6 ms·

The ideal is: you should be legally allowed to fetch and use any public document on internet, even if you know or should know its owner intended it to be privat

The ideal is: you should be legally allowed to fetch and use any public document on internet, even if you know or should know its owner intended it to be private.

smtddr 14y ago
> you should be legally allowed to fetch and use any public document on internet, even if you know or should know its owner intended it to be private. That's a bit too general isn't it? If I hacked H&R Block and gave the tax documents of 5,000 people to journalist should I not face some kind of consequence? Not that I'm on AT&T's side on this; just saying the line needs to be drawn somewhere. Revealing emails, to me, shouldn't be a crime at all. Revealing the kind of info found on tax-forms however should have some kind of penalty.
- bigiain 14y ago
  "If I hacked H&R Block and gave the tax documents of 5,000 people to journalist should I not face some kind of consequence?" As I see it - if H&R Block had a public webserver which used an easily innumerable url to "protect" the tax documents of 5000 people - it's H&R Block who should be "facing the consequences". Ignoring for a moment the distraction about weev's likableness and/or character, where's the outrage against AT&T for their part? If it's been a teenaged scriptkiddie from somewhere that US jurisdiction (and oil interests) don't reach (like most of these WordPress admin logins my fail2ban config is seeing these last few days), wouldn't it be _much_ more obviously AT&T's "fault"? Hell, where I live it's an offense to leave your car unlocked : http://www.police.nsw.gov.au/community_issues/crime_prevention/public_transport_and_traffic http://www.police.nsw.gov.au/community_issues/crime_preventi... (scroll down to the first bullet point under "Help Stop Car Theft"). Why isn't someone at AT&T facing jail time here?
  - AnthonyMouse 14y ago
    >Ignoring for a moment the distraction about weev's likableness and/or character, where's the outrage against AT&T for their part? There's the rub though. AT&T isn't a human, so who do you punish? You can fine AT&T the company, but that's not punishing the people who left the site like that, it's punishing the stockholders. Stockholders really don't like to be liable for the actions of fairly low level subordinates like that, and they have the political influence to make sure that doesn't happen. You could try to go after the specific admins who set up the site insecurely, but they're not unsympathetic people. The ones who do things like this are mostly people who are overworked or poorly trained through no fault of their own. The people who are really at fault, then, are the ones who hired admins without proper training or experience or put so much workload on them that they couldn't adequately do their jobs, but now you're talking about corporate executives who (like stockholders) don't like to be personally liable for the actions of subordinates and who have the political influence to make sure that doesn't happen. So we're left with a situation where there is no one good to punish, but we have to punish someone, don't we? Something bad has happened! So we kill the messenger. The messenger doesn't have any lobbyists on staff. What's missing from all this is that we really don't have to punish anyone. Just let the vulnerabilities be published. Companies don't want to hear that because it very publicly makes them look as dumb as they are, but if they can't stop it by threatening anyone with prison then the only way they can do it is by maintaining secure systems. Which means they will, or they'll face the penalties of the court of public opinion. Where in this dynamic is there a need for intervention by the federal prison system?
rhizome 14y ago
The ideal I was referring to is the character of the defendant, not their actions.

The ideal is: you should be legally allowed to fetch and use any public document on internet, even if you know or should know its owner intended it to be private.

smtddr 14y ago

> you should be legally allowed to fetch and use any public document on internet, even if you know or should know its owner intended it to be private. That's a bit too general isn't it? If I hacked H&R Block and gave the tax documents of 5,000 people to journalist should I not face some kind of consequence? Not that I'm on AT&T's side on this; just saying the line needs to be drawn somewhere. Revealing emails, to me, shouldn't be a crime at all. Revealing the kind of info found on tax-forms however should have some kind of penalty.

bigiain 14y ago
"If I hacked H&R Block and gave the tax documents of 5,000 people to journalist should I not face some kind of consequence?" As I see it - if H&R Block had a public webserver which used an easily innumerable url to "protect" the tax documents of 5000 people - it's H&R Block who should be "facing the consequences". Ignoring for a moment the distraction about weev's likableness and/or character, where's the outrage against AT&T for their part? If it's been a teenaged scriptkiddie from somewhere that US jurisdiction (and oil interests) don't reach (like most of these WordPress admin logins my fail2ban config is seeing these last few days), wouldn't it be _much_ more obviously AT&T's "fault"? Hell, where I live it's an offense to leave your car unlocked : http://www.police.nsw.gov.au/community_issues/crime_prevention/public_transport_and_traffic http://www.police.nsw.gov.au/community_issues/crime_preventi... (scroll down to the first bullet point under "Help Stop Car Theft"). Why isn't someone at AT&T facing jail time here?
- AnthonyMouse 14y ago
  >Ignoring for a moment the distraction about weev's likableness and/or character, where's the outrage against AT&T for their part? There's the rub though. AT&T isn't a human, so who do you punish? You can fine AT&T the company, but that's not punishing the people who left the site like that, it's punishing the stockholders. Stockholders really don't like to be liable for the actions of fairly low level subordinates like that, and they have the political influence to make sure that doesn't happen. You could try to go after the specific admins who set up the site insecurely, but they're not unsympathetic people. The ones who do things like this are mostly people who are overworked or poorly trained through no fault of their own. The people who are really at fault, then, are the ones who hired admins without proper training or experience or put so much workload on them that they couldn't adequately do their jobs, but now you're talking about corporate executives who (like stockholders) don't like to be personally liable for the actions of subordinates and who have the political influence to make sure that doesn't happen. So we're left with a situation where there is no one good to punish, but we have to punish someone, don't we? Something bad has happened! So we kill the messenger. The messenger doesn't have any lobbyists on staff. What's missing from all this is that we really don't have to punish anyone. Just let the vulnerabilities be published. Companies don't want to hear that because it very publicly makes them look as dumb as they are, but if they can't stop it by threatening anyone with prison then the only way they can do it is by maintaining secure systems. Which means they will, or they'll face the penalties of the court of public opinion. Where in this dynamic is there a need for intervention by the federal prison system?

rhizome 14y ago

The ideal I was referring to is the character of the defendant, not their actions.