6 ms·

I think a more useful analogy is this: there's a large municipal building in town that stores a lot of its citizen's vital records, and they've been slipshod on

I think a more useful analogy is this: there's a large municipal building in town that stores a lot of its citizen's vital records, and they've been slipshod on security. You gather evidence about just how slipshod they've been and turn it over to a journalist. Conflating what weev did to someone walking around inside your house brings in too many emotional triggers about private property. He wasn't in someone's house, he was trying to demonstrate that the company you hired to keep your private property was doing a crappy job at it. EDIT: Okay, yes, he was probably just trying to be an ass but fortunately that's not a crime.

smsm42 14y ago
You don't "gather the evidence", you rather take the records for 100,000 citizens, put them on a truck and dump them in the frontyard for a local newspaper, after considering how much you could sell it for and deciding it's probably more fun to just cause public embarrassment. If you wanted just to show the system is insecure, 2 records would be enough. Stealing 100K of them is not something you do if your goal is just "gathering the evidence".
- drhayes9 14y ago
  There's definitely a "being an ass" component to this, no doubt... but one could argue that presenting two records to a journalist implies a small security hole. 100k of them is a giant security hole.
  - gavinlynch 14y ago
    Yah, except for the part where he spends an extra 10 seconds explaining "here are 2 of hundreds of thousands, as an example". The headline would be the same: "X Company exposes N Number of user accounts in discovered security hole". So do you see where that doesn't make any sense? edit: agree with you @drhayes9, just responding to the OP's assertion that the number mattered.
    - drhayes9 14y ago
      I don't think the number of documents mattered in this case, legally. One or one hundred thousand, the crime was the same. I think the numbers helped sensationalize it, sure.
  - smsm42 14y ago
    That's like saying just showing remote root exploit with "id" command is a small security hole, but copying the whole file server is a big one. Any journalist knowing anything about security knows that access matters, not how much is physically copied. And any that doesn't know it but has a functioning brain can understand it in under 30 seconds. I don't buy it, journalists are more than capable to make big conclusions from small evidence, they don't need much help in that.

smsm42 14y ago

You don't "gather the evidence", you rather take the records for 100,000 citizens, put them on a truck and dump them in the frontyard for a local newspaper, after considering how much you could sell it for and deciding it's probably more fun to just cause public embarrassment. If you wanted just to show the system is insecure, 2 records would be enough. Stealing 100K of them is not something you do if your goal is just "gathering the evidence".

drhayes9 14y ago
There's definitely a "being an ass" component to this, no doubt... but one could argue that presenting two records to a journalist implies a small security hole. 100k of them is a giant security hole.
- gavinlynch 14y ago
  Yah, except for the part where he spends an extra 10 seconds explaining "here are 2 of hundreds of thousands, as an example". The headline would be the same: "X Company exposes N Number of user accounts in discovered security hole". So do you see where that doesn't make any sense? edit: agree with you @drhayes9, just responding to the OP's assertion that the number mattered.
  - drhayes9 14y ago
    I don't think the number of documents mattered in this case, legally. One or one hundred thousand, the crime was the same. I think the numbers helped sensationalize it, sure.
- smsm42 14y ago
  That's like saying just showing remote root exploit with "id" command is a small security hole, but copying the whole file server is a big one. Any journalist knowing anything about security knows that access matters, not how much is physically copied. And any that doesn't know it but has a functioning brain can understand it in under 30 seconds. I don't buy it, journalists are more than capable to make big conclusions from small evidence, they don't need much help in that.