5 ms·

I don't think this particular case is black and white. Judging by my Twitter feed, a number of security researchers and white hats feel the same way I do: the l

by objclxt 14y ago

I don't think this particular case is black and white. Judging by my Twitter feed, a number of security researchers and white hats feel the same way I do: the law as it stands is not good, but what Weev did was also really, really unhelpful and borderline stupid. Rather than disclosing to AT&T, he leaked it directly to Gawker, and discussed how to potentially abuse the data he had (by shorting the stock, selling the e-mail addresses he had collected to spammers, etc). The sentence is absolutely disproportionate. But there are so many ways in which the guy could have handled himself better. I think a lot of people in the infosec industry are simultaneously angry at the sentence but not massively empathetic with the defendant. What I'm trying to say is that as a test case or campaign to change the law it's far from ideal.

flyinRyan 14y ago
Sounds like a bunch of victim blaming to me. So the guy is an idiot, is that enough to go to prison now?
- objclxt 14y ago
  ...you did read the bit where I said "the sentence is absolutely disproportionate"? I think you can be a victim and a bit of an idiot at the same time. I'm trying to point out that in terms of changing the law so this sort of thing doesn't happen again he's hardly a fantastic poster child.
- anglebracket 14y ago
  >Sounds like a bunch of victim blaming Ironic that you should say that, considering that Weev's defense is essentially "her parameters were all hanging out and it was just so easy."
  - flyinRyan 14y ago
    No weev's defense is that... it was a public URL... Do you really want to set a precedent that companies get to decide after the fact that some public URL you surfed wasn't meant to be public so now you go to jail?
px43 14y ago
He didn't expose some flaw or weakness. ATT knew that information was there, they were the ones that put it there. Weev was pointing out a negligent mishandling of data. ATT already has shown that they suck at vendor response. I think he has a duty to inform the public when there is an issue like that. If he had gone to ATT first, they likely would have lawyered him into oblivion, and kept their shitty service online.
- enraged_camel 14y ago
  This argument is very commonly made, and that's unfortunate because it is fundamentally flawed. Just because AT&T left the information exposed is not sufficient justification for some random person to take it, especially when that person takes it with the explicit intent to cause harm AND profit from it.
  - px43 14y ago
    First off, what profit? Weev can be described by many negative terms, but greedy has never been one of them. Secondly, if a company posts something publicly, people in the public are going to see it. My mind is incapable of comprehending the logic of anyone who would say "Just because we posted it on our website doesn't mean we wanted anyone to see it."
olefoo 14y ago
The first amendment makes no distinction between someone who says "Hey your shitty website is broken. And I'm telling everybody." and someone who sends a private email, hat in hand, saying; "Excuse me kind sirs, but I can't help but notice that your security procedures are somewhat lacking." And oddly, if one of those is a crime, so is the other.
- chc 14y ago
  Does the First Amendment make a distinction between a person in a crowded room shouting "I love U2" and the same person shouting "Fire"? I'm going to go ahead and suggest that the answer is "No, but we as a society make a distinction." Same princple here. I believe the general principle is that you have freedom of speech, but you do not have indemnity from the harmful consequences of your speech.
  - pessimizer 14y ago
    The judge who said that the 1st amendment doesn't cover shouting fire in a crowded theater used it as an argument to jail people for handing out anti-war fliers. So it's not even appropriate for me to say that it's a slippery slope, because it started at the bottom.
    - chc 14y ago
      Although the application is questionable, I think most people agree with the principle — you are free to speak your mind, but when your speech ventures into the realm of action, that action is not necessarily protected. For example, ordering a hit on someone is not protected even though it is technically just speech.
djvu9 14y ago
The point is one should not be punished because he is unhelpful or stupid.

by objclxt 14y ago

flyinRyan 14y ago

Sounds like a bunch of victim blaming to me. So the guy is an idiot, is that enough to go to prison now?

objclxt 14y ago
...you did read the bit where I said "the sentence is absolutely disproportionate"? I think you can be a victim and a bit of an idiot at the same time. I'm trying to point out that in terms of changing the law so this sort of thing doesn't happen again he's hardly a fantastic poster child.
anglebracket 14y ago
>Sounds like a bunch of victim blaming Ironic that you should say that, considering that Weev's defense is essentially "her parameters were all hanging out and it was just so easy."
- flyinRyan 14y ago
  No weev's defense is that... it was a public URL... Do you really want to set a precedent that companies get to decide after the fact that some public URL you surfed wasn't meant to be public so now you go to jail?

px43 14y ago

He didn't expose some flaw or weakness. ATT knew that information was there, they were the ones that put it there. Weev was pointing out a negligent mishandling of data. ATT already has shown that they suck at vendor response. I think he has a duty to inform the public when there is an issue like that. If he had gone to ATT first, they likely would have lawyered him into oblivion, and kept their shitty service online.

enraged_camel 14y ago
This argument is very commonly made, and that's unfortunate because it is fundamentally flawed. Just because AT&T left the information exposed is not sufficient justification for some random person to take it, especially when that person takes it with the explicit intent to cause harm AND profit from it.
- px43 14y ago
  First off, what profit? Weev can be described by many negative terms, but greedy has never been one of them. Secondly, if a company posts something publicly, people in the public are going to see it. My mind is incapable of comprehending the logic of anyone who would say "Just because we posted it on our website doesn't mean we wanted anyone to see it."

olefoo 14y ago

The first amendment makes no distinction between someone who says "Hey your shitty website is broken. And I'm telling everybody." and someone who sends a private email, hat in hand, saying; "Excuse me kind sirs, but I can't help but notice that your security procedures are somewhat lacking." And oddly, if one of those is a crime, so is the other.

chc 14y ago
Does the First Amendment make a distinction between a person in a crowded room shouting "I love U2" and the same person shouting "Fire"? I'm going to go ahead and suggest that the answer is "No, but we as a society make a distinction." Same princple here. I believe the general principle is that you have freedom of speech, but you do not have indemnity from the harmful consequences of your speech.
- pessimizer 14y ago
  The judge who said that the 1st amendment doesn't cover shouting fire in a crowded theater used it as an argument to jail people for handing out anti-war fliers. So it's not even appropriate for me to say that it's a slippery slope, because it started at the bottom.
  - chc 14y ago
    Although the application is questionable, I think most people agree with the principle — you are free to speak your mind, but when your speech ventures into the realm of action, that action is not necessarily protected. For example, ordering a hit on someone is not protected even though it is technically just speech.

djvu9 14y ago

The point is one should not be punished because he is unhelpful or stupid.