4 ms·

> leak Auernheimer was a member of the hacker group known as "Goatse Security" that exposed a flaw in AT&T security in June 2010, which allowed the e-mail addre

by sofixa 5y ago

> leak Auernheimer was a member of the hacker group known as "Goatse Security" that exposed a flaw in AT&T security in June 2010, which allowed the e-mail addresses of iPad users to be revealed. The flaw was part of a publicly-accessible URL, which allowed the group to collect the e-mails without having to break into AT&T's system. Contrary to what it first claimed, the group revealed the security flaw to Gawker Media before AT&T had been notified, and also exposed the data of 114,000 iPad users, You know that someone leaving their front door open by accident is not an invitation or an excuse to enter and collect whatever you want, right? Especially when you're a complete and total piece of shit, some jail time is not an overreaction ( if it was a normal human being, leniency for a first offense is natural and to be expected). As for Sony execs, if only that was the first case white collar crime was brushed off.

makerofthings 5y ago
I’ve heard the “leaving your door open” thing before and I don’t think that’s a good analogy here. That’s not how the internet works. I send requests to other machines and ask them for stuff and whether they respond or not is on them. That some folks make terrible decisions when it comes to how they store their data isn’t really anyone else’s problem. A better analogy might be “In the uk, if you leave something on the pavement outside your house then you don’t want it anymore and it’s Ok if other people take it. I decided to leave a stack of personal data there and someone just took it.”
- lovehashbrowns 5y ago
  > I send requests to other machines and ask them for stuff and whether they respond or not is on them. So by this logic, SQL injection is perfectly fine? RCE is perfectly acceptable too? After all, my machine is just asking for stuff and the other machine is responding in a way its code tells it to. The open door analogy fits pretty well here, really. Just because you see an opening doesn’t mean you’re allowed in.
  - makerofthings 5y ago
    I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine. [ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ]
    - dylan604 5y ago
      >I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine With you so far... >[ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ] WTF?! Seriously? There's a huge difference by tweaking the content in a query string of a URL vs injecting known malicious code/content.
      - makerofthings 5y ago
        Yes, seriously, and I have thought about this a lot. I appreciate it’s not a popular position and I’m not likely to win any debates on the topic. If a computer is voluntarily connected to the internet then it’s there to explore and there should be no penalties for getting into those machines and looking around by connecting remotely. Malicious outcomes in the real world, obviously this is different. Hack in, look around, fine. Hack in, explode powerstation, not fine.
        SpikedCola 5y ago
        I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then dumping all the data and exorting the company with it, should definitely be.
        bentcorner 5y ago
        > Malicious outcomes in the real world, obviously this is different. I definitely agree with you on this point. If someone looked in my window from the street and saw me eating breakfast, no harm no foul. If I didn't want them to see me I should have closed the blinds. But if someone sets up a camera at the exact same spot and streams it to twitch, I feel like I should have some recourse. (I don't think, legally, I would, but ianal).
- kuroguro 5y ago
  I wonder how this works with scraping. If I automatically scrape and store sensitive data by accident, surely that would be the site's fault?
car_analogy 5y ago
> You know that someone leaving their front door open by accident is not an invitation or an excuse to enter and collect whatever you want, right? Did I claim it was? I accurately described the e-mails as "accidentally accessible" (since I don't think what weev did rises to the level of "using an exploit"), and contrasted the severity of the act with what Sony did, and the severity of its consequences for consumers with what Google and others routinely do. > Especially when you're a complete and total piece of shit Then charge him with "being a piece of shit". But given Sony's, Google's, Microsoft's,... general behavior, he's not the only one that could be accused of that.
Workaccount2 5y ago
It's like leaving the front door open for a laundromat. If it's open it's expected to be ok to enter and use. Both the internet and the laundromat go by "If it's publicly accessible, it's publicly available."
seanp2k2 5y ago
The AT&T emails were what they got him on, but they were mad at him for a lot more than that. Do some research if you’re curious. Smart guy with a lot of wasted potential.

by sofixa 5y ago

makerofthings 5y ago

I’ve heard the “leaving your door open” thing before and I don’t think that’s a good analogy here. That’s not how the internet works. I send requests to other machines and ask them for stuff and whether they respond or not is on them. That some folks make terrible decisions when it comes to how they store their data isn’t really anyone else’s problem. A better analogy might be “In the uk, if you leave something on the pavement outside your house then you don’t want it anymore and it’s Ok if other people take it. I decided to leave a stack of personal data there and someone just took it.”

lovehashbrowns 5y ago
> I send requests to other machines and ask them for stuff and whether they respond or not is on them. So by this logic, SQL injection is perfectly fine? RCE is perfectly acceptable too? After all, my machine is just asking for stuff and the other machine is responding in a way its code tells it to. The open door analogy fits pretty well here, really. Just because you see an opening doesn’t mean you’re allowed in.
- makerofthings 5y ago
  I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine. [ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ]
  - dylan604 5y ago
    >I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine With you so far... >[ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ] WTF?! Seriously? There's a huge difference by tweaking the content in a query string of a URL vs injecting known malicious code/content.
    - makerofthings 5y ago
      Yes, seriously, and I have thought about this a lot. I appreciate it’s not a popular position and I’m not likely to win any debates on the topic. If a computer is voluntarily connected to the internet then it’s there to explore and there should be no penalties for getting into those machines and looking around by connecting remotely. Malicious outcomes in the real world, obviously this is different. Hack in, look around, fine. Hack in, explode powerstation, not fine.
      - SpikedCola 5y ago
        I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then dumping all the data and exorting the company with it, should definitely be.
      - bentcorner 5y ago
        > Malicious outcomes in the real world, obviously this is different. I definitely agree with you on this point. If someone looked in my window from the street and saw me eating breakfast, no harm no foul. If I didn't want them to see me I should have closed the blinds. But if someone sets up a camera at the exact same spot and streams it to twitch, I feel like I should have some recourse. (I don't think, legally, I would, but ianal).
kuroguro 5y ago
I wonder how this works with scraping. If I automatically scrape and store sensitive data by accident, surely that would be the site's fault?

car_analogy 5y ago

> You know that someone leaving their front door open by accident is not an invitation or an excuse to enter and collect whatever you want, right? Did I claim it was? I accurately described the e-mails as "accidentally accessible" (since I don't think what weev did rises to the level of "using an exploit"), and contrasted the severity of the act with what Sony did, and the severity of its consequences for consumers with what Google and others routinely do. > Especially when you're a complete and total piece of shit Then charge him with "being a piece of shit". But given Sony's, Google's, Microsoft's,... general behavior, he's not the only one that could be accused of that.

Workaccount2 5y ago

It's like leaving the front door open for a laundromat. If it's open it's expected to be ok to enter and use. Both the internet and the laundromat go by "If it's publicly accessible, it's publicly available."

seanp2k2 5y ago

The AT&T emails were what they got him on, but they were mad at him for a lot more than that. Do some research if you’re curious. Smart guy with a lot of wasted potential.