3 ms·

> Edwin’s actions, he charged, had been “malicious and deliberate” and caused “imminent danger to life”. If the script kiddie breaking in was being charged wit

> Edwin’s actions, he charged, had been “malicious and deliberate” and caused “imminent danger to life”. If the script kiddie breaking in was being charged with such serious crimes, what about the people who allowed this to happen > Scanning the rest of the network from the KPN machine he’d accessed, Edwin saw the obsolete software being used in hundreds of places. Almost every computer server in the telecom provider’s vast network had a window open. The kid from Barendrecht strolled around unimpeded, and what he saw astonished him. He could control 514 computer servers. He could even access the core router, the backbone of KPN’s entire network. He could see the data of 2.1 million KPN customers Their seriously negligent actions. This isn't someone exploiting a bug a couple of days after it came out, this is gross negligence of a system that, if hacked, can cause imminent danger to life.

ThrowawayR2 5y ago
> "what about the people who allowed this to happen" If you're expecting agreement, remember that you're on HN. As far as I can tell, most developers have been vocally and fervently against being held liable or even accountable for bugs, design defects, security issues, etc. <sotto voce> probably because, collectively, developers produce so many of them.
- teddyh 5y ago
  “HN” is probably against blaming programmers for bugs, since this would be blaming the lowest-level employees for something which can only realistically be fixed at the top level. Programmers have some blame in producing bugs, but that is mostly because they are not given the time, resources, incentives or training to do things right.
throwawaygh 5y ago
Indeed; Software Engineering and IT Admin need to be professionalized, in the sense that both individual practitioners and institutions take personal legal responsibility for the systems they implement. But also, gross negligence doesn't justify criminal trespass. You can't walk into someone's home and touch all their stuff just because they left their front door open.
- syshum 5y ago
  That is going to be very hard to do given that in most companies IT Admins and even software devs are not really in control to make security and other choices, we present options to business leaders who make the choice. My guess that if you look at the vast majority of security incidents it is not due to negligence on the part of an IT Worker but instead due the business choices to prioritize some new feature, or performance, or anything else over security. If you put the liability on the head if the IT guy/gal who has been saying "hey that system is insecure" only to be ignored by the business well that is a real good way worsen the shortage in qualified people. I sure as hell am not going to assume legal liability over systems I do not really have control over.
  - chucksta 5y ago
    Its not that hard, its up to the personnel to inform the company, and the company is liable. The book should be thrown twice as hard at a company which fails to acknowledge said IT. There is already SOX audit, and several others with clearly established rules and repercussions
    - syshum 5y ago
      You are at odds with both the Parent comment, and the other people have that replied They are not talking about holding the companies responsible, they are wanting to establish standard of government licensure similar to that of a Doctor, or Civil Engineer, there by making the INDIVIDUAL responsible not the company.
      - chucksta 5y ago
        Yeah, the odds being there is no point to holding an individual accountable, due to the reasons the comment I relied to. Especially when there are already systems in place which would solve the issue much easier. All parent will do is institute more government organizations and insurance
  - setr 5y ago

ThrowawayR2 5y ago

> "what about the people who allowed this to happen" If you're expecting agreement, remember that you're on HN. As far as I can tell, most developers have been vocally and fervently against being held liable or even accountable for bugs, design defects, security issues, etc. <sotto voce> probably because, collectively, developers produce so many of them.

teddyh 5y ago
“HN” is probably against blaming programmers for bugs, since this would be blaming the lowest-level employees for something which can only realistically be fixed at the top level. Programmers have some blame in producing bugs, but that is mostly because they are not given the time, resources, incentives or training to do things right.

throwawaygh 5y ago

Indeed; Software Engineering and IT Admin need to be professionalized, in the sense that both individual practitioners and institutions take personal legal responsibility for the systems they implement. But also, gross negligence doesn't justify criminal trespass. You can't walk into someone's home and touch all their stuff just because they left their front door open.

syshum 5y ago
That is going to be very hard to do given that in most companies IT Admins and even software devs are not really in control to make security and other choices, we present options to business leaders who make the choice. My guess that if you look at the vast majority of security incidents it is not due to negligence on the part of an IT Worker but instead due the business choices to prioritize some new feature, or performance, or anything else over security. If you put the liability on the head if the IT guy/gal who has been saying "hey that system is insecure" only to be ignored by the business well that is a real good way worsen the shortage in qualified people. I sure as hell am not going to assume legal liability over systems I do not really have control over.
- chucksta 5y ago
  Its not that hard, its up to the personnel to inform the company, and the company is liable. The book should be thrown twice as hard at a company which fails to acknowledge said IT. There is already SOX audit, and several others with clearly established rules and repercussions
  - syshum 5y ago
    You are at odds with both the Parent comment, and the other people have that replied They are not talking about holding the companies responsible, they are wanting to establish standard of government licensure similar to that of a Doctor, or Civil Engineer, there by making the INDIVIDUAL responsible not the company.
    - chucksta 5y ago
      Yeah, the odds being there is no point to holding an individual accountable, due to the reasons the comment I relied to. Especially when there are already systems in place which would solve the issue much easier. All parent will do is institute more government organizations and insurance
- setr 5y ago