 6y ago
        ...wrong regardless... That obviously isn't true. Some data shouldn't exist: CP. Some data can exist, but it's backed-up so well that deletion is never a problem. For example, I'm not going to forget my birth date any time soon! In fact, very little of the information that businesses have about me needs preservation. I remember it all, and if I decide the business still deserves it I can give it to them again. It is of course possible that some of this data didn't need to be kept private, and therefore shouldn't have been deleted. Maybe some medical researchers had compiled the data they needed to formulate the ultimate cure to COVID-19? (I hope they had anonymized all the patient data!) Until those researchers come forward to lament humanity's loss, I'll just assume that all the "victims" who don't want to go into too much detail about the "lost" data were playing fast and loose with their customers' private information.
lallysingh 6y ago
The first crime committed was leaving people's data out in the open. If someone had a list of names/birthdays/SSNs posted on their door, I'm not too unhappy if someone blacks out every line with the word 'meow.'
- gwright 6y ago
  Not sure why you are focusing on the PII scenario. The original report seems to say it is just "unsecured databases" and not databases that have PII information posted. You are also making an subtle assumption that the service is being administered by a 3rd party. Could be that the service is being administered by the owner of the data. In any case it is still wrong to delete the data.
  - lallysingh 6y ago
    The folks hit didn't have backups (if they did, well anyone can restore them), nor did they secure their db. One is forgivable. Both together get no sympathy from me. Rather disgust that some of them had PII from customers that trusted them.
    - gwright 6y ago
      More justification that this is an appropriate way to teach people a lesson. You don't seem to care at all what the impact might be on those affected. You are in affect encouraging the criminal behavior because the ends justify the means, apparently. While I understand the concern that organizations aren't taking proper care to protect their data I think legitimizing vigilante punishment for those mistakes is a very problematic stance.
      - lallysingh 6y ago
        I'm a huge thought-criminal. A threat to the state!
- umvi 6y ago
  It's literally any unsecured database, not just databases containing PII. What if you just have a toy database for a toy project on the public internet and some jerk just deletes it to "teach you a lesson"? It's like, gee, thanks...

cm2187 6y ago

I don't think the parent suggests it exonerates the hackers. Just that the clients are better off.

gwright 6y ago
Better off? The idea that victims deserve to be victimized because they didn't take enough care is trotted out every time a security issue comes up on HN.
- wolco 6y ago
  Thr victims are the unaware customers who's data has been stolen because the company wasn't providing security. If a business left the store open with the customers credit cards details on display. Anyone passing by can go in and copy that info. Someone sees this and burns the exposed records. Perhaps they helped the victim. Remember no one burned the store down or the table holding the records. They burned only the exposed records.
  - gwright 6y ago
    You don't know who was the storage vendor and who's data was being deleted and you have no idea what that data represents or what the consequences are of having to restore it. You are making several unfounded assumptions.
    - wolco 6y ago
      No one knows more information than the article presents. When you state that victims exist or that the data being deleted is important you are also making unfounded assumptions. You can't have it both ways.
      - gwright 6y ago
        I think it is entirely reasonable to start with the presumption that people have a right to their data and to their property, that it is valuable to them.
        wolco 6y ago
        If a site/service has a right to allow a person to delete data. The machine can be setup however they like. These are not hacked databases. The system said welcome what do you want to do? You can read everything or delete everything or add anything. So they did.
        cryptoz 6y ago
        > These are not hacked databases. Yes they are. The method of the hack was 'simple' to you, but that doesn't mean it's just magically not a hack any more. These are hacked databases. > The system said welcome what do you want to do? You can read everything or delete everything or add anything. I don't understand this. Are you suggesting that the attackers were greeted by the database with an English-language legal directive of what legal permissions they had in the database? What do you mean by this statement? Surely the databases said no such thing. If you're implying that a private door with no lock is not private but actually shared property that can be destroyed or added to in any way, then I think you're wrong. None of this comment makes sense to me. An unsecured database holding private data, or an unlocked door to a private business or building, is not an open legal invitation for vandalism.
        wolco 6y ago
        If you attempt to connect to a database the database will greet you. It can be configured to ask for a login. It can be configured to have no login. If it doesn't have a login and gives you a welcome prompt it's not called hacking. In order to hack something it needed to be secured to start with. Databases do greet users in mostly english. Need help? Type help. On the list of things the system allows deleting data appeared to be one. If you knock on a door and the door opens and says welcome what do you want to do (delete data, read data) and you pick delete it doesn't mean it's illegal vandalism.
- deleted 6y ago
  [deleted]
- ThrowawayR2 6y ago
  These aren't victims; they were harmed through their own gross negligence or the gross negligence of the developer they employed.
  - gwright 6y ago
    They aren't victims? If you forget to lock your car door and it is stolen or something inside it is stolen are you also not a victim by your logic?

rytis 6y ago

Except that I didn’t leave the doors open. Someone I trusted with the keys, left them in their safe. Unlocked. So I rather have their whole place burned down and MY keys melted at the same time.

gwright 6y ago
You are suggesting that it was just "keys" but that isn't the case here. You don't know what type of data is being destroyed. A better example might be a storage unit service that left the front gate unlocked. If someone torches the place to illustrate that they need better security would you be comfortable with that? Isn't there a better approach that we should encourage or is OK to encourage people to destroy things that aren't protected to teach people "lessons"?
- rytis 6y ago
  Maybe. However, if this was my diary or photoalbum, bank statements, medical reports or anything of that sort I’d rather have them destroyed than knowing that they may have been copied... The lesson is not for the people, it’s for the companies that take shortcuts to save money. It for the MBA’s that think things don’t have to be properly engineered.
  - gwright 6y ago
    So you are rationalizing a crime because it teaches companies a lesson? That is a crazy rejection of the rule of law. Would you be comfortable in applying that logic to all crimes?
    - smichel17 6y ago
      I'm not gp, but let's take a step back for a sec. (I've mostly lived in the northeastern US) I live in a small (~20k population) rural technically-city (but... it's a town) where crime is not much of an issue; my car sits unlocked in my driveway and I seldom lock my house -- when I do, it's almost always when I'm at home (alone) -- it's about a feeling of security, not any real risk of a break-in. I've lived this way in this town for many years and have never experienced a robbery. I think it's pretty low risk, not irresponsible. I've also lived in a larger city. There, I absolutely locked my doors. And I've traveled to tourist-y locations known for pickpockets, and kept an even closer watch on my belongings. The internet is two orders of magnitude larger than the world's largest city and policing it is exceptionally difficult, since it spans national borders. There will be crime. I wish this weren't the case. I much prefer living in a safe place where I don't have to worry about locking my doors when I go out. But when crime is common, it's negligent not to protect against it.

sinsterizme 6y ago

I think the major difference is that losing my house along with all my belongings is much worse than losing just some of my belongings. Also data being exposed publicly can be used nefariously by multiple parties, so is likely worse in most scenarios compared to just outright deletion of the data

gwright 6y ago
Ok, but losing "just some of your belongings" is bad also, right? When thinking about the culpability of the person deleting the data or storing the data, we have to start from the assumption that the owner of the data values it. Whatever analysis you want to put on the situation I don't think it is reasonable to start with the idea that some of the data might not be that valuable.
- zentiggr 6y ago
  Either the data is something public (name, address, etc) in which case, whatever. Or it's data that was gathered (in line of business, for example) and its destruction is anywhere from more secure to an inconvenience. Or it's data that was aggregated beyond legitimate use (hey, FAANG) and by all means, tear it the hell up and throw it away.
  - gwright 6y ago
    Why do you feel it is important to characterize the nature of the data? The unauthorized deletion is wrong regardless of the nature of the data.
    - jessaustin 6y ago
      ...wrong regardless... That obviously isn't true. Some data shouldn't exist: CP. Some data can exist, but it's backed-up so well that deletion is never a problem. For example, I'm not going to forget my birth date any time soon! In fact, very little of the information that businesses have about me needs preservation. I remember it all, and if I decide the business still deserves it I can give it to them again. It is of course possible that some of this data didn't need to be kept private, and therefore shouldn't have been deleted. Maybe some medical researchers had compiled the data they needed to formulate the ultimate cure to COVID-19? (I hope they had anonymized all the patient data!) Until those researchers come forward to lament humanity's loss, I'll just assume that all the "victims" who don't want to go into too much detail about the "lost" data were playing fast and loose with their customers' private information.

lallysingh 6y ago

The first crime committed was leaving people's data out in the open. If someone had a list of names/birthdays/SSNs posted on their door, I'm not too unhappy if someone blacks out every line with the word 'meow.'

gwright 6y ago
Not sure why you are focusing on the PII scenario. The original report seems to say it is just "unsecured databases" and not databases that have PII information posted. You are also making an subtle assumption that the service is being administered by a 3rd party. Could be that the service is being administered by the owner of the data. In any case it is still wrong to delete the data.
- lallysingh 6y ago
  The folks hit didn't have backups (if they did, well anyone can restore them), nor did they secure their db. One is forgivable. Both together get no sympathy from me. Rather disgust that some of them had PII from customers that trusted them.
  - gwright 6y ago
    More justification that this is an appropriate way to teach people a lesson. You don't seem to care at all what the impact might be on those affected. You are in affect encouraging the criminal behavior because the ends justify the means, apparently. While I understand the concern that organizations aren't taking proper care to protect their data I think legitimizing vigilante punishment for those mistakes is a very problematic stance.
    - lallysingh 6y ago
      I'm a huge thought-criminal. A threat to the state!
umvi 6y ago
It's literally any unsecured database, not just databases containing PII. What if you just have a toy database for a toy project on the public internet and some jerk just deletes it to "teach you a lesson"? It's like, gee, thanks...