23 ms·

10M people watched a YouTuber shim a lock; the lock company sued him – bad idea

1587 points by Brajeshwar 1y ago

https://www.youtube.com/shorts/YjzlmKz_MM8 https://www.youtube.com/shorts/YjzlmKz_MM8

catlikesshrimp 1y ago
I am concerned about the public reacting aggressively agaisnt the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit, however unjust it was. The correct support for a just cause must have been constructive: providing financial support for the defendant, public manifestation campaign, professional lobbying, etc Although this time I agree with the defendant cause, the response by the public was as toxic bullying as the plaintiff, only stronger.
- deleted 1y ago
  [deleted]
- tyleo 1y ago
  You’re getting downvoted which is unfortunate because I think you make a worthwhile point. Emotionally I disagree with you. It feels like a bully is getting what a bully deserves. Logically, I think you are right though. Crowds just aren’t equipped to handle these situations. There are cases where the wisdom of the crowd is correct, but there are many more where it multiplies harms. The underlying problem is that it never feels like justice is being served. Another comment mentions that there should be harsher punishment for false DMCAs. I don’t think the “wisdom of the crowd” approach is the best way to write those wrongs but I lament that modern justice has not been up to the task.
  - cindyllm 1y ago
    [dead]
- mikestew 1y ago
  I’m going to border closely to blaming the “victim” here, but if the lawsuit had been filed without toxic, threatening, man-baby social media posts, we wouldn’t be hearing about it. Harassed because he filed a lawsuit? C’mon, there’s a lot more to it than that. When one goes swinging their dick around on Twitter in an attempt to garner support (from one’s equally toxic fans, I presume), one will also likely attract equally toxic folks who disagree. Talk enough shit, and you’ll eventually get a punch to the face. Right or wrong, such is the world long before social media.
- MBCook 1y ago
  That’s the internet these days. It’s been going on for decades. Game developers got death threats over minor changes to video games and nothing happened to them. Is it that surprising that tactic has continued? People can make fun of the company all they want. That’s fair game. They shouldn’t be calling the guy’s personal phone or harassing his family, that’s totally over the line. But nothing happens. The behavior gets a pass so it continues to become more common. That passes for debate now.
  - ipaddr 1y ago
    Phone numbers are public not personal secrets. If you have a number someone can call it.
    - MBCook 1y ago
      And I can find relatives/friends on Facebook to harass. Doesn’t make it ok. Just like the fact we have agreed upon rules against using chemical weapons or attacking civilians in war (which some violate), the fact something is possible doesn’t mean society should accept it. If we don’t have even the basic civility of not getting death threats over whatever minor thing someone on the internet is mad at, even mixing us up with their real target sharing our name, what’s left? Everything becomes full force win at all costs, no matter how stupid or trivial. Who wants to live like that?
    - snowwrestler 1y ago
      To be clear, threatening people in person is against the law too.
    - HelloMcFly 1y ago
      Let's all say it together: just because you can doesn't mean you should
- greedo 1y ago
  This all sounds great in the abstract. But reality is different due to the power differential. McNally is just one dude (albeit with a huge following). Lee is obviously a toxic jerk and his attacks and mockery of McNally triggered both McNally repeatedly proving the flaws in Proven's technology. McNally obviously did the correct thing it seeking counsel and basically demolishing Proven's case in court. Too bad the SLAPP stuff doesn't work with DMCA takedowns. And everyone else cheering on the sidelines (who isn't a paid shill of Proven's like the guy making the "liberal" comment)? Well giving Lee's company shit is fine IMHO. Call up the publicly available phone numbers, make service requests to flood his business etc. Fine with me. You poke the Internet bear, you get some claws. As to the threats? If they actually occurred (which is questionable considering the BS Proven has been saying), then let the authorities know about them. That's not on McNally at all, it's more Lee being a jerk who doesn't know about the Streisand Effect, combined with social media companies that allow stuff like that to happen. It's also a good idea to not expose too much info about your personal life on social media that can be linked to your business, opsec ya know?
- mindslight 1y ago
  > the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit I think you're confusing who filed the lawsuit here. That was also the lock company owner as well (Lee/Proven). While I agree that flash mob harassment from the Internet is a terrible dynamic, filing baseless lawsuits has been a longstanding way to predictably summon them. So if the table stakes of launching or defending these type of aggressive attacks have gone from a significant amount of money for attorneys, to a significant amount of money for attorneys plus public relations and/or having a large audience, does that really actually change much? Either way most people simply don't file lawsuits, even if they've been actually wronged, due to the extreme personal stress. The straightforward way of diminishing mob justice is to make people believe the system provides justice. If we lived in a society where McNally would predictably win the lawsuit [0], and be predictably compensated for his expenses/time/emotionalDistress for being on the receiving end of this baseless SLAPP, then there would be much less mob outrage to begin with. As it stands, everyone can imagine themselves receiving these types of legal shakedown letters, but having much less power to push back. [0] it sounds like this particular suit was slapped down pretty hard and "quick" by the standards of the legal system, but there are many similar cases that don't go this way
zamalek 1y ago
Someone seriously needs to be taken to task for filing a false DMCA. DMCA is just another term for SLAPP these days. If anyone is a lawyer, they could still be despite retracting the case?
- nerdsniper 1y ago
  Anti-SLAPP is a great tool to have, but we do need slightly stronger ones. It’s a tough balance to find - to minimize the potential ways to abuse the system for all different kinds of entities/people. YouTube’s TOS would be the most critical place to begin in terms of evaluating legal options. To file a “DMCA” (not really DMCA but YT’s proprietary version of it) claimants generally have to create an account and agree to the TOS. So it may bind both parties (the YTer and the abusive DMCA claimant). That might limit legal options for anti-SLAPP, tortious interference, etc. But without either significant legal expertise or someone finding some particularly relevant case law, it seems like a nuanced enough domain that no one’s lay “legal” opinion would be particularly illuminating.
  - ProllyInfamous 1y ago
    As the recipient of a SLAPP lawsuit (~decade ago) for truth I published online, the biggest problem with Anti-SLAPP statutes is that laypeople (particularly poorer ones) have limited access to attorney representation... the judicial system isn't accessible/friendly to the pro se litigant. So even if the case is clearly being used to strategicly silence you, it'll probably still work (from plaintiff's POV). Same for DMCA.
    - jcranmer 1y ago
      With a strong Anti-SLAPP statute, the person who files the lawsuit is on the hook for the defendant's legal fees, which would (in theory) let the defendant hire an attorney on contigency fees. Of course, one of the other issues is there's no federal Anti-SLAPP statute, and circuits are split as to whether or not state Anti-SLAPP applies to federal lawsuits, so if someone can diversity jurisdiction you into a federal SLAPP lawsuit, you're kind of stuck.
mindcrime 1y ago
It's probably a good thing for Proven that they didn't get into this dispute the LockPickingLawyer instead. He'd wind up owning their company in the counter-suit...
- adolph 1y ago
  That'd be an interesting channel, the "LockMakingLawyer" where the lock is highly lawsuit resistant, "Press the NDA button to always be informed when the next video comes out"
mothballed 1y ago
This guy shims a $100+ lock in 10 seconds with a liquid death can, all without speaking in the video, just replays and then destroyed their claims and GTFO. Absolutely masterful.
viggity 1y ago
These kinds of results seem all too common. Like, why? Are companies just too used to using their general business attorneys for it, and those attorneys are just ignorant? Hungry for extra billable hours?
- resoluteteeth 1y ago
  Even if they know they would lose in court, lawsuits are expensive enough that threatening to sue or filing a lawsuit is often enough to get people without deep pockets to do whatever you want. I don't know if that was the reasoning in this case though, considering that they didn't drop the lawsuit once it was clear that the youtuber wasn't going to give in to their demands.
- topspin 1y ago
  > Like, why? The answer, as succinctly as possible: cognitive dissonance. This is exhibited in every human endeavor, but it's particularly acute, or at least more apparent to simple analysis, in business. In business, anything that diminishes the perception of value is a threat to earnings. Business people don't tolerate the existence of such perceptions in their minds. They readily adopt whatever mental state is necessary to deny realities that reveal a lack of value in whatever work product they sell. In this case, someone demonstrated a weakness in a lock design. In the minds of the business people behind the product, this is impossible. Their locks are awesome. Best locks in the world! Therefore, the only conceivable possibility permitted, in their minds, is fraud or some other actionable offense that can be feasibly pursued in court. The role of lawyers in this is a symptom, not a cause. Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Whatever aberrations or iniquities arise from this are simply denied by yet more cognitive dissonance.
  - walterbell 1y ago
    > Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Thanks for answering this FAQ.
  - dwattttt 1y ago
ProllyInfamous 1y ago
Back in 2007, I published the first YouTube bypass of the Master Lock #175 (very common 4-digit code lock), using a paperclip. After the video reached 1.5M views (over a couple years), the video was eventually demonetized (no official reason given). I suspect there was a similarly-frivolous DMCA / claim, but at that point in my life I didn't have any money (was worth negative) so I just accepted YouTube's ruling. Eventually shut down the account, not wanting to help thieves bypass one of the most-common utility locks around — but definitely am in a position now where I understand that videos like mine and McNally's force manufacturers to actually improve their locks' securities/mechanisms. It is lovely now to see that the tolerances on the #175 have been tightened enough that a paperclip no longer defeats the lock (at least non-destructively); but thin high-tensile picks still do the trick (of bypassing the lock) via the exact same mechanism. Locks keep honest people honest, but to claim Master's products high security is inherently dishonest (e.g. in their advertising). Thievery is about ease of opportunity; if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).
- mothballed 1y ago
  Actual thieves don't give a shit to learn lock picking, they can use a fine toothed sawzall or oxy-acetylene torch and defeat any lock just as fast without having to youtube the particular brand.
  - b00ty4breakfast 1y ago
    most thieves don't even go that far. they find stuff that isn't locked or they kick in the door.
  - Ekaros 1y ago
    It is actually surprising just how little brute force many semi-decent padlocks can handle. A decent mallet and some force concentrator and I think good amount of them will fail.
    - ortusdux 1y ago
c420 1y ago
https://youtu.be/qL_MeobAp5s?t=1487 https://youtu.be/qL_MeobAp5s?t=1487 For those interested in the actual case, here's some deeper coverage of this bruhaha including how Lee may have perjured himself during deposition.
- hinkley 1y ago
  That guy sure isn’t in a hurry to get anywhere. Good one to watch at 1.25x speed.
pcthrowaway 1y ago
Lock-makers should start including RFID and a software key checking mechanism, then sharing the key would be illegal
- ranger_danger 1y ago
  > sharing the key would be illegal How so? And what region are you referring to? There are many countries in the world with vastly different laws.
  - tgsovlerkhgsel 1y ago
    Unfortunately, the "region" would be the 193 member states of WIPO: https://en.wikipedia.org/wiki/Anti-circumvention https://en.wikipedia.org/wiki/Anti-circumvention So, you are right, the laws in Micronesia, Palau and South Sudan might be vastly different.
- dcan 1y ago
  09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
  - butlike 1y ago
    plz stop! my hddvds...
  - foofoo12 1y ago
    That's an illegal number mate. Straight to the slammer! (for those missing out: https://en.wikipedia.org/wiki/AACS_encryption_key_controversy https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...)
  - dmbche 1y ago
    Thabk you so much this is a beautiful rabbit hole to go down
- nomel 1y ago
  Could you make access illegal using the DMCA, by putting some copyrighted content inside, with the physical key also being the license key?
hinata08 1y ago
The internet : sees thoughts challenging facts Someone : “Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.” The company : Proven also had its lawyers file “multiple” DMCA takedown notices against the McNally video, claiming that its use of Proven’s promo video was copyright infringement. When did facts and enlightenment started to be for "liberals lol" ? Freedom of speech based on facts should be universal.
- mothballed 1y ago
  >Freedom of speech based on facts should be universal. To be fair that's not what we have in USA. For instance, a nurse who never even signed a private privacy agreement with anyone (unusual, but could happen) could violate HIPAA if they factually tell a patient's spouse the patient is being treated for AIDS and they ought to watch out.
  - alwa 1y ago
    Yes, they could and most definitely would be. The case you describe is one of the reasons it’s that way. For what exactly would this fly-by-night nurse be telling me to “watch out,” in relation to my partner who’s living with and being treated for HIV? One hopes this nurse, being medically trained and apparently working with vulnerable populations, understands the efficacy of the modern HIV therapies the patient is receiving. That, when managed, HIV is not transmissible by conventional marital means [0]; and that, until recently at least [also 0], concerted public health efforts have meant that most anyone who seeks medical attention ends up on those modern therapies. That said, I hope said nurse would catch me in a charitable mood rather than a litigious one. [0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetectable-untransmittable.html https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta...
    - mothballed 1y ago
      This is an entirely different argument than the fact at hand, which is making the factual statement is illegal. You're just explaining why stating the fact should be illegal. >[0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta... I said AIDS, not HIV. I am no AIDS expert but I would be shocked if a large portion of people AIDS had no detectable viral load, while people with HIV commonly do not have detectable one. Wouldn't people with no detectable viral load generally not being exhibiting AIDS?
jwr 1y ago
If you don't know him already, I highly recommend videos by LockPickingLawyer — he routinely destroys bogus claims of various companies within seconds. It's quite entertaining to see how little security you actually get from most locks. I wonder if anybody tried suing him…
- jasoncartwright 1y ago
  LPL is superb. He inspired me to get a lock pick kit and a few simple padlocks - a cheap and fun hobby during COVID lockdowns.
  - diego898 1y ago
    Thinking of doing the same! Which kit did you order? I see a FNG, FNG+ Bundle, and "Learn lockpicking bundle". 3rd one seems the most likely candidate. Any tips you can share? Thanks!
    - yoz-y 1y ago
      I’ve got a German practice lock and boy was that a hard wake up call. That thing was so hard to pick that I gave up. (The keyhole is really slim) My bad though, LPL did warn about this.
    - embedding-shape 1y ago
      I did the same (also during COVID, after doing it for a bit in my youth). I haven't tried Covert Instruments gear, I bought some other pack from China, but whatever pack you can find with the basics (and maybe some variety so you can try different techniques) plus a training padlock so you can see what's going on inside, and it'll be a walk in the park.
    - Y_Y 1y ago
      Start with a cheap kit from e.g. Amazon which includes a couple of perspex locks so you can see what you're doing. Get a real set of picks for real money once you graduate from that.
    - 1y ago
tuetuopay 1y ago
The most absurd thing is the original video response from the company was good, and with a very compelling argument: their customers never saw shimming in the field. Their user base don't need shimming resistance: security needs to be adequate, not perfect. And they follow-up by presenting options about people requiring the lock to be shim-proof. Granted, in this day and age, it's a disgrace to still make locks that can be shimmed. Especially when the shim-proof alternatives they show just have an additional notch to catch the shim.
- adgjlsfhk1 1y ago
  > their customers never saw shimming in the field. This is arguably good PR, but a terrible response. Shimming is so quick and hard to detect that even if you had 24-7 video of the lock, you probably wouldn't notice that the lock had been shimmed. You would just assume that someone lost a key.
  - masklinn 1y ago
    Also the company sold a picking-proof version… at a higher price.
    - masklinn 1y ago
      shimming proof not picking, sorry just noticed the entirely wrong word
  - yreg 1y ago
    It's a trailer hitch lock. If someone steals your trailer then you definitely do notice. And if they just shim the lock and put it back then it doesn't really matter.
- deleted 1y ago
  [deleted]
robotnikman 1y ago
I wonder how many stories like this are caused simply because a corporate lawyer is looking for some work to do, and maybe to meet some kind of internal KPI.
- pcaharrier 1y ago
  Former in-house lawyer here and in my experience the answer is something like "probably less than you think." The job of the lawyer is to advise the client and (within the bounds of ethical rules) advocate for their position, not to come up what the company's position should be.
  - robotnikman 1y ago
    Interesting, thanks for the insight!
  - dghlsakjg 1y ago
    Honest question. Is it the job of an in-house lawyer (or any lawyer) to say that this appears to be a vexatious or SLAPP case, and the client should not pursue it? Is there an ethical obligation not to get involved in a case that you know is being prosecuted in bad faith?
    - pkilgore 1y ago
      Within the limits of their knowledge/ability, yes. Some bosses make it clear they do not like being told no, however. YMMV if you continue to work for such people. The bar there is very high. This case might be embarrassing but probably isn’t sanctionable. And the only lawyer that would get sanctioned would be the ones that signed the papers not the drone that hired them.
jimbokun 1y ago
> Under questioning, however, one of Proven’s employees admitted that he had been able to duplicate McNally’s technique, leading to the question from McNally’s lawyer: “When you did it yourself, did it occur to you for one moment that maybe the best thing to do, instead of file a lawsuit, was to fix [the lock]?” Sometimes a single question tells you how the entire case is going to go.
rdtsc 1y ago
> On July 7, the company dismissed the lawsuit against McNally instead. > Proven also made a highly unusual request: Would the judge please seal almost the entire court record—including the request to seal? Tough at first then running away with the tail between their legs. Typical bullying behavior. > but Proven complained about a “pattern of intimidation and harassment by individuals influenced by Defendant McNally’s content.” They have to know it's generated by their own lawsuit and how they approached it, right? They can't be that oblivious to turn around and say "Judge, look at all the craziness this generated, we just have to seal the records!". It's like an ice-cream cone that licks itself. > the case became a classic example of the Streisand Effect, in which the attempt to censor information can instead call attention to it. A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.
- embedding-shape 1y ago
  > A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media. I'm just guessing based on the contents of the article, but it sounds like a typical "hard-fist founder-run company" so good luck convincing the founder to not sit on social media and argue their points.
  - dekhn 1y ago
    also known as the 'double down on stupid' and 'triple down on stupid'
    - seanhunter 1y ago
      This is known as the “Randy Pitchford” social media strat.
    - jeltz 1y ago
      We recently had an example of that with Automattic and the WordPress drama. Where the founder was here on HN hurting his own legal case despite people here repeatedly told him to stop posting for his own sake and asking him to talk to his lawyers.
zahlman 1y ago
So... what should we be using for physical security?
- shagie 1y ago
  The question is "what do you want to secure against?" Describe the threat and then go from there. What are you securing? Is it meth-head or teenager? Or is it person determined to get in while making your insurance grill you over "did you lock it?"
- alistairSH 1y ago
  In the case of a trailer, you do some combination of... - Receiver pin lock similar to the one highlighted here (but probably not that exact one) - Wheel lock / boot - Receiver coupler lock (locks inside the cup-shaped receiver, preventing somebody towing the trailer with an undersized ball) - Secured storage lot / garage But, basically all options are only going to stop random opportunistic thieves. If somebody really wants whatever you're protecting, they'll find a way. That's why insurance exists.
- teekert 1y ago
  Just clicked around after watching the vid and stumbled onto [0]. So there are locks he recommends... When it requires focus + several minutes to pick. [0] https://www.youtube.com/watch?v=HrV86GqlY8o https://www.youtube.com/watch?v=HrV86GqlY8o
- sebstefan 1y ago
  I do lockpicking and swear by "Abus" locks
shagie 1y ago
Long (often an hour long) with significant snark videos going over the filings: https://www.youtube.com/@RunkleOfTheBailey/search?query=Proven https://www.youtube.com/@RunkleOfTheBailey/search?query=Prov...
modeless 1y ago
> In the end, Proven’s lawsuit likely cost the company serious time and cash—and generated little but bad publicity. There's no such thing as bad publicity. People say this for a reason. It's true. I'm willing to bet that their sales have only increased since this started.
- Tade0 1y ago
  Who is in the market for a product that doesn't work as advertised?
  - leni536 1y ago
    Lockpicking youtubers? But I guess that market got exhausted early on.
- paxys 1y ago
  There's absolutely such a thing as bad publicity. Entire products and even companies have tanked because of bad publicity. I don't know why this myth continues to be so prevalent.
  - dec0dedab0de 1y ago
    I think the saying is for people who can take the bad publicity and use it to their advantage.
- henry2023 1y ago
  I didn’t buy a Juicero back in 2015. Seems like I was not the only one.
  - modeless 1y ago
    Bad publicity doesn't guarantee success for a bad product. But it doesn't doom a good one either.
- ktallett 1y ago
  You're right! I'm off to the next Fyre festival and making sure my bag is secure with a Proven lock..... I wonder if Dassani still exist so I definitely can quench my thirst.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
rkhassen9 1y ago
Um...shouldn't Proven just hire Trevor McNally as a consultant or heck, make him a partner? I mean...can you imagine the next level reputation they'd have if they can adapt and make a Trevor-proof lock? I'd buy it.
ngcc_hk 1y ago
Interesting story but surprisingly bad write up. What happen to arstechnica.
zem 1y ago
clearly proven needs to sue whoever initiated that lawsuit for "mockery produced for the purpose of humiliating plaintiff”.
tptacek 1y ago
The whole case is up on RECAP: https://www.courtlistener.com/docket/70036390/proven-industries-inc-v-trevor-mcnally/ https://www.courtlistener.com/docket/70036390/proven-industr...
TaupeRanger 1y ago
[flagged]
- jasonjmcghee 1y ago
  the YouTuber in question doesn't talk. that's the representative from the lock company - basically the infomercial
  - thenthenthen 1y ago
    its a very confusing video to watch without sound haha, not sure if it gets better with sound. The fact that you do not see the lock pickers face makes you assume it is the same person doing the talking (the representative).
vladmk 1y ago
Yeah saw this - I can't believe a company would steer so far wrong...
dekhn 1y ago
I once worked for a company that kept its passwords locked in a safe. One day, all other copies of the password were lost, and they needed it, but the safe's key could not be found. They expensed a sledgehammer and obtained the password through physical modification of the safe using a careful application of force. Some employees complained that meant the safe wasn't... well, safe. The security team replied "Working as Intended" - no safe is truly safe, it's just designed to slow down an attacker. At that moment, I was enlightened.
- russdill 1y ago
  Excellent koan
- Terr_ 1y ago
  All Security Hinges on the arrival Of people with guns
  - cwsx 1y ago
    Obligatory xkcd https://xkcd.com/538/ https://xkcd.com/538/
    - tonyhart7 1y ago
      please stop mention this anymore, I gonna crazy
      - hrimfaxi 1y ago
        I thought maybe cwsx was posting this often but that doesn't seem to be the case. Is it that that xkcd is basically a HN trope at this point?
        deaux 1y ago
        If you do a site search you'll find 700+ comments linking to it. I wouldn't be surprised if it was the number one most frequently linked page in HN history.
croes 1y ago
> Proven argued that it would be difficult for an untrained user to perform. That’s are exactly the people who usually break locks. All others fail on simple locks too.
croes 1y ago
> Lee’s partner and his mother both “received harassing messages through Facebook Messenger,” while other messages targeted Lee’s son, saying things like “I would kill your f—ing n—– child” and calling him a “racemixing pussy.” Some people always go too far, undermining the good cause of the others
anitil 1y ago
If anyone is interested in the legal side, I'd also recommend 'Runkle of the Bailey' who has a series on this saga but with a focus on the legal shenanigans [0] [0] https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfklP1xO1qdmL63lpkZQSaPEpP https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfk...
logicallee 1y ago
This is the stupidest thing I read today.
realaaa 1y ago
so they were even asking for it themselves? ahah, geniuses
sreekanth850 1y ago
Suing someone because your product doesn't work correctly is diabolical. Instead of filing a lawsuit, they should have acknowledged the issue and released an upgrade to their locks.
- bdamm 1y ago
  Ah, but the truth came out here; the can't sell a lock that is upgraded, because they already do sell one at a higher price. There are cheaper locks if you don't care to defend against shimming.
rdiddly 1y ago
What a snowflake.
kuil009 1y ago
OMG
sebstefan 1y ago
The entire field of locksmithing has a failing culture around security. They still rely on security by obscurity, they sue attackers, and they never improve
DecentShoes 1y ago
The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies: https://m.youtube.com/@provenindustries8236 https://m.youtube.com/@provenindustries8236
lenkite 1y ago
Haven't laughed so much reading an article recently. Wow, this story looked taken right off a comedy movie.
jeffreygoesto 1y ago
https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr
- deleted 1y ago
  [deleted]
jbs789 1y ago
Sounds like the guy had rude awakening that his lock wasn’t as good as he thought it was. Another way of responding to this is… to improve the lock? Could even explore a positive collaborative social media campaign promoting the new lock. Ship has sailed now…
- jeroenhd 1y ago
  There were locks that were secure against this attack, but they're more expensive. The cheaper locks vulnerable to this attack probably still makes them a load of money, though.
hufdr 1y ago
If a company’s first reaction to a flaw is to sue instead of fix it, the problem probably goes beyond the lock itself. A real security company would appreciate someone pointing out a weakness rather than trying to take the video down. That kind of openness would actually make people trust them more.
- jeroenhd 1y ago
  The weird thing is, they actually had someone competent dealing with the issue: > The strange thing about the whole situation is that Proven actually knew how to respond constructively to the first McNally video. Its own response video opened with a bit of humor (the presenter drinks a can of Liquid Death), acknowledged the issue (“we’ve had a little bit of controversy in the last couple days”), and made clear that Proven could handle criticism (“we aren’t afraid of a little bit of feedback”). > The video went on to show how their locks work and provided some context on shimming attacks and their likelihood of real-world use. It ended by showing how users concerned about shimming attacks could choose more expensive but more secure lock cores that should resist the technique. Sounds to me like someone professional in the company with a cooler head was on this and was handling it well, but someone else higher up got angry and aggressive and decided that revenge was more important.
pkphilip 1y ago
One of my favourite lock pickers is Marc Tobias. He was also sued by a number of lock companies. https://www.youtube.com/watch?v=NadPAE6BDbA https://www.youtube.com/watch?v=NadPAE6BDbA It is interesting to see that these companies still don't know about the Streisand Effect or they choose to think that it won't happen to them.
- foofoo12 1y ago
  He just dropped a new video. Totally roasted the cunt out of that Easilok: https://www.youtube.com/watch?v=3lS5_6D4q9k https://www.youtube.com/watch?v=3lS5_6D4q9k
Azkron 1y ago
This reminds me of the CEO of a cyber security company that challenged Anonimous https://en.wikipedia.org/wiki/HBGary https://en.wikipedia.org/wiki/HBGary. If you work for any kind of security company, do not ever ever ever challenge any kind penetration specialist. Everything is hackable, it is only a matter of cost vs reward, but when you challenge someone that goes out of the window.
- matheusmoreira 1y ago
  Generalizing the advice.. Don't challenge people. Don't insult people. Don't humiliate people. Don't threaten people. Allow them to maintain their self-respect even when they lose. Don't rub it in. Give them a face-saving exit. Plenty of violence and aggression is caused by violation of the above rules. They seem simple but they're broken on a daily basis. Famous last words: "you don't have the guts".
kh_hk 1y ago
It would be funny if all this was just a liquid death marketing campaign
wafflemaker 1y ago
Once came back to work after 4 week holidays (not USA) and realized I forgot the 3 digit code to my locker. But I remembered that friend's locker (he was on holidays then) used US police code for murder. (Police in US use codes for crimes when communicating on the radio). I googled the code, used friend's locker for the day, and by lunch the next day I've bruteforced through enough codes to learn that my code was the embarrassing 420.
simonw 1y ago
This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html https://www.mattblaze.org/masterkey.html When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html https://www.mattblaze.org/papers/kiss.html It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.
- agumonkey 1y ago
  Even as a computer nerd, I find computing culture to be often too radical sometimes.
  - jama211 1y ago
    Agreed
- czx111331 1y ago
  Perhaps the most important difference is that software — even after being purchased and used — remains relatively easy to patch, unlike a physical lock.
  - sigmoid10 1y ago
    Tbf that's a new-ish principle. 2003 was Windows XP era and the early days of Metasploit. I.e. Microsoft and all the other companies were still figuring out this internet thing, while most computers were riddled with unpatched vulnerabilities. There was no such thing as zero day back then, because you could use many exploits years later.
    - ale42 1y ago
      Totally true. Also consider that although software can theoretically or technically be patched, sometimes patches just don't exist... the amount of unmaintained but yet useful software is just huge.
deleted 1y ago
[deleted]
ODIER 1y ago
[dead]
amelius 1y ago
Wait, what if a hacker found an exploit and then published it without giving the company a chance to fix it?
deleted 1y ago
[deleted]
HexPhantom 1y ago
They turned a one-minute critique into a PR disaster that millions of people now know about
aswegs8 1y ago
The wohle article reads to me like: "AMERICA FKK YEAHHH BROO, HE GOT PWNNNDD, SON!" eagle sounds Gotta admit its entertaining, though.
dpoloncsak 1y ago
Saw the headline, knew it was going to be McNally. God Bless McNally
throw7 1y ago
Who knew shaking a juice box could be so intimidating!
xyst 1y ago
LPL (Lock Picking Lawyer) has been making a fool of MasterLock and other physical security products/marketing for many years. Guess ML realizes it’s best to be humiliated online where a small subset of population would never buy their products anyways. Rather than humiliate themselves in public like Proven Industries did (Barbara Streisand effect?)

1587 points by Brajeshwar 1y ago

https://www.youtube.com/shorts/YjzlmKz_MM8 https://www.youtube.com/shorts/YjzlmKz_MM8

I am concerned about the public reacting aggressively agaisnt the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit, however unjust it was. The correct support for a just cause must have been constructive: providing financial support for the defendant, public manifestation campaign, professional lobbying, etc Although this time I agree with the defendant cause, the response by the public was as toxic bullying as the plaintiff, only stronger.

deleted 1y ago
[deleted]
tyleo 1y ago
You’re getting downvoted which is unfortunate because I think you make a worthwhile point. Emotionally I disagree with you. It feels like a bully is getting what a bully deserves. Logically, I think you are right though. Crowds just aren’t equipped to handle these situations. There are cases where the wisdom of the crowd is correct, but there are many more where it multiplies harms. The underlying problem is that it never feels like justice is being served. Another comment mentions that there should be harsher punishment for false DMCAs. I don’t think the “wisdom of the crowd” approach is the best way to write those wrongs but I lament that modern justice has not been up to the task.
- cindyllm 1y ago
  [dead]
mikestew 1y ago
I’m going to border closely to blaming the “victim” here, but if the lawsuit had been filed without toxic, threatening, man-baby social media posts, we wouldn’t be hearing about it. Harassed because he filed a lawsuit? C’mon, there’s a lot more to it than that. When one goes swinging their dick around on Twitter in an attempt to garner support (from one’s equally toxic fans, I presume), one will also likely attract equally toxic folks who disagree. Talk enough shit, and you’ll eventually get a punch to the face. Right or wrong, such is the world long before social media.
MBCook 1y ago
That’s the internet these days. It’s been going on for decades. Game developers got death threats over minor changes to video games and nothing happened to them. Is it that surprising that tactic has continued? People can make fun of the company all they want. That’s fair game. They shouldn’t be calling the guy’s personal phone or harassing his family, that’s totally over the line. But nothing happens. The behavior gets a pass so it continues to become more common. That passes for debate now.
- ipaddr 1y ago
  Phone numbers are public not personal secrets. If you have a number someone can call it.
  - MBCook 1y ago
    And I can find relatives/friends on Facebook to harass. Doesn’t make it ok. Just like the fact we have agreed upon rules against using chemical weapons or attacking civilians in war (which some violate), the fact something is possible doesn’t mean society should accept it. If we don’t have even the basic civility of not getting death threats over whatever minor thing someone on the internet is mad at, even mixing us up with their real target sharing our name, what’s left? Everything becomes full force win at all costs, no matter how stupid or trivial. Who wants to live like that?
  - snowwrestler 1y ago
    To be clear, threatening people in person is against the law too.
  - HelloMcFly 1y ago
    Let's all say it together: just because you can doesn't mean you should
greedo 1y ago
This all sounds great in the abstract. But reality is different due to the power differential. McNally is just one dude (albeit with a huge following). Lee is obviously a toxic jerk and his attacks and mockery of McNally triggered both McNally repeatedly proving the flaws in Proven's technology. McNally obviously did the correct thing it seeking counsel and basically demolishing Proven's case in court. Too bad the SLAPP stuff doesn't work with DMCA takedowns. And everyone else cheering on the sidelines (who isn't a paid shill of Proven's like the guy making the "liberal" comment)? Well giving Lee's company shit is fine IMHO. Call up the publicly available phone numbers, make service requests to flood his business etc. Fine with me. You poke the Internet bear, you get some claws. As to the threats? If they actually occurred (which is questionable considering the BS Proven has been saying), then let the authorities know about them. That's not on McNally at all, it's more Lee being a jerk who doesn't know about the Streisand Effect, combined with social media companies that allow stuff like that to happen. It's also a good idea to not expose too much info about your personal life on social media that can be linked to your business, opsec ya know?
mindslight 1y ago
> the lock company owner amd his family. The guy is definitely a toxic bully, but he was indeed violently harrassed by filing a lawsuit I think you're confusing who filed the lawsuit here. That was also the lock company owner as well (Lee/Proven). While I agree that flash mob harassment from the Internet is a terrible dynamic, filing baseless lawsuits has been a longstanding way to predictably summon them. So if the table stakes of launching or defending these type of aggressive attacks have gone from a significant amount of money for attorneys, to a significant amount of money for attorneys plus public relations and/or having a large audience, does that really actually change much? Either way most people simply don't file lawsuits, even if they've been actually wronged, due to the extreme personal stress. The straightforward way of diminishing mob justice is to make people believe the system provides justice. If we lived in a society where McNally would predictably win the lawsuit [0], and be predictably compensated for his expenses/time/emotionalDistress for being on the receiving end of this baseless SLAPP, then there would be much less mob outrage to begin with. As it stands, everyone can imagine themselves receiving these types of legal shakedown letters, but having much less power to push back. [0] it sounds like this particular suit was slapped down pretty hard and "quick" by the standards of the legal system, but there are many similar cases that don't go this way

zamalek 1y ago

Someone seriously needs to be taken to task for filing a false DMCA. DMCA is just another term for SLAPP these days. If anyone is a lawyer, they could still be despite retracting the case?

nerdsniper 1y ago
Anti-SLAPP is a great tool to have, but we do need slightly stronger ones. It’s a tough balance to find - to minimize the potential ways to abuse the system for all different kinds of entities/people. YouTube’s TOS would be the most critical place to begin in terms of evaluating legal options. To file a “DMCA” (not really DMCA but YT’s proprietary version of it) claimants generally have to create an account and agree to the TOS. So it may bind both parties (the YTer and the abusive DMCA claimant). That might limit legal options for anti-SLAPP, tortious interference, etc. But without either significant legal expertise or someone finding some particularly relevant case law, it seems like a nuanced enough domain that no one’s lay “legal” opinion would be particularly illuminating.
- ProllyInfamous 1y ago
  As the recipient of a SLAPP lawsuit (~decade ago) for truth I published online, the biggest problem with Anti-SLAPP statutes is that laypeople (particularly poorer ones) have limited access to attorney representation... the judicial system isn't accessible/friendly to the pro se litigant. So even if the case is clearly being used to strategicly silence you, it'll probably still work (from plaintiff's POV). Same for DMCA.
  - jcranmer 1y ago
    With a strong Anti-SLAPP statute, the person who files the lawsuit is on the hook for the defendant's legal fees, which would (in theory) let the defendant hire an attorney on contigency fees. Of course, one of the other issues is there's no federal Anti-SLAPP statute, and circuits are split as to whether or not state Anti-SLAPP applies to federal lawsuits, so if someone can diversity jurisdiction you into a federal SLAPP lawsuit, you're kind of stuck.

mindcrime 1y ago

It's probably a good thing for Proven that they didn't get into this dispute the LockPickingLawyer instead. He'd wind up owning their company in the counter-suit...

adolph 1y ago
That'd be an interesting channel, the "LockMakingLawyer" where the lock is highly lawsuit resistant, "Press the NDA button to always be informed when the next video comes out"

mothballed 1y ago

This guy shims a $100+ lock in 10 seconds with a liquid death can, all without speaking in the video, just replays and then destroyed their claims and GTFO. Absolutely masterful.

viggity 1y ago

These kinds of results seem all too common. Like, why? Are companies just too used to using their general business attorneys for it, and those attorneys are just ignorant? Hungry for extra billable hours?

resoluteteeth 1y ago
Even if they know they would lose in court, lawsuits are expensive enough that threatening to sue or filing a lawsuit is often enough to get people without deep pockets to do whatever you want. I don't know if that was the reasoning in this case though, considering that they didn't drop the lawsuit once it was clear that the youtuber wasn't going to give in to their demands.
topspin 1y ago
> Like, why? The answer, as succinctly as possible: cognitive dissonance. This is exhibited in every human endeavor, but it's particularly acute, or at least more apparent to simple analysis, in business. In business, anything that diminishes the perception of value is a threat to earnings. Business people don't tolerate the existence of such perceptions in their minds. They readily adopt whatever mental state is necessary to deny realities that reveal a lack of value in whatever work product they sell. In this case, someone demonstrated a weakness in a lock design. In the minds of the business people behind the product, this is impossible. Their locks are awesome. Best locks in the world! Therefore, the only conceivable possibility permitted, in their minds, is fraud or some other actionable offense that can be feasibly pursued in court. The role of lawyers in this is a symptom, not a cause. Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Whatever aberrations or iniquities arise from this are simply denied by yet more cognitive dissonance.
- walterbell 1y ago
  > Lawyers are paid to exhibit the necessary cognitive dissonance their clients require. Thanks for answering this FAQ.
- dwattttt 1y ago

ProllyInfamous 1y ago

Back in 2007, I published the first YouTube bypass of the Master Lock #175 (very common 4-digit code lock), using a paperclip. After the video reached 1.5M views (over a couple years), the video was eventually demonetized (no official reason given). I suspect there was a similarly-frivolous DMCA / claim, but at that point in my life I didn't have any money (was worth negative) so I just accepted YouTube's ruling. Eventually shut down the account, not wanting to help thieves bypass one of the most-common utility locks around — but definitely am in a position now where I understand that videos like mine and McNally's force manufacturers to actually improve their locks' securities/mechanisms. It is lovely now to see that the tolerances on the #175 have been tightened enough that a paperclip no longer defeats the lock (at least non-destructively); but thin high-tensile picks still do the trick (of bypassing the lock) via the exact same mechanism. Locks keep honest people honest, but to claim Master's products high security is inherently dishonest (e.g. in their advertising). Thievery is about ease of opportunity; if I were stealing from a jobsite with multiple lockboxes, the ones with Master locks would be attacked first (particularly wafer cylinders).

mothballed 1y ago
Actual thieves don't give a shit to learn lock picking, they can use a fine toothed sawzall or oxy-acetylene torch and defeat any lock just as fast without having to youtube the particular brand.
- b00ty4breakfast 1y ago
  most thieves don't even go that far. they find stuff that isn't locked or they kick in the door.
- Ekaros 1y ago
  It is actually surprising just how little brute force many semi-decent padlocks can handle. A decent mallet and some force concentrator and I think good amount of them will fail.
  - ortusdux 1y ago

c420 1y ago

https://youtu.be/qL_MeobAp5s?t=1487 https://youtu.be/qL_MeobAp5s?t=1487 For those interested in the actual case, here's some deeper coverage of this bruhaha including how Lee may have perjured himself during deposition.

hinkley 1y ago
That guy sure isn’t in a hurry to get anywhere. Good one to watch at 1.25x speed.

pcthrowaway 1y ago

Lock-makers should start including RFID and a software key checking mechanism, then sharing the key would be illegal

ranger_danger 1y ago
> sharing the key would be illegal How so? And what region are you referring to? There are many countries in the world with vastly different laws.
- tgsovlerkhgsel 1y ago
  Unfortunately, the "region" would be the 193 member states of WIPO: https://en.wikipedia.org/wiki/Anti-circumvention https://en.wikipedia.org/wiki/Anti-circumvention So, you are right, the laws in Micronesia, Palau and South Sudan might be vastly different.
dcan 1y ago
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
- butlike 1y ago
  plz stop! my hddvds...
- foofoo12 1y ago
  That's an illegal number mate. Straight to the slammer! (for those missing out: https://en.wikipedia.org/wiki/AACS_encryption_key_controversy https://en.wikipedia.org/wiki/AACS_encryption_key_controvers...)
- dmbche 1y ago
  Thabk you so much this is a beautiful rabbit hole to go down
nomel 1y ago
Could you make access illegal using the DMCA, by putting some copyrighted content inside, with the physical key also being the license key?

hinata08 1y ago

The internet : sees thoughts challenging facts Someone : “Sucks to see how many people take everything they see online for face value,” one Proven employee wrote. “Sounds like a bunch of liberals lol.” The company : Proven also had its lawyers file “multiple” DMCA takedown notices against the McNally video, claiming that its use of Proven’s promo video was copyright infringement. When did facts and enlightenment started to be for "liberals lol" ? Freedom of speech based on facts should be universal.

mothballed 1y ago
>Freedom of speech based on facts should be universal. To be fair that's not what we have in USA. For instance, a nurse who never even signed a private privacy agreement with anyone (unusual, but could happen) could violate HIPAA if they factually tell a patient's spouse the patient is being treated for AIDS and they ought to watch out.
- alwa 1y ago
  Yes, they could and most definitely would be. The case you describe is one of the reasons it’s that way. For what exactly would this fly-by-night nurse be telling me to “watch out,” in relation to my partner who’s living with and being treated for HIV? One hopes this nurse, being medically trained and apparently working with vulnerable populations, understands the efficacy of the modern HIV therapies the patient is receiving. That, when managed, HIV is not transmissible by conventional marital means [0]; and that, until recently at least [also 0], concerted public health efforts have meant that most anyone who seeks medical attention ends up on those modern therapies. That said, I hope said nurse would catch me in a charitable mood rather than a litigious one. [0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetectable-untransmittable.html https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta...
  - mothballed 1y ago
    This is an entirely different argument than the fact at hand, which is making the factual statement is illegal. You're just explaining why stating the fact should be illegal. >[0] https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta https://www.cdc.gov/global-hiv-tb/php/our-approach/undetecta... I said AIDS, not HIV. I am no AIDS expert but I would be shocked if a large portion of people AIDS had no detectable viral load, while people with HIV commonly do not have detectable one. Wouldn't people with no detectable viral load generally not being exhibiting AIDS?

jwr 1y ago

If you don't know him already, I highly recommend videos by LockPickingLawyer — he routinely destroys bogus claims of various companies within seconds. It's quite entertaining to see how little security you actually get from most locks. I wonder if anybody tried suing him…

jasoncartwright 1y ago
LPL is superb. He inspired me to get a lock pick kit and a few simple padlocks - a cheap and fun hobby during COVID lockdowns.
- diego898 1y ago
  Thinking of doing the same! Which kit did you order? I see a FNG, FNG+ Bundle, and "Learn lockpicking bundle". 3rd one seems the most likely candidate. Any tips you can share? Thanks!
  - yoz-y 1y ago
    I’ve got a German practice lock and boy was that a hard wake up call. That thing was so hard to pick that I gave up. (The keyhole is really slim) My bad though, LPL did warn about this.
  - embedding-shape 1y ago
    I did the same (also during COVID, after doing it for a bit in my youth). I haven't tried Covert Instruments gear, I bought some other pack from China, but whatever pack you can find with the basics (and maybe some variety so you can try different techniques) plus a training padlock so you can see what's going on inside, and it'll be a walk in the park.
  - Y_Y 1y ago
    Start with a cheap kit from e.g. Amazon which includes a couple of perspex locks so you can see what you're doing. Get a real set of picks for real money once you graduate from that.
  - 1y ago

tuetuopay 1y ago

The most absurd thing is the original video response from the company was good, and with a very compelling argument: their customers never saw shimming in the field. Their user base don't need shimming resistance: security needs to be adequate, not perfect. And they follow-up by presenting options about people requiring the lock to be shim-proof. Granted, in this day and age, it's a disgrace to still make locks that can be shimmed. Especially when the shim-proof alternatives they show just have an additional notch to catch the shim.

adgjlsfhk1 1y ago
> their customers never saw shimming in the field. This is arguably good PR, but a terrible response. Shimming is so quick and hard to detect that even if you had 24-7 video of the lock, you probably wouldn't notice that the lock had been shimmed. You would just assume that someone lost a key.
- masklinn 1y ago
  Also the company sold a picking-proof version… at a higher price.
  - masklinn 1y ago
    shimming proof not picking, sorry just noticed the entirely wrong word
- yreg 1y ago
  It's a trailer hitch lock. If someone steals your trailer then you definitely do notice. And if they just shim the lock and put it back then it doesn't really matter.
deleted 1y ago
[deleted]

robotnikman 1y ago

I wonder how many stories like this are caused simply because a corporate lawyer is looking for some work to do, and maybe to meet some kind of internal KPI.

pcaharrier 1y ago
Former in-house lawyer here and in my experience the answer is something like "probably less than you think." The job of the lawyer is to advise the client and (within the bounds of ethical rules) advocate for their position, not to come up what the company's position should be.
- robotnikman 1y ago
  Interesting, thanks for the insight!
- dghlsakjg 1y ago
  Honest question. Is it the job of an in-house lawyer (or any lawyer) to say that this appears to be a vexatious or SLAPP case, and the client should not pursue it? Is there an ethical obligation not to get involved in a case that you know is being prosecuted in bad faith?
  - pkilgore 1y ago
    Within the limits of their knowledge/ability, yes. Some bosses make it clear they do not like being told no, however. YMMV if you continue to work for such people. The bar there is very high. This case might be embarrassing but probably isn’t sanctionable. And the only lawyer that would get sanctioned would be the ones that signed the papers not the drone that hired them.

jimbokun 1y ago

> Under questioning, however, one of Proven’s employees admitted that he had been able to duplicate McNally’s technique, leading to the question from McNally’s lawyer: “When you did it yourself, did it occur to you for one moment that maybe the best thing to do, instead of file a lawsuit, was to fix [the lock]?” Sometimes a single question tells you how the entire case is going to go.

rdtsc 1y ago

> On July 7, the company dismissed the lawsuit against McNally instead. > Proven also made a highly unusual request: Would the judge please seal almost the entire court record—including the request to seal? Tough at first then running away with the tail between their legs. Typical bullying behavior. > but Proven complained about a “pattern of intimidation and harassment by individuals influenced by Defendant McNally’s content.” They have to know it's generated by their own lawsuit and how they approached it, right? They can't be that oblivious to turn around and say "Judge, look at all the craziness this generated, we just have to seal the records!". It's like an ice-cream cone that licks itself. > the case became a classic example of the Streisand Effect, in which the attempt to censor information can instead call attention to it. A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media.

embedding-shape 1y ago
> A constant reminder to keep the people who don't know what they are doing (including the owners of the company!) from the social media. I'm just guessing based on the contents of the article, but it sounds like a typical "hard-fist founder-run company" so good luck convincing the founder to not sit on social media and argue their points.
- dekhn 1y ago
  also known as the 'double down on stupid' and 'triple down on stupid'
  - seanhunter 1y ago
    This is known as the “Randy Pitchford” social media strat.
  - jeltz 1y ago
    We recently had an example of that with Automattic and the WordPress drama. Where the founder was here on HN hurting his own legal case despite people here repeatedly told him to stop posting for his own sake and asking him to talk to his lawyers.

zahlman 1y ago

So... what should we be using for physical security?

shagie 1y ago
The question is "what do you want to secure against?" Describe the threat and then go from there. What are you securing? Is it meth-head or teenager? Or is it person determined to get in while making your insurance grill you over "did you lock it?"
alistairSH 1y ago
In the case of a trailer, you do some combination of... - Receiver pin lock similar to the one highlighted here (but probably not that exact one) - Wheel lock / boot - Receiver coupler lock (locks inside the cup-shaped receiver, preventing somebody towing the trailer with an undersized ball) - Secured storage lot / garage But, basically all options are only going to stop random opportunistic thieves. If somebody really wants whatever you're protecting, they'll find a way. That's why insurance exists.
teekert 1y ago
Just clicked around after watching the vid and stumbled onto [0]. So there are locks he recommends... When it requires focus + several minutes to pick. [0] https://www.youtube.com/watch?v=HrV86GqlY8o https://www.youtube.com/watch?v=HrV86GqlY8o
sebstefan 1y ago
I do lockpicking and swear by "Abus" locks

shagie 1y ago

Long (often an hour long) with significant snark videos going over the filings: https://www.youtube.com/@RunkleOfTheBailey/search?query=Proven https://www.youtube.com/@RunkleOfTheBailey/search?query=Prov...

modeless 1y ago

> In the end, Proven’s lawsuit likely cost the company serious time and cash—and generated little but bad publicity. There's no such thing as bad publicity. People say this for a reason. It's true. I'm willing to bet that their sales have only increased since this started.

Tade0 1y ago
Who is in the market for a product that doesn't work as advertised?
- leni536 1y ago
  Lockpicking youtubers? But I guess that market got exhausted early on.
paxys 1y ago
There's absolutely such a thing as bad publicity. Entire products and even companies have tanked because of bad publicity. I don't know why this myth continues to be so prevalent.
- dec0dedab0de 1y ago
  I think the saying is for people who can take the bad publicity and use it to their advantage.
henry2023 1y ago
I didn’t buy a Juicero back in 2015. Seems like I was not the only one.
- modeless 1y ago
  Bad publicity doesn't guarantee success for a bad product. But it doesn't doom a good one either.
ktallett 1y ago
You're right! I'm off to the next Fyre festival and making sure my bag is secure with a Proven lock..... I wonder if Dassani still exist so I definitely can quench my thirst.

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

rkhassen9 1y ago

Um...shouldn't Proven just hire Trevor McNally as a consultant or heck, make him a partner? I mean...can you imagine the next level reputation they'd have if they can adapt and make a Trevor-proof lock? I'd buy it.

ngcc_hk 1y ago

Interesting story but surprisingly bad write up. What happen to arstechnica.

zem 1y ago

clearly proven needs to sue whoever initiated that lawsuit for "mockery produced for the purpose of humiliating plaintiff”.

tptacek 1y ago

The whole case is up on RECAP: https://www.courtlistener.com/docket/70036390/proven-industries-inc-v-trevor-mcnally/ https://www.courtlistener.com/docket/70036390/proven-industr...

TaupeRanger 1y ago

[flagged]

jasonjmcghee 1y ago
the YouTuber in question doesn't talk. that's the representative from the lock company - basically the infomercial
- thenthenthen 1y ago
  its a very confusing video to watch without sound haha, not sure if it gets better with sound. The fact that you do not see the lock pickers face makes you assume it is the same person doing the talking (the representative).

vladmk 1y ago

Yeah saw this - I can't believe a company would steer so far wrong...

dekhn 1y ago

I once worked for a company that kept its passwords locked in a safe. One day, all other copies of the password were lost, and they needed it, but the safe's key could not be found. They expensed a sledgehammer and obtained the password through physical modification of the safe using a careful application of force. Some employees complained that meant the safe wasn't... well, safe. The security team replied "Working as Intended" - no safe is truly safe, it's just designed to slow down an attacker. At that moment, I was enlightened.

russdill 1y ago
Excellent koan
Terr_ 1y ago
All Security Hinges on the arrival Of people with guns
- cwsx 1y ago
  Obligatory xkcd https://xkcd.com/538/ https://xkcd.com/538/
  - tonyhart7 1y ago
    please stop mention this anymore, I gonna crazy
    - hrimfaxi 1y ago
      I thought maybe cwsx was posting this often but that doesn't seem to be the case. Is it that that xkcd is basically a HN trope at this point?
      - deaux 1y ago
        If you do a site search you'll find 700+ comments linking to it. I wouldn't be surprised if it was the number one most frequently linked page in HN history.

croes 1y ago

> Proven argued that it would be difficult for an untrained user to perform. That’s are exactly the people who usually break locks. All others fail on simple locks too.

croes 1y ago

> Lee’s partner and his mother both “received harassing messages through Facebook Messenger,” while other messages targeted Lee’s son, saying things like “I would kill your f—ing n—– child” and calling him a “racemixing pussy.” Some people always go too far, undermining the good cause of the others

anitil 1y ago

If anyone is interested in the legal side, I'd also recommend 'Runkle of the Bailey' who has a series on this saga but with a focus on the legal shenanigans [0] [0] https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfklP1xO1qdmL63lpkZQSaPEpP https://www.youtube.com/watch?v=y3WVme9LAcQ&list=PLo0bMOObfk...

logicallee 1y ago

This is the stupidest thing I read today.

realaaa 1y ago

so they were even asking for it themselves? ahah, geniuses

sreekanth850 1y ago

Suing someone because your product doesn't work correctly is diabolical. Instead of filing a lawsuit, they should have acknowledged the issue and released an upgrade to their locks.

bdamm 1y ago
Ah, but the truth came out here; the can't sell a lock that is upgraded, because they already do sell one at a higher price. There are cheaper locks if you don't care to defend against shimming.

rdiddly 1y ago

What a snowflake.

kuil009 1y ago

OMG

sebstefan 1y ago

The entire field of locksmithing has a failing culture around security. They still rely on security by obscurity, they sue attackers, and they never improve

DecentShoes 1y ago

The company who sued him is, still, embarrassingly, attempting to hold a social media presence, despite getting exposed as fraudsters and bullies: https://m.youtube.com/@provenindustries8236 https://m.youtube.com/@provenindustries8236

lenkite 1y ago

Haven't laughed so much reading an article recently. Wow, this story looked taken right off a comedy movie.

jeffreygoesto 1y ago

https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr https://youtu.be/PVhYhLQ4Y64?si=5UrMMeovCkP2J3Nr

deleted 1y ago
[deleted]

jbs789 1y ago

Sounds like the guy had rude awakening that his lock wasn’t as good as he thought it was. Another way of responding to this is… to improve the lock? Could even explore a positive collaborative social media campaign promoting the new lock. Ship has sailed now…

jeroenhd 1y ago
There were locks that were secure against this attack, but they're more expensive. The cheaper locks vulnerable to this attack probably still makes them a load of money, though.

hufdr 1y ago

If a company’s first reaction to a flaw is to sue instead of fix it, the problem probably goes beyond the lock itself. A real security company would appreciate someone pointing out a weakness rather than trying to take the video down. That kind of openness would actually make people trust them more.

jeroenhd 1y ago
The weird thing is, they actually had someone competent dealing with the issue: > The strange thing about the whole situation is that Proven actually knew how to respond constructively to the first McNally video. Its own response video opened with a bit of humor (the presenter drinks a can of Liquid Death), acknowledged the issue (“we’ve had a little bit of controversy in the last couple days”), and made clear that Proven could handle criticism (“we aren’t afraid of a little bit of feedback”). > The video went on to show how their locks work and provided some context on shimming attacks and their likelihood of real-world use. It ended by showing how users concerned about shimming attacks could choose more expensive but more secure lock cores that should resist the technique. Sounds to me like someone professional in the company with a cooler head was on this and was handling it well, but someone else higher up got angry and aggressive and decided that revenge was more important.

pkphilip 1y ago

One of my favourite lock pickers is Marc Tobias. He was also sued by a number of lock companies. https://www.youtube.com/watch?v=NadPAE6BDbA https://www.youtube.com/watch?v=NadPAE6BDbA It is interesting to see that these companies still don't know about the Streisand Effect or they choose to think that it won't happen to them.

foofoo12 1y ago
He just dropped a new video. Totally roasted the cunt out of that Easilok: https://www.youtube.com/watch?v=3lS5_6D4q9k https://www.youtube.com/watch?v=3lS5_6D4q9k

Azkron 1y ago

This reminds me of the CEO of a cyber security company that challenged Anonimous https://en.wikipedia.org/wiki/HBGary https://en.wikipedia.org/wiki/HBGary. If you work for any kind of security company, do not ever ever ever challenge any kind penetration specialist. Everything is hackable, it is only a matter of cost vs reward, but when you challenge someone that goes out of the window.

matheusmoreira 1y ago
Generalizing the advice.. Don't challenge people. Don't insult people. Don't humiliate people. Don't threaten people. Allow them to maintain their self-respect even when they lose. Don't rub it in. Give them a face-saving exit. Plenty of violence and aggression is caused by violation of the above rules. They seem simple but they're broken on a daily basis. Famous last words: "you don't have the guts".

kh_hk 1y ago

It would be funny if all this was just a liquid death marketing campaign

wafflemaker 1y ago

Once came back to work after 4 week holidays (not USA) and realized I forgot the 3 digit code to my locker. But I remembered that friend's locker (he was on holidays then) used US police code for murder. (Police in US use codes for crimes when communicating on the radio). I googled the code, used friend's locker for the day, and by lunch the next day I've bruteforced through enough codes to learn that my code was the embarrassing 420.

simonw 1y ago

This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html https://www.mattblaze.org/masterkey.html When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html https://www.mattblaze.org/papers/kiss.html It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.

agumonkey 1y ago
Even as a computer nerd, I find computing culture to be often too radical sometimes.
- jama211 1y ago
  Agreed
czx111331 1y ago
Perhaps the most important difference is that software — even after being purchased and used — remains relatively easy to patch, unlike a physical lock.
- sigmoid10 1y ago
  Tbf that's a new-ish principle. 2003 was Windows XP era and the early days of Metasploit. I.e. Microsoft and all the other companies were still figuring out this internet thing, while most computers were riddled with unpatched vulnerabilities. There was no such thing as zero day back then, because you could use many exploits years later.
  - ale42 1y ago
    Totally true. Also consider that although software can theoretically or technically be patched, sometimes patches just don't exist... the amount of unmaintained but yet useful software is just huge.

deleted 1y ago

[deleted]

ODIER 1y ago

[dead]

amelius 1y ago

Wait, what if a hacker found an exploit and then published it without giving the company a chance to fix it?

deleted 1y ago

[deleted]

HexPhantom 1y ago

They turned a one-minute critique into a PR disaster that millions of people now know about

aswegs8 1y ago

The wohle article reads to me like: "AMERICA FKK YEAHHH BROO, HE GOT PWNNNDD, SON!" eagle sounds Gotta admit its entertaining, though.

dpoloncsak 1y ago

Saw the headline, knew it was going to be McNally. God Bless McNally

throw7 1y ago

Who knew shaking a juice box could be so intimidating!

xyst 1y ago

LPL (Lock Picking Lawyer) has been making a fool of MasterLock and other physical security products/marketing for many years. Guess ML realizes it’s best to be humiliated online where a small subset of population would never buy their products anyways. Rather than humiliate themselves in public like Proven Industries did (Barbara Streisand effect?)