6 ms·

Given the recent story on HN about how former YouSendIt founder had taken their servers down to prove their vulnerability [1] [2], I'm surprised how little reve

Given the recent story on HN about how former YouSendIt founder had taken their servers down to prove their vulnerability [1] [2], I'm surprised how little reverence these "lol-hackers" (that's going to be my term for them) give to showcasing these vulnerabilities by exploiting them in the real-world and messing with people's real things. I know as hackers, we feel a duty to show people how serious these things are and that we get impatient and annoyed when ignored. And I also know that it's hard for us to reconcile the idea that when we show the owners rather than tell, it's suddenly considered a crime. But it is. Let's try an analogy. Door locks on houses are ineffective. Think about it. Your house is covered with windows, which are made of glass. Glass is really easy to break. I mean really easy. If you found out your neighbor didn't have a house alarm, you might talk to them and tell them they should get one. If they didn't get one, would you then break into their house one night and walk into their bedroom to show them how dangerous it is? OK, who knows, maybe you have a weird relationship with your neighbor. Furthermore, this is an imperfect analogy, because here, Rails and Github are both responsible for other people's property. But now imagine it's a business across town and that you don't actually know the business owner. If you broke into their business to show them their building's security vulnerabilities, you bet your ass they would press charges and I don't think anyone would blame them. Even if you're doing it with the best intentions, it's still vandalism at best. All of that being said, this is a very effective way of making your point and getting people to fix the problem. That doesn't make it right. But if you're willing to put yourself in harm's way and essentially become a martyr to get these security vulnerabilities fixed, more power to you. [1] http://news.ycombinator.com/item?id=3643102 http://news.ycombinator.com/item?id=3643102 [2] http://www.inc.com/magazine/201203/burt-helm/a-silicon-valley-tale-of-humiliation-and-revenge.html http://www.inc.com/magazine/201203/burt-helm/a-silicon-valle...

marshray 15y ago
Door locks on physical houses are just a small part of a much greater security picture involving your community, observant neighbors, other monitoring systems, the police, even dogs. And yes, houses do get broken into causing a massive amount of aggregate economic loss every year. But on the internet everyone's front door is accessible from even the most remote and hostile places in the world and you're pretty much on your own for securing it. Internet-facing systems also tend hold far more valuable things than your typical home. For these reasons, I don't think the household lock analogy works very well.
- JangoSteve 15y ago
  EDIT 2: Hmm, maybe I shouldn't have removed my original response, I just didn't want to derail the conversation upon second thought. For posterity's sake, my original response was something along the lines of this: --- I think you may be overestimating the effects of "the greater security picture" involving community, observant neighbors, other monitoring systems for the average community. For example, my first startup was RateMyStudentRental.com, and as I recall adding automated motion-activated sensors and lighting actually had a negative effect on break-in protection. As in, adding such a system actually increased your chances of having a break-in. According to the study, neighbors don't actually pay much attention to someone standing at a well-lit door (mileage varying based on the specific community obviously). --- ORIGINAL EDIT: I won't comment on the technicality of the differences between the analogous situation and the actual situation at hand; the differences have nothing to do with the point being made. Don't get caught up in the analogy, because it's just an analogy. In case it wasn't clear the first time around, the entire point of the analogy was that, breaking into and vandalizing someone's business just to show them that it can be done is generally a bad idea. Though I don't think anyone would argue it isn't effective.
  - humbledrone 15y ago
    > [...] automated lighting systems actually have a negative effect on break-in protection [...] Do you have a source for this? I've always been under the commonly held impression that this has a preventative effect, and it would be very interesting if the opposite really is true.
    - JangoSteve 15y ago
      Good question. It was a long time ago, and I'm having trouble googling for it, because all I get in search results are articles and how-tos by motion-sensor companies selling their products. I'll search though and update if I find it. UPDATE: Hey, awesome, turns out we blogged about it back in the day: http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-is-a-happy-home-well-it-helps-anyway/ http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-i... Here is the original article: http://www.schneier.com/blog/archives/2007/09/light_and_crime.html http://www.schneier.com/blog/archives/2007/09/light_and_crim... Much so-called security lighting is designed with little thought for how eyes -- or criminals -- operate. Marcus Felson, a professor at the School of Criminal Justice at Rutgers University, has concluded that lighting is effective in preventing crime mainly if it enables people to notice criminal activity as it's taking place, and if it doesn't help criminals to see what they're doing. Bright, unshielded floodlights -- one of the most common types of outdoor security lighting in the country -- often fail on both counts, as do all-night lights installed on isolated structures or on parts of buildings that can't be observed by passersby (such as back doors). A burglar who is forced to use a flashlight, or whose movement triggers a security light controlled by an infrared motion sensor, is much more likely to be spotted than one whose presence is masked by the blinding glare of a poorly placed metal halide "wall pack." In the early seventies, the public-school system in San Antonio, Texas, began leaving many of its school buildings, parking lots, and other property dark at night and found that the no-lights policy not only reduced energy costs but also dramatically cut vandalism. I remembered it incorrectly, as apparently motion-activated lighting helps, but on-all-night floodlighting makes the situation worse.
ben0x539 15y ago
Breaking some poor dude's window probably causes a whole bunch more economic damage than a spurious commit into a github repos.
- marshray 15y ago
  Do you have any idea how much it costs to clean up after an "intrusion" or "data breach"? Of course, it's unfair to blame all those costs on the guy who had to go as far as actually escalating his privileges in order to unmask the Rails developers for being such knuckleheads.
  - ben0x539 15y ago
    As I understand it, for all you know, there were other intrusions anyway and you'd have to go looking for them and clean up after them anyway as soon as you learned that there was an exploit. Whether one dude actually posted something under someone else's name doesn't affect that there has been a huge hole in github for (apparently?) years.
    - marshray 15y ago
      Right. As if this guy who reported it was the only one at the time who could have pwned Github with it. For all we know, this bug has been abused for a long time to commit backdoors to other projects (perhaps those too big and active to notice).
  - smsm42 15y ago
    Cleaning up after the breach constitutes of two parts: 1. Changing passwords, removing unauthorized changes/fraudulent transactions, etc. dealing with evil people accessing info that shouldn't be accessed. 2. Notifying clients of vulnerability existence, securing the system properly and changing procedures so that such kind of breach would have less chance of happening again. In the white hat scenario, the first part does not exist and the white hat does not actually do anything harmful. The second part still exists and can cost tons of money, but this part is not the fault of the person who found the problem. So while the costs _after_ a benign "intrusion" like was done to Github can be substantial - both in money and reputation, the costs _because_ of it are much less, since most of the costs weren't caused by it, it only exposed the pre-existing need of bear those costs. Like a doctor diagnosing somebody with serious illness - he's not at fault that the person now has to spend tons of money on drugs and medical procedures.
sek 15y ago
This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did. You have to assume every exploit will be abused. The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way. I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.
- JangoSteve 15y ago
  I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them. I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.
  - sek 15y ago
    You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.
    - JangoSteve 15y ago
      Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).
ktizo 15y ago
If he used a known vulnerability to break into github, then he didn't break in, he walked in. Admittedly he did then do the online equivalent of pissing on the wall, so minus several million points for artistic endeavor.
- JangoSteve 15y ago
  It's more of a legal grey area I think. If I climb through an unlocked window of a company to enter a restricted area for which I don't have access, and then write (or piss) on the wall, I think it still counts as breaking and entering. Or trespassing and vandalism at least. I don't think I'm going to take this analogy any further though; things get dangerous when you base an argument entirely on analogy.
  - ktizo 15y ago
    I wonder what the Young's modulus of an analogy is ;)
  - Drbble 15y ago
    It's obviously not "breaking". In fact "breaking" is the difference between burglary and theft, and theft insurance is way more expensive than burglary insurance (which I experienced today reading an insurance offer) , because theft is nearly impossible to prove and usually due to the victim's negligence.
    - JangoSteve 15y ago
      In the legal sense, you don't need to literally break something for it to be breaking in entering. From the legal-dictionary [1]: breaking and entering v., n. entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary. If there is no such intent, the breaking and entering alone is probably at least illegal trespass, which is a misdemeanor crime. [1] http://legal-dictionary.thefreedictionary.com/breaking+and+entering http://legal-dictionary.thefreedictionary.com/breaking+and+e...
ricardobeat 15y ago
Terrible analogy. More like someone's automatic door lock is opening by itself at random times of the day, and the owner doesn't believe it, so you leave a note on the inside. It's creepy, but not wrong.
- baq 15y ago
  but the owner doesn't know that. he has to assume you left a bomb under the passenger's seat, left illicit substances in hard to get spots and put a potato in the exhaust.
  - fluidcruft 15y ago
    So...? The owner has to assume that anyway because they relied on faulty security. Assuming they even care--and honestly why would you think they care now when the evidence is they have not cared about this for at least months.
wisty 15y ago
There's an old debate over what constitutes "gray hat" hacking, and whether it's moral. I haven't looked at Egor's actions too closely, but he seems fairly close to a "white hat". He's been a bit immature, and so has Github, but there's been no real lasting damage. Anyone who's written a web app knows that mistakes can happen, and they take time to fix. I'm sure Github will handle the PR crisis with an informative and unbiased mea culpa (even if they secretly think Egor was a bit brash). People will keep using them, because their interface rocks. This will stay on the front page for about 24 hours, then there will be a few link bait articles that also cash in on it, but that's about it.

marshray 15y ago

Door locks on physical houses are just a small part of a much greater security picture involving your community, observant neighbors, other monitoring systems, the police, even dogs. And yes, houses do get broken into causing a massive amount of aggregate economic loss every year. But on the internet everyone's front door is accessible from even the most remote and hostile places in the world and you're pretty much on your own for securing it. Internet-facing systems also tend hold far more valuable things than your typical home. For these reasons, I don't think the household lock analogy works very well.

JangoSteve 15y ago
EDIT 2: Hmm, maybe I shouldn't have removed my original response, I just didn't want to derail the conversation upon second thought. For posterity's sake, my original response was something along the lines of this: --- I think you may be overestimating the effects of "the greater security picture" involving community, observant neighbors, other monitoring systems for the average community. For example, my first startup was RateMyStudentRental.com, and as I recall adding automated motion-activated sensors and lighting actually had a negative effect on break-in protection. As in, adding such a system actually increased your chances of having a break-in. According to the study, neighbors don't actually pay much attention to someone standing at a well-lit door (mileage varying based on the specific community obviously). --- ORIGINAL EDIT: I won't comment on the technicality of the differences between the analogous situation and the actual situation at hand; the differences have nothing to do with the point being made. Don't get caught up in the analogy, because it's just an analogy. In case it wasn't clear the first time around, the entire point of the analogy was that, breaking into and vandalizing someone's business just to show them that it can be done is generally a bad idea. Though I don't think anyone would argue it isn't effective.
- humbledrone 15y ago
  > [...] automated lighting systems actually have a negative effect on break-in protection [...] Do you have a source for this? I've always been under the commonly held impression that this has a preventative effect, and it would be very interesting if the opposite really is true.
  - JangoSteve 15y ago
    Good question. It was a long time ago, and I'm having trouble googling for it, because all I get in search results are articles and how-tos by motion-sensor companies selling their products. I'll search though and update if I find it. UPDATE: Hey, awesome, turns out we blogged about it back in the day: http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-is-a-happy-home-well-it-helps-anyway/ http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-i... Here is the original article: http://www.schneier.com/blog/archives/2007/09/light_and_crime.html http://www.schneier.com/blog/archives/2007/09/light_and_crim... Much so-called security lighting is designed with little thought for how eyes -- or criminals -- operate. Marcus Felson, a professor at the School of Criminal Justice at Rutgers University, has concluded that lighting is effective in preventing crime mainly if it enables people to notice criminal activity as it's taking place, and if it doesn't help criminals to see what they're doing. Bright, unshielded floodlights -- one of the most common types of outdoor security lighting in the country -- often fail on both counts, as do all-night lights installed on isolated structures or on parts of buildings that can't be observed by passersby (such as back doors). A burglar who is forced to use a flashlight, or whose movement triggers a security light controlled by an infrared motion sensor, is much more likely to be spotted than one whose presence is masked by the blinding glare of a poorly placed metal halide "wall pack." In the early seventies, the public-school system in San Antonio, Texas, began leaving many of its school buildings, parking lots, and other property dark at night and found that the no-lights policy not only reduced energy costs but also dramatically cut vandalism. I remembered it incorrectly, as apparently motion-activated lighting helps, but on-all-night floodlighting makes the situation worse.

ben0x539 15y ago

Breaking some poor dude's window probably causes a whole bunch more economic damage than a spurious commit into a github repos.

marshray 15y ago
Do you have any idea how much it costs to clean up after an "intrusion" or "data breach"? Of course, it's unfair to blame all those costs on the guy who had to go as far as actually escalating his privileges in order to unmask the Rails developers for being such knuckleheads.
- ben0x539 15y ago
  As I understand it, for all you know, there were other intrusions anyway and you'd have to go looking for them and clean up after them anyway as soon as you learned that there was an exploit. Whether one dude actually posted something under someone else's name doesn't affect that there has been a huge hole in github for (apparently?) years.
  - marshray 15y ago
    Right. As if this guy who reported it was the only one at the time who could have pwned Github with it. For all we know, this bug has been abused for a long time to commit backdoors to other projects (perhaps those too big and active to notice).
- smsm42 15y ago
  Cleaning up after the breach constitutes of two parts: 1. Changing passwords, removing unauthorized changes/fraudulent transactions, etc. dealing with evil people accessing info that shouldn't be accessed. 2. Notifying clients of vulnerability existence, securing the system properly and changing procedures so that such kind of breach would have less chance of happening again. In the white hat scenario, the first part does not exist and the white hat does not actually do anything harmful. The second part still exists and can cost tons of money, but this part is not the fault of the person who found the problem. So while the costs _after_ a benign "intrusion" like was done to Github can be substantial - both in money and reputation, the costs _because_ of it are much less, since most of the costs weren't caused by it, it only exposed the pre-existing need of bear those costs. Like a doctor diagnosing somebody with serious illness - he's not at fault that the person now has to spend tons of money on drugs and medical procedures.

sek 15y ago

This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did. You have to assume every exploit will be abused. The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way. I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.

JangoSteve 15y ago
I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them. I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.
- sek 15y ago
  You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.
  - JangoSteve 15y ago
    Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).

ktizo 15y ago

If he used a known vulnerability to break into github, then he didn't break in, he walked in. Admittedly he did then do the online equivalent of pissing on the wall, so minus several million points for artistic endeavor.

JangoSteve 15y ago
It's more of a legal grey area I think. If I climb through an unlocked window of a company to enter a restricted area for which I don't have access, and then write (or piss) on the wall, I think it still counts as breaking and entering. Or trespassing and vandalism at least. I don't think I'm going to take this analogy any further though; things get dangerous when you base an argument entirely on analogy.
- ktizo 15y ago
  I wonder what the Young's modulus of an analogy is ;)
- Drbble 15y ago
  It's obviously not "breaking". In fact "breaking" is the difference between burglary and theft, and theft insurance is way more expensive than burglary insurance (which I experienced today reading an insurance offer) , because theft is nearly impossible to prove and usually due to the victim's negligence.
  - JangoSteve 15y ago
    In the legal sense, you don't need to literally break something for it to be breaking in entering. From the legal-dictionary [1]: breaking and entering v., n. entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary. If there is no such intent, the breaking and entering alone is probably at least illegal trespass, which is a misdemeanor crime. [1] http://legal-dictionary.thefreedictionary.com/breaking+and+entering http://legal-dictionary.thefreedictionary.com/breaking+and+e...

ricardobeat 15y ago

Terrible analogy. More like someone's automatic door lock is opening by itself at random times of the day, and the owner doesn't believe it, so you leave a note on the inside. It's creepy, but not wrong.

baq 15y ago
but the owner doesn't know that. he has to assume you left a bomb under the passenger's seat, left illicit substances in hard to get spots and put a potato in the exhaust.
- fluidcruft 15y ago
  So...? The owner has to assume that anyway because they relied on faulty security. Assuming they even care--and honestly why would you think they care now when the evidence is they have not cared about this for at least months.

wisty 15y ago

There's an old debate over what constitutes "gray hat" hacking, and whether it's moral. I haven't looked at Egor's actions too closely, but he seems fairly close to a "white hat". He's been a bit immature, and so has Github, but there's been no real lasting damage. Anyone who's written a web app knows that mistakes can happen, and they take time to fix. I'm sure Github will handle the PR crisis with an informative and unbiased mea culpa (even if they secretly think Egor was a bit brash). People will keep using them, because their interface rocks. This will stay on the front page for about 24 hours, then there will be a few link bait articles that also cash in on it, but that's about it.