3 ms·

(To be clear, I'm speaking more broadly about the topic and absolutely not condoning the weev's alleged actions. Lack of responsible disclosure, discussion of p

by meritt 14y ago

(To be clear, I'm speaking more broadly about the topic and absolutely not condoning the weev's alleged actions. Lack of responsible disclosure, discussion of profiting from the flaw and exploiting it far beyond simple validation tests are all going to make it very difficult for him.) Observing sequential identifiers in a URL and validating a gaping security hole is hardly something I'd classify along the lines of "stealing a database" nor should it be considered "unauthorized access", however the judicial system clearly feels different and that's the sort of changes I'm advocating that need to be adjusted. Of course, discussing legislation changes that would allow anyone to execute security testing is probably not a very lucrative topic with the founder of a company that provides security research & testing.

tptacek 14y ago
A.A. and his alleged coconspirator may be exonerated, so maybe you're right. But using a flaw like this to download 100,000 email addresses, and then select from those addresses those of prominent members of the media to do outreach for a PR campaign, all the while talking on IRC about selling the addresses to spammers --- that's something more than simply observing increasing numeric IDs. Your last sentence is needlessly and pointlessly hostile. If I was arguing out of personal interest, I wouldn't be recommending that companies pre-consent to having strangers test their web apps by setting up thank-you pages, now would I?
danielweber 14y ago
That last sentence is incredibly lame. I've had problems with 'tptacek (from an incident several years ago that I'm finally over) but he argues for security policies that he believes work, not those that are in his interest. A wild-west attitude, with every man for himself, no-holds-barred, no-legal-resource-when-you-are-hacked is the best possible thing for security people, who would be kingmakers in such a universe.
- chc 14y ago
  The security field in such a universe would be a gigantic, insanely lucrative shakedown racket. "I can help harden your systems against attacks — or I can just steal your customer database and sell their info to these nice Russian gentlemen. Whichever you prefer."

by meritt 14y ago

tptacek 14y ago

A.A. and his alleged coconspirator may be exonerated, so maybe you're right. But using a flaw like this to download 100,000 email addresses, and then select from those addresses those of prominent members of the media to do outreach for a PR campaign, all the while talking on IRC about selling the addresses to spammers --- that's something more than simply observing increasing numeric IDs. Your last sentence is needlessly and pointlessly hostile. If I was arguing out of personal interest, I wouldn't be recommending that companies pre-consent to having strangers test their web apps by setting up thank-you pages, now would I?

danielweber 14y ago

That last sentence is incredibly lame. I've had problems with 'tptacek (from an incident several years ago that I'm finally over) but he argues for security policies that he believes work, not those that are in his interest. A wild-west attitude, with every man for himself, no-holds-barred, no-legal-resource-when-you-are-hacked is the best possible thing for security people, who would be kingmakers in such a universe.

chc 14y ago
The security field in such a universe would be a gigantic, insanely lucrative shakedown racket. "I can help harden your systems against attacks — or I can just steal your customer database and sell their info to these nice Russian gentlemen. Whichever you prefer."