4 ms·

If you are driving down the street, and notice that I put the deadbolt onto my house backwards (so that it locked from the outside), is the appropriate thing to

If you are driving down the street, and notice that I put the deadbolt onto my house backwards (so that it locked from the outside), is the appropriate thing to do to let yourself in and walk around looking at all my stuff and then call the local news station and invite them in along with you, or is it to call the police or leave me a note letting me know I've got a problem?

drhayes9 14y ago
I think a more useful analogy is this: there's a large municipal building in town that stores a lot of its citizen's vital records, and they've been slipshod on security. You gather evidence about just how slipshod they've been and turn it over to a journalist. Conflating what weev did to someone walking around inside your house brings in too many emotional triggers about private property. He wasn't in someone's house, he was trying to demonstrate that the company you hired to keep your private property was doing a crappy job at it. EDIT: Okay, yes, he was probably just trying to be an ass but fortunately that's not a crime.
- smsm42 14y ago
  You don't "gather the evidence", you rather take the records for 100,000 citizens, put them on a truck and dump them in the frontyard for a local newspaper, after considering how much you could sell it for and deciding it's probably more fun to just cause public embarrassment. If you wanted just to show the system is insecure, 2 records would be enough. Stealing 100K of them is not something you do if your goal is just "gathering the evidence".
  - drhayes9 14y ago
    There's definitely a "being an ass" component to this, no doubt... but one could argue that presenting two records to a journalist implies a small security hole. 100k of them is a giant security hole.
    - gavinlynch 14y ago
      Yah, except for the part where he spends an extra 10 seconds explaining "here are 2 of hundreds of thousands, as an example". The headline would be the same: "X Company exposes N Number of user accounts in discovered security hole". So do you see where that doesn't make any sense? edit: agree with you @drhayes9, just responding to the OP's assertion that the number mattered.
      - drhayes9 14y ago
        I don't think the number of documents mattered in this case, legally. One or one hundred thousand, the crime was the same. I think the numbers helped sensationalize it, sure.
    - smsm42 14y ago
      That's like saying just showing remote root exploit with "id" command is a small security hole, but copying the whole file server is a big one. Any journalist knowing anything about security knows that access matters, not how much is physically copied. And any that doesn't know it but has a functioning brain can understand it in under 30 seconds. I don't buy it, journalists are more than capable to make big conclusions from small evidence, they don't need much help in that.
lifeisstillgood 14y ago
Your private house - yes sure. But if you are a bank, commercially offering "secure" services for profit, and the deadbolt is on the outside, then any public outing is to be expected. Really this is abou a lack of understanding of software and architecture by the entire public - imagine a bank had actually put a million Dollar safe up and had forgotten to put a lock on it - the competitors CEO would expect to be fired if he did not take the press and cameras around to have a good laugh
- numbsafari 14y ago
  So why not, having discovered this major security breach, contact a lawyer and sue AT&T for negligently sharing your private information?
vinhboy 14y ago
I say we should just stop trying to make moral arguments by comparing the physical world with the digital realm. It just does not work. Yes I would download a car if I could....
jellicle 14y ago
Try making an honest comparison instead. This photo was taken at a restaurant, from the outside looking in, before it opened for the day: http://www.blogto.com/upload/2008/02/20080215_rats.jpg http://www.blogto.com/upload/2008/02/20080215_rats.jpg The restauranteurs were not informed about it; it went straight to the media and to the city health department. The restaurant was shut down later that day for health violations. Has a crime been committed? Did the photographer have a moral, ethical, or legal duty to attempt to quietly inform the restaurant that they have a rat problem? Should the photographer have been prosecuted for interfering in the business operations of the restaurant? Suppose we know the photographer is an asshole. Does that change the calculus?
- numbsafari 14y ago
  None. Notice that the photographer was OUTSIDE. He didn't remove any property from the restaurant. He did not physically enter the restaurant. Part of the problem, and I think you'll agree with me on this, is that these metaphors breakdown because, when talking about information and systems, the notions of property are much more complicated. What if, for example, the photographer photographed a sheet of paper with 100 usernames and passwords to gmail accounts, or bank account records and then mailed it out for everyone to see? He should probably have gone to the authorities first, not the media.
  - mindslight 14y ago
    That sign is copyrighted and that kitchen arrangement is a trade secret, so yes, that photographer "stole" the same kind of things as weev. It's quite easy to casually condone three years in a cage for someone you don't like when that's your only involvement.
    - danielweber 14y ago
      That sign is copyrighted and that kitchen arrangement is a trade secret You don't actually believe those words you just said.

drhayes9 14y ago

I think a more useful analogy is this: there's a large municipal building in town that stores a lot of its citizen's vital records, and they've been slipshod on security. You gather evidence about just how slipshod they've been and turn it over to a journalist. Conflating what weev did to someone walking around inside your house brings in too many emotional triggers about private property. He wasn't in someone's house, he was trying to demonstrate that the company you hired to keep your private property was doing a crappy job at it. EDIT: Okay, yes, he was probably just trying to be an ass but fortunately that's not a crime.

smsm42 14y ago
You don't "gather the evidence", you rather take the records for 100,000 citizens, put them on a truck and dump them in the frontyard for a local newspaper, after considering how much you could sell it for and deciding it's probably more fun to just cause public embarrassment. If you wanted just to show the system is insecure, 2 records would be enough. Stealing 100K of them is not something you do if your goal is just "gathering the evidence".
- drhayes9 14y ago
  There's definitely a "being an ass" component to this, no doubt... but one could argue that presenting two records to a journalist implies a small security hole. 100k of them is a giant security hole.
  - gavinlynch 14y ago
    Yah, except for the part where he spends an extra 10 seconds explaining "here are 2 of hundreds of thousands, as an example". The headline would be the same: "X Company exposes N Number of user accounts in discovered security hole". So do you see where that doesn't make any sense? edit: agree with you @drhayes9, just responding to the OP's assertion that the number mattered.
    - drhayes9 14y ago
      I don't think the number of documents mattered in this case, legally. One or one hundred thousand, the crime was the same. I think the numbers helped sensationalize it, sure.
  - smsm42 14y ago
    That's like saying just showing remote root exploit with "id" command is a small security hole, but copying the whole file server is a big one. Any journalist knowing anything about security knows that access matters, not how much is physically copied. And any that doesn't know it but has a functioning brain can understand it in under 30 seconds. I don't buy it, journalists are more than capable to make big conclusions from small evidence, they don't need much help in that.

lifeisstillgood 14y ago

Your private house - yes sure. But if you are a bank, commercially offering "secure" services for profit, and the deadbolt is on the outside, then any public outing is to be expected. Really this is abou a lack of understanding of software and architecture by the entire public - imagine a bank had actually put a million Dollar safe up and had forgotten to put a lock on it - the competitors CEO would expect to be fired if he did not take the press and cameras around to have a good laugh

numbsafari 14y ago
So why not, having discovered this major security breach, contact a lawyer and sue AT&T for negligently sharing your private information?

vinhboy 14y ago

I say we should just stop trying to make moral arguments by comparing the physical world with the digital realm. It just does not work. Yes I would download a car if I could....

jellicle 14y ago

Try making an honest comparison instead. This photo was taken at a restaurant, from the outside looking in, before it opened for the day: http://www.blogto.com/upload/2008/02/20080215_rats.jpg http://www.blogto.com/upload/2008/02/20080215_rats.jpg The restauranteurs were not informed about it; it went straight to the media and to the city health department. The restaurant was shut down later that day for health violations. Has a crime been committed? Did the photographer have a moral, ethical, or legal duty to attempt to quietly inform the restaurant that they have a rat problem? Should the photographer have been prosecuted for interfering in the business operations of the restaurant? Suppose we know the photographer is an asshole. Does that change the calculus?

numbsafari 14y ago
None. Notice that the photographer was OUTSIDE. He didn't remove any property from the restaurant. He did not physically enter the restaurant. Part of the problem, and I think you'll agree with me on this, is that these metaphors breakdown because, when talking about information and systems, the notions of property are much more complicated. What if, for example, the photographer photographed a sheet of paper with 100 usernames and passwords to gmail accounts, or bank account records and then mailed it out for everyone to see? He should probably have gone to the authorities first, not the media.
- mindslight 14y ago
  That sign is copyrighted and that kitchen arrangement is a trade secret, so yes, that photographer "stole" the same kind of things as weev. It's quite easy to casually condone three years in a cage for someone you don't like when that's your only involvement.
  - danielweber 14y ago
    That sign is copyrighted and that kitchen arrangement is a trade secret You don't actually believe those words you just said.