5 ms·

I was not aware he was ill. Always sad to hear people that are taken by cancer. I didn't know Kevin, but am friends with Tsutomu Shimomura who worked with auth

I was not aware he was ill. Always sad to hear people that are taken by cancer. I didn't know Kevin, but am friends with Tsutomu Shimomura who worked with authorities to get him arrested. Tsutomu worked with me a bit when I was at Sun trying to get a cryptographically secure subsystem into the base system specification. It was fun to listen to his side of this story. The 80's was a really weird time for computer enthusiasts, and it was the period of time when what was then considered the "hacker" community schismed into what today we might call "white hat" vs "black hat" hackers. As a person who considered themselves to be part of that community I was personally offended by how the story of Kevin painted everyone who thought of themselves as a "hacker" as a criminal. It made for good story telling to make these folks "pirate" or perhaps more accurately "privateer" types in their swashbuckling ways of sticking it to the man. People would say, "Exposing security holes is like solving puzzles (which is fun) and important because if I don't do it, well somebody 'bad' will." And while I'm here, why not make it hurt for them a little bit to incentivize them to fix this problem quickly!" I didn't disagree with the importance of pointing out security problems, but the flamboyant way it was done scared the crap out of people who were both clueless and in a position to do stupid things. As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act. The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it.

larrywright 3y ago
I really enjoyed the book Takedown, about Shimomura's pursuit of Mitnick - I must have read it three or four times. I always wondered what happened to Shimomura, since he just seemed to drop out of sight after that book came out.
- sshd 3y ago
  NSA has entered the chat
  - bozhark 3y ago
    Blockchain
- iJohnDoe 3y ago
  Shimomura was an egotistical asshole at the time. However, he was younger then and can hopefully acknowledge he was still learning about himself and wasn’t all-wise yet. I hope Shimomura can realize that Mitnick made him a better version of himself, both personally and professionally.
  - larrywright 3y ago
    His ego came through a bit in the book, but honestly that's a fairly common trait for young guys. I am also quite aware that the book only presents one side of the story and that Mitnick had quite a different perspective. I'm sure the truth lies somewhere in the middle. My enjoyment of the book was much more about the process they used to track him down, and the detailed description of them building tools to aid in the process, rather than the people involved.
    - DonHopkins 3y ago
      "A bit"? You think so? At the time, Tsutomu was enough of an adult to know not to be such an asshole, but that didn't stop him one bit. Fuck the "boys will be boys" defense, and the people who still try to defend reprehensible behavior (and ultimately their own) by trotting out that old sexist canard.
      - larrywright 3y ago
        I’m not defending the behavior, just saying that it didn’t detract from the parts of the book that I enjoyed. I did find the inclusion of so many details of his romantic life a bit odd. It’s not that they were graphic or anything, there was just a lot of it and it didn’t have anything to do with the subject of the book.
  - retrocryptid 3y ago
    Meh. It 'ain't braggin' if it's true. Worked with Tsutomo on some projects. Dude has an extremely keen analytical mind. Mitnick on the other hand had an excellent grasp of human intellectual frailty. I was always surprised people expected Tsutomo to be some amazingly empathetic mensch and Mitnick to be some uber mentat wizzard. Each was quite good within their speciality, and kinda crappy in the other's. And that's totally okay.
- ChuckMcM 3y ago
  He started at company called Neofocal which had some really cool LED products. He also has had some health issues of his own to deal with. I last talked with him about 5 years ago in 2018.
  - DonHopkins 3y ago
    It's mired in lawsuits due to him being a jerk, so nobody's ever using any of those really cool LED products. It's not that he dropped out of sight, it's that nobody wanted to work with him after reading his book.
- 0ct4via 3y ago
  Alas the book (and the movie) were trash, rather like Shimomura. Anyone who knew Kevin, knew that Takedown was egotistical BS. If you really want to know about "the pursuit of Mitnick," watch Freedom Downtime. https://en.wikipedia.org/wiki/Freedom_Downtime https://en.wikipedia.org/wiki/Freedom_Downtime https://archive.org/details/FreedomDowntime-TheStoryOfKevinMitnick https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...
29athrowaway 3y ago
Markoff and Shimomura received $750,000 for their book rights and $650,000 for the film rights. The most sensational parts in the book or the movie had absolutely nothing to do with the truth. Sharknado is closer to reality than Track Down. The cringest part is Tsutomu's fictional gf.
- dijit 3y ago
  Take Down (the movie) was fantastic fiction, and even showed Mitnick as convicted before he even was. However my cringiest take away from the book was Simomura's detailing of what he was eating which seemed to have so many mentions that at times I thought it was a healthy eating dialogue.
  - 0ct4via 3y ago
    Anyone who knew Kevin, knew that Takedown was complete BS - "fiction" or not. You'd be better off watching Freedom Downtime. https://en.wikipedia.org/wiki/Freedom_Downtime https://en.wikipedia.org/wiki/Freedom_Downtime https://archive.org/details/FreedomDowntime-TheStoryOfKevinMitnick https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...
jonahx 3y ago
> but the flamboyant way it was done scared the crap out of people who were both clueless and in a position to do stupid things. As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act. > The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. The causal leap from flamboyant hackers to the DMCA/CFAA, and then to damaging the US's innovation talent feels... speculative.
- AnthonyMouse 3y ago
  > The causal leap from flamboyant hackers to the DMCA/CFAA That isn't much of a leap. The penalties aren't rooted in the actual damages, because for most of this kind of curiosity-based intrusion, there isn't any real damage and the damage imputed to them is the cost of cleaning up after the vulnerability, which the "victim" ought to have paid regardless. Getting trolled by some kid isn't what costs you money, implementing a vulnerability that allows some kid to troll you is. The reason the penalties are high is because of that embarrassment. Some major institution that ought to have done better gets pwned by some pranksters and they lose face. So they want to throw the book at the guy to deter anyone else, not from maliciously causing them undue harm, but from making a fool of them in public. But blaming the youth for bragging about it is blaming the victim. The perpetrators are the institutions that abuse the law, and the process of creating the law, to severely punish not evildoers but the child who points out that the emperor has no clothes. > and then to damaging the US's innovation talent These are the laws they use to charge the likes of Aaron Swartz, are they not?
  - CPLX 3y ago
    It'll make more sense when you realize that promoting the competence of American corporations is, in and of itself, an explicit policy goal of the American government.
    - rjbwork 3y ago
      If they wanted to promote competence then the damages would be applied to the corporation for implementing the vulnerability, not on the attacker for exposing it. This way, corporations are given a shield for being incompetent and can place the blame and damages upon an individual that brings them to light.
mcv 3y ago
> I was not aware he was ill. Always sad to hear people that are taken by cancer. It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure. It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals.
- vmurthy 3y ago
  :-(. Always sad to hear such news. Stay strong mate!
- glimshe 3y ago
  I'm sorry to hear about your mom. It's not impossible to cure, but it's very uncommon. I think that if it is caught early, only 10% of people eventually become disease-free.
- jjkaczor 3y ago
  It took my dad last year, diagnosis in April, gone by mid-June. It was so aggressive he chose "medical assistance in death" (MAID), because he didn't want to be in hospitals all-the-time. He had half-completed the process, then had a stroke on June 4th, where he was then admitted to hospital. The stroke cause aphasia, so he couldn't communicate very well (speech was very disjointed, but he could understand everyone) - they brough in a speech pathologist, after a couple weeks they we able to confirm that he still wanted 'MAID', so - I had to make the decision as to when. (And - I agreed, spending time in hospitals, fighting the inevitable was antithetic to his whole personality) Cleared by 2nd round of medical professionals to make the MAID decision on a Wednesday, so - we scheduled for Friday - he passed away naturally Thursday morning.
  - nathancahill 3y ago
    Sorry for your loss.
  - saary 3y ago
    Thank you for sharing, sorry for your loss.
withinboredom 3y ago
Pro-tip: CFAA only applies if you cross state lines between you and the server. Otherwise, state laws applies and there are/were some states that never passed any 'anti-hacking' laws. Source: experience.
- marcus0x62 3y ago
  Pro-er tip: if you are in the US and access a computer over any kind of service provider network (Internet, leased line, etc.) you should operate on the assumption your traffic is crossing state lines and the CFAA applies to your activities. Tools like traceroute cannot show you where your traffic is physically being sent because: there may be no geographic information in the router reverse DNS records, that information might not be accurate if it is present, and layer 3 tools cannot show you the underlying layer 1/2 path (which might be wildly different than the layer 3 hops would suggest.)
  - EMCymatics 3y ago
    How can the DNS records not be accurate?
    - kjs3 3y ago
      You're new here, aren't you?
      - deleted 3y ago
        [deleted]
    - amoss 3y ago
      rDNS information is provided by the owner of the IP address, not the owner of the domain. More generally there are spoofing and poisoning attacks against DNS.
    - marcus0x62 3y ago
      You can make a reverse DNS record (or any DNS record, for that matter,) say anything at all. There isn't a National Committee for the Verification of DNS Updates checking this stuff out and demanding in-person inspections and notarized affidavits swearing that 100% of all information in the DNS is accurate and means whatever the end-user might infer it to mean. For instance, part of the tracroute from my house to Google looks like this: 6 be-33112-cs01.doraville.ga.ibone.comcast.net (96.110.43.81) 19.602 ms 7 be-33142-cs04.doraville.ga.ibone.comcast.net (96.110.43.93) 22.738 ms 8 be-302-cr13.56marietta.ga.ibone.comcast.net (96.110.39.49) 23.202 ms You can see these hostnames are obviously meant to encode some geographic data -- strictly for the convenience of the provider, it doesn't mean anything else -- but you, as the user, cannot tell from these records that these routers are actually where you think they are, based on the host names. Another issue is the server you're communicating with might take a completely different path to get back to you, and you'd have no real way of knowing that.
Mindwipe 3y ago
> The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it. It is very difficult to see how that is the case when pretty much every functioning nation has substantially similar laws.
- nekoashide 3y ago
  Nobody really cared in the scene about the DMCA until the FBI started taking people offline. Even then? It stopped nobody, people just got more security aware.
detourdog 3y ago
The hacks had to be flamboyant. If the hacks weren’t embarrassing the “adults” in suits would deny the hairy person in a t-shirt knew what they were talking about.
- loup-vaillant 3y ago
  This even happens when there is not nearly as much status difference between the two. I was once tasked to work with TPM 2.0 provisioning in an embedded position. They specifically chose me and pulled me from another team because of my skills in cryptography (I wrote Monocypher). Fast forward a couple weeks, I notice that the way the provisioning was specified, it would allow us to provision a fake TPM without noticing. My team lead didn’t believe me. Sometimes later we had an actual provisioning procedure in place, and what do you know, it worked to completion even with a fake (software) TPM and a real certificate from the manufacturer. Because, well… we just didn’t compare the relevant public keys. My team lead was still sceptical. I had to mention the issue in a meeting with some higher-ups and the security guy to be allowed to fix the problem. I believe this goes a bit deeper than a status game. I think it’s downright magical thinking: this hope that ignoring problems (especially vague threats like security vulnerabilities), could make the problem actually disappear.
  - detourdog 3y ago
    Definitely some of that. but in Kevin's day it was most likely a team of IBM blue suits, white shirts, and red ties vs. Kevin in whatever he found to wear.
msarrel 3y ago
Having been around for the long haul and meet Kevin a few times, I'm sad to hear of his passing. Yet, his white hat influence will live on. I completely agree. There was a time when hacker did not mean criminal. That was the time during which Kevin was active. It was also the time during which I was active, not that that matters right now. But there was a rapid shift from computers being something you could explore to if you're exploring that then you are a bad person. And I also agree that trying to scare policy makers isn't necessarily going to work because they don't understand what they're scared of. Curiosity is no longer rewarded in general in our society. Those of you who don't think what Kevin did was important, there seem to be a lot of people discussing him, aren't there?
pcunite 3y ago
As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act. The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it. I was escorted out of my job as a shipping clerk in 1999 for creating an entry in an NT 4.0 group with my name in it to impress the IT Admin so I could get a job in the computer department.

larrywright 3y ago

I really enjoyed the book Takedown, about Shimomura's pursuit of Mitnick - I must have read it three or four times. I always wondered what happened to Shimomura, since he just seemed to drop out of sight after that book came out.

sshd 3y ago
NSA has entered the chat
- bozhark 3y ago
  Blockchain
iJohnDoe 3y ago
Shimomura was an egotistical asshole at the time. However, he was younger then and can hopefully acknowledge he was still learning about himself and wasn’t all-wise yet. I hope Shimomura can realize that Mitnick made him a better version of himself, both personally and professionally.
- larrywright 3y ago
  His ego came through a bit in the book, but honestly that's a fairly common trait for young guys. I am also quite aware that the book only presents one side of the story and that Mitnick had quite a different perspective. I'm sure the truth lies somewhere in the middle. My enjoyment of the book was much more about the process they used to track him down, and the detailed description of them building tools to aid in the process, rather than the people involved.
  - DonHopkins 3y ago
    "A bit"? You think so? At the time, Tsutomu was enough of an adult to know not to be such an asshole, but that didn't stop him one bit. Fuck the "boys will be boys" defense, and the people who still try to defend reprehensible behavior (and ultimately their own) by trotting out that old sexist canard.
    - larrywright 3y ago
      I’m not defending the behavior, just saying that it didn’t detract from the parts of the book that I enjoyed. I did find the inclusion of so many details of his romantic life a bit odd. It’s not that they were graphic or anything, there was just a lot of it and it didn’t have anything to do with the subject of the book.
- retrocryptid 3y ago
  Meh. It 'ain't braggin' if it's true. Worked with Tsutomo on some projects. Dude has an extremely keen analytical mind. Mitnick on the other hand had an excellent grasp of human intellectual frailty. I was always surprised people expected Tsutomo to be some amazingly empathetic mensch and Mitnick to be some uber mentat wizzard. Each was quite good within their speciality, and kinda crappy in the other's. And that's totally okay.
ChuckMcM 3y ago
He started at company called Neofocal which had some really cool LED products. He also has had some health issues of his own to deal with. I last talked with him about 5 years ago in 2018.
- DonHopkins 3y ago
  It's mired in lawsuits due to him being a jerk, so nobody's ever using any of those really cool LED products. It's not that he dropped out of sight, it's that nobody wanted to work with him after reading his book.
0ct4via 3y ago
Alas the book (and the movie) were trash, rather like Shimomura. Anyone who knew Kevin, knew that Takedown was egotistical BS. If you really want to know about "the pursuit of Mitnick," watch Freedom Downtime. https://en.wikipedia.org/wiki/Freedom_Downtime https://en.wikipedia.org/wiki/Freedom_Downtime https://archive.org/details/FreedomDowntime-TheStoryOfKevinMitnick https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...

29athrowaway 3y ago

Markoff and Shimomura received $750,000 for their book rights and $650,000 for the film rights. The most sensational parts in the book or the movie had absolutely nothing to do with the truth. Sharknado is closer to reality than Track Down. The cringest part is Tsutomu's fictional gf.

dijit 3y ago
Take Down (the movie) was fantastic fiction, and even showed Mitnick as convicted before he even was. However my cringiest take away from the book was Simomura's detailing of what he was eating which seemed to have so many mentions that at times I thought it was a healthy eating dialogue.
- 0ct4via 3y ago
  Anyone who knew Kevin, knew that Takedown was complete BS - "fiction" or not. You'd be better off watching Freedom Downtime. https://en.wikipedia.org/wiki/Freedom_Downtime https://en.wikipedia.org/wiki/Freedom_Downtime https://archive.org/details/FreedomDowntime-TheStoryOfKevinMitnick https://archive.org/details/FreedomDowntime-TheStoryOfKevinM...

jonahx 3y ago

> but the flamboyant way it was done scared the crap out of people who were both clueless and in a position to do stupid things. As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act. > The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. The causal leap from flamboyant hackers to the DMCA/CFAA, and then to damaging the US's innovation talent feels... speculative.

AnthonyMouse 3y ago
> The causal leap from flamboyant hackers to the DMCA/CFAA That isn't much of a leap. The penalties aren't rooted in the actual damages, because for most of this kind of curiosity-based intrusion, there isn't any real damage and the damage imputed to them is the cost of cleaning up after the vulnerability, which the "victim" ought to have paid regardless. Getting trolled by some kid isn't what costs you money, implementing a vulnerability that allows some kid to troll you is. The reason the penalties are high is because of that embarrassment. Some major institution that ought to have done better gets pwned by some pranksters and they lose face. So they want to throw the book at the guy to deter anyone else, not from maliciously causing them undue harm, but from making a fool of them in public. But blaming the youth for bragging about it is blaming the victim. The perpetrators are the institutions that abuse the law, and the process of creating the law, to severely punish not evildoers but the child who points out that the emperor has no clothes. > and then to damaging the US's innovation talent These are the laws they use to charge the likes of Aaron Swartz, are they not?
- CPLX 3y ago
  It'll make more sense when you realize that promoting the competence of American corporations is, in and of itself, an explicit policy goal of the American government.
  - rjbwork 3y ago
    If they wanted to promote competence then the damages would be applied to the corporation for implementing the vulnerability, not on the attacker for exposing it. This way, corporations are given a shield for being incompetent and can place the blame and damages upon an individual that brings them to light.

mcv 3y ago

> I was not aware he was ill. Always sad to hear people that are taken by cancer. It was pancreatic cancer, which is the deadliest cancer. It kills very quickly and as far as I know, it's impossible to cure. It killed my mom: 3 months between diagnosis and death. She didn't want treatment because it couldn't save her; it would only postpone the inevitable and she didn't want to spend the rest of her days in hospitals.

vmurthy 3y ago
:-(. Always sad to hear such news. Stay strong mate!
glimshe 3y ago
I'm sorry to hear about your mom. It's not impossible to cure, but it's very uncommon. I think that if it is caught early, only 10% of people eventually become disease-free.
jjkaczor 3y ago
It took my dad last year, diagnosis in April, gone by mid-June. It was so aggressive he chose "medical assistance in death" (MAID), because he didn't want to be in hospitals all-the-time. He had half-completed the process, then had a stroke on June 4th, where he was then admitted to hospital. The stroke cause aphasia, so he couldn't communicate very well (speech was very disjointed, but he could understand everyone) - they brough in a speech pathologist, after a couple weeks they we able to confirm that he still wanted 'MAID', so - I had to make the decision as to when. (And - I agreed, spending time in hospitals, fighting the inevitable was antithetic to his whole personality) Cleared by 2nd round of medical professionals to make the MAID decision on a Wednesday, so - we scheduled for Friday - he passed away naturally Thursday morning.
- nathancahill 3y ago
  Sorry for your loss.
- saary 3y ago
  Thank you for sharing, sorry for your loss.

withinboredom 3y ago

Pro-tip: CFAA only applies if you cross state lines between you and the server. Otherwise, state laws applies and there are/were some states that never passed any 'anti-hacking' laws. Source: experience.

marcus0x62 3y ago
Pro-er tip: if you are in the US and access a computer over any kind of service provider network (Internet, leased line, etc.) you should operate on the assumption your traffic is crossing state lines and the CFAA applies to your activities. Tools like traceroute cannot show you where your traffic is physically being sent because: there may be no geographic information in the router reverse DNS records, that information might not be accurate if it is present, and layer 3 tools cannot show you the underlying layer 1/2 path (which might be wildly different than the layer 3 hops would suggest.)
- EMCymatics 3y ago
  How can the DNS records not be accurate?
  - kjs3 3y ago
    You're new here, aren't you?
    - deleted 3y ago
      [deleted]
  - amoss 3y ago
    rDNS information is provided by the owner of the IP address, not the owner of the domain. More generally there are spoofing and poisoning attacks against DNS.
  - marcus0x62 3y ago
    You can make a reverse DNS record (or any DNS record, for that matter,) say anything at all. There isn't a National Committee for the Verification of DNS Updates checking this stuff out and demanding in-person inspections and notarized affidavits swearing that 100% of all information in the DNS is accurate and means whatever the end-user might infer it to mean. For instance, part of the tracroute from my house to Google looks like this: 6 be-33112-cs01.doraville.ga.ibone.comcast.net (96.110.43.81) 19.602 ms 7 be-33142-cs04.doraville.ga.ibone.comcast.net (96.110.43.93) 22.738 ms 8 be-302-cr13.56marietta.ga.ibone.comcast.net (96.110.39.49) 23.202 ms You can see these hostnames are obviously meant to encode some geographic data -- strictly for the convenience of the provider, it doesn't mean anything else -- but you, as the user, cannot tell from these records that these routers are actually where you think they are, based on the host names. Another issue is the server you're communicating with might take a completely different path to get back to you, and you'd have no real way of knowing that.

Mindwipe 3y ago

> The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it. It is very difficult to see how that is the case when pretty much every functioning nation has substantially similar laws.

nekoashide 3y ago
Nobody really cared in the scene about the DMCA until the FBI started taking people offline. Even then? It stopped nobody, people just got more security aware.

detourdog 3y ago

The hacks had to be flamboyant. If the hacks weren’t embarrassing the “adults” in suits would deny the hairy person in a t-shirt knew what they were talking about.

loup-vaillant 3y ago
This even happens when there is not nearly as much status difference between the two. I was once tasked to work with TPM 2.0 provisioning in an embedded position. They specifically chose me and pulled me from another team because of my skills in cryptography (I wrote Monocypher). Fast forward a couple weeks, I notice that the way the provisioning was specified, it would allow us to provision a fake TPM without noticing. My team lead didn’t believe me. Sometimes later we had an actual provisioning procedure in place, and what do you know, it worked to completion even with a fake (software) TPM and a real certificate from the manufacturer. Because, well… we just didn’t compare the relevant public keys. My team lead was still sceptical. I had to mention the issue in a meeting with some higher-ups and the security guy to be allowed to fix the problem. I believe this goes a bit deeper than a status game. I think it’s downright magical thinking: this hope that ignoring problems (especially vague threats like security vulnerabilities), could make the problem actually disappear.
- detourdog 3y ago
  Definitely some of that. but in Kevin's day it was most likely a team of IBM blue suits, white shirts, and red ties vs. Kevin in whatever he found to wear.

msarrel 3y ago

Having been around for the long haul and meet Kevin a few times, I'm sad to hear of his passing. Yet, his white hat influence will live on. I completely agree. There was a time when hacker did not mean criminal. That was the time during which Kevin was active. It was also the time during which I was active, not that that matters right now. But there was a rapid shift from computers being something you could explore to if you're exploring that then you are a bad person. And I also agree that trying to scare policy makers isn't necessarily going to work because they don't understand what they're scared of. Curiosity is no longer rewarded in general in our society. Those of you who don't think what Kevin did was important, there seem to be a lot of people discussing him, aren't there?

pcunite 3y ago

As a result we got the CFAA and the DMCA which are both some of the most ridiculous pieces of legislation after the so called "patriot" act. The damage that did to curious people growing up lost the US a significant fraction of their upcoming "innovation" talent. While not diminishing the folks who leaned in to the illegality of it. I was escorted out of my job as a shipping clerk in 1999 for creating an entry in an NT 4.0 group with my name in it to impress the IT Admin so I could get a job in the computer department.