4 ms·

I wonder how many of the 420,000 machines they ran their code on got screwed up by them? As anyone who's tried to manage a cluster of machines knows, it's a pa

I wonder how many of the 420,000 machines they ran their code on got screwed up by them? As anyone who's tried to manage a cluster of machines knows, it's a pain to get everything working. Even when you have complete control over the hardware, software and network, distributing code to the cluster and making the cluster send stuff back is difficult. So much can go wrong and it is easy to take out servers with what seems like the most trivial of mistakes. Now try doing this with almost half a million machines, of unknown hardware, already running unknown software, and operating in network conditions that you have no idea about. Do you think they did it perfectly and nothing went wrong? They undoubtedly broke or disrupted many computers and systems here, and they know it. They can write all the weasel-words they like about how nice and kind they were, but I am sure they broke a lot of people's systems (some of them, by their own admission, running important services).

MertsA 14y ago
But honestly it would be pretty hard to break it beyond what a reboot would fix. Most of those embedded devices probably don't have a persistent /tmp directory and even if they did the only chance of really screwing it up would be if that 45 - 60 kb binary took up enough space to break something. It seems pretty unlikely and even then I'd consider it a net positive because then someone notices the device with root exposed to the world.
pixl97 14y ago
While the researchers have no moral high ground to stand on here, neither do the 420,000 people (or whatever division of that is owned by separate groups) that are running insecure devices. I've messed up and put insecure stuff on the internet before. I'd rather have it go down and break in a fire rather then having it quietly ship personal information to (feared country of choice). If you put an insecure device on the internet, the damage that ensues is your fault. Ignorance cannot be an excuse. Default passwords and no passwords are just unacceptable. Yes, by some twisted logic you can blame the hacker, but as time goes on we see more and more state sponsored attacks. It is their job to hack in to equipment of other nations for various reasons. It is your job to keep that from happening. TL;DR There is no such thing as a trivial mistake on a public network.
- jankins 14y ago
  Someone who leaves his car door open & his car running is obviously practicing poor security. But it doesn't take "some twisted logic" to show that a thief is still culpable for the crime if he takes the car. I don't think the analogy breaks down in any essential way when applied to the current discussion.
  - pixl97 14y ago
    thief is still culpable for the crime if he takes the car. Unless the thief is in a country that neglects, ignores, or rejects your law. This is where the analogy breaks down. Unless you fool the person to come to your (or another friendly) country they can hack you with impunity, that said there has been examples of hackers dumb enough to come to the U.S. after the fact. A better way to look at this instead of the criminal method is the insurance method. Your insurance company is going to be unwilling to pay for your loss because you were stupid and left your car open and running where Russian gangsters could steal it with impunity.
  - lukeschlather 14y ago
    We're not talking about a thief who took the car. To complete your analogy, the intruder installed a GPS device and gathered real-time traffic data. Illegal? Probably. But not theft.
    - zeckalpha 14y ago
      No, it is more like they got in and locked the doors so the real thieves couldn't get in. (Aidra) I still don't like it.
      - marshray 14y ago
        Well to complete the analogy, he stole a tiny bit of the juice from the battery to charge his mobile phone while he was at it.
nitrogen 14y ago
(some of them, by their own admission, running important services) It sounded like the author targeted only the most common hardware configurations, so it's likely that these were TV set-top boxes and ISP-issued routers. At any rate, if there was a massive spike in worldwide equipment failures between June and October of 2012, we probably would've heard about it.

MertsA 14y ago

But honestly it would be pretty hard to break it beyond what a reboot would fix. Most of those embedded devices probably don't have a persistent /tmp directory and even if they did the only chance of really screwing it up would be if that 45 - 60 kb binary took up enough space to break something. It seems pretty unlikely and even then I'd consider it a net positive because then someone notices the device with root exposed to the world.

pixl97 14y ago

While the researchers have no moral high ground to stand on here, neither do the 420,000 people (or whatever division of that is owned by separate groups) that are running insecure devices. I've messed up and put insecure stuff on the internet before. I'd rather have it go down and break in a fire rather then having it quietly ship personal information to (feared country of choice). If you put an insecure device on the internet, the damage that ensues is your fault. Ignorance cannot be an excuse. Default passwords and no passwords are just unacceptable. Yes, by some twisted logic you can blame the hacker, but as time goes on we see more and more state sponsored attacks. It is their job to hack in to equipment of other nations for various reasons. It is your job to keep that from happening. TL;DR There is no such thing as a trivial mistake on a public network.

jankins 14y ago
Someone who leaves his car door open & his car running is obviously practicing poor security. But it doesn't take "some twisted logic" to show that a thief is still culpable for the crime if he takes the car. I don't think the analogy breaks down in any essential way when applied to the current discussion.
- pixl97 14y ago
  thief is still culpable for the crime if he takes the car. Unless the thief is in a country that neglects, ignores, or rejects your law. This is where the analogy breaks down. Unless you fool the person to come to your (or another friendly) country they can hack you with impunity, that said there has been examples of hackers dumb enough to come to the U.S. after the fact. A better way to look at this instead of the criminal method is the insurance method. Your insurance company is going to be unwilling to pay for your loss because you were stupid and left your car open and running where Russian gangsters could steal it with impunity.
- lukeschlather 14y ago
  We're not talking about a thief who took the car. To complete your analogy, the intruder installed a GPS device and gathered real-time traffic data. Illegal? Probably. But not theft.
  - zeckalpha 14y ago
    No, it is more like they got in and locked the doors so the real thieves couldn't get in. (Aidra) I still don't like it.
    - marshray 14y ago
      Well to complete the analogy, he stole a tiny bit of the juice from the battery to charge his mobile phone while he was at it.

nitrogen 14y ago

(some of them, by their own admission, running important services) It sounded like the author targeted only the most common hardware configurations, so it's likely that these were TV set-top boxes and ISP-issued routers. At any rate, if there was a massive spike in worldwide equipment failures between June and October of 2012, we probably would've heard about it.