8 ms·

I'm mainly wondering if he can get his face sued off over this. I've got NO doubt that this is going to have a noticable negative impact on Amazon's profits.

by dlytle 17y ago

I'm mainly wondering if he can get his face sued off over this. I've got NO doubt that this is going to have a noticable negative impact on Amazon's profits. Not world shaking, but more than enough to make the lawyers angry. As another commenter mentioned, he's been in a NYT article, with his face and full name displayed. Amazon won't have any trouble finding him.

sho 17y ago
I should certainly hope not. While he's certainly mischievous and possibly malicious, he didn't actually do anything that I think should be illegal. He merely used Amazon's flawed system against them, at considerably personal expense. He hacked them, in other words. I can't agree with his aims in this case but you've got to hand it to him really - you don't have to like trolling in general to admit that was an amazing troll. It shouldn't be illegal and he shouldn't be able to be sued. Society would be worse for it, counterintutive as it may seem.
- tjic 17y ago
  > he didn't actually do anything that I think should be illegal. Registering multiple false user names? Giving false feedback? Restraint of trade? I'm not a fan of government prosecuting someone for registering on Facebook with the user name "Joe Schmoe" in order to blog anonymously about their crappy job at Microsoft. ...but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm? > He merely used Amazon's flawed system against them I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me. "Oh, all I did was hang a sign in the window saying 'A child molester lives here' - what LOLZ!" Yeah, OK, great, that's a wonderful "hack".
  - axod 17y ago
    All he did was enable Amazon to be sent some data. Amazon shouldn't just blindly accept data and trust it is legitimate. Same with creating false accounts. You can't really compare it with breaking and entering a house.
    - stcredzero 17y ago
      Actually, it compares very well. Your typical consumer door lock might as well just not be there to a skilled lock picker.
      - axod 17y ago
        I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't the one using the resources. It was the users visiting the websites containing the iframe. At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.
        stcredzero 17y ago
        Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
        axod 17y ago
        A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
        stcredzero 17y ago
        So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
  - sho 17y ago
    "Registering multiple false user names? Giving false feedback?" Well then, unless your actual name is "tjic" then we are both criminals right off the bat. And since when is the government in the business of checking whether feedback is "false" or not? That's the company's job. It's not illegal to lie unless you are under oath, and nobody was. "Restraint of trade?" I don't see how Amazon's trade has been restrained in any way, shape or form. Unless you consider criticism or bad reputation to be restraint of trade, in which case any criticism is fair game. Very dangerous ground. "but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?" Who says it's bad data? What's wrong with aliases? You're trying to legislate against intent. And your example of how Joe Schmoe should be protected even though he's slagging off Microsoft - MS will say that's bad data bringing a PR firestorm. It just doesn't work. "I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me." Dear god, not this argument again. Look, physical security is NOT the same as network security. It is impossible to totally guarantee physical security. It is possible, even easy, to create perfect network security. The two are totally at odds. Creating a few fake accounts and submitting some votes (which Amazon encourages) is not even remotely similar to breaking into your house and placing signs advertising your partiality to child molestation. You are giving Amazon a free pass for their lax security practises, and placing all the blame on some random guy who had the balls to admit he did it. And if it was illegal, the only thing that would change is that he wouldn't have admitted it. You can't have laws like that. You may as well try to make a law that everyone has to be nice.
    - stcredzero 17y ago
      Dear god, not this argument again. Sometimes that's a sign that your point of view is out of whack. (And being able to realize this is a mark of true learning. And yeah, it is painful sometimes.) What happened here is more like Whole Foods setting out free samples. If someone concocted a scheme to walk out the front door with all of the free samples, I would not be at all surprised if the perpetrator were taken off to jail. "But Whole Foods encourages you to take them!" yeah, right. Something smacks of rationalization here.
  - jrockway 17y ago
    I agree with you, it's all about intent. If you give false feedback to avoid having your family killed, that should be legal. If you do it to troll Amazon, that's malicious, and should be a crime. This guy is a jerk, and he's making society slightly less good. As a society, we should try and avoid the tragedy of the commons, or else we won't have a society for much longer. Someone needs to remind this guy, in an official capacity, that his actions are not appreciated or tolerated.
- philh 17y ago
  Laws exist to deter people from doing things that are possible, so the fact that their system allowed him to do it is irrelevant. The quality of the troll is also irrelevant. The fact that you commit a crime really well doesn't make it any less illegal. That said, I'm not certain what he did should have been illegal. But I can't think of a single reason he shouldn't be sued. There's no way he didn't forsee loss of revenue for Amazon. If you deliberately cause harm to another person, even if you work out how to do it without technically breaking the law, they should absolutely be able to get their loss back from you.
  - Retric 17y ago
    Posting a message that you got food poising from a local restaurant will cause them to lose money without you breaking the law. Would you say it's reasonable for them to sue you if you where telling the truth?
    - stcredzero 17y ago
      It certainly would be reasonable for them to sue you if you had lied.
      - sho 17y ago
        Then we have fundamentally different opinions of what should and should not be legally actionable. How the hell should anyone be able to drag someone through the courts on the grounds that they might have lied about about feeling sick or not? And what could you possibly do when he just says "I did feel sick" - "no you didn't"? Yes I did, no you didn't? I don't think you've given much thought to the complexities here. Laws have to be workable and practical and err on the side of freedom of speech and action. Trying to legislate niceness and truthfulness is pure folly, especially considering the imbalance of power between a corporation (or restaurant!) and a person.
        DeCarabas 17y ago
        Libel and Slander are well-established legal concepts that have been around for ages. http://en.wikipedia.org/wiki/Defamation http://en.wikipedia.org/wiki/Defamation
- stcredzero 17y ago
  "counter-intuitive" is your code word for "I can't justify it but I like it anyway?" If his hack involved writing an innocuous demo script and presenting it to Amazon or at a conference, this would be one thing, and society is better off for the freedom to make such discoveries and talk and write about them. Society is certainly better off when it accords freedom of speech. But academic freedom ends where you start to impact other's freedom of speech. (Like effective censorship of Amazon listings.) All my life, I've had this background occurrence of strangers have coming out of nowhere to try and haze me with some racial epithet. Almost all of these idiots carry this air of striking some sort of blow for truth and beauty, as if they're defending motherhood and the American way through their yelling and insults. To me, Weev and his ilk have the exact same sort of misguided self-righteousness. I'm sure the one who hazed that young girl into committing suicide on MySpace felt just as clever and justified. (Many of those Weev targets may have the same self-righteous chip on their shoulder as well, and may be just as bad in their way. It's just not a productive way to expend mental energy.)
  - sokoloff 17y ago
    Let's be clear here. Weev didn't censor Amazon listings. If what Weev claims is true, the most you can say is that he helped trick Amazon into choosing, via automated means, to censor those titles. But ultimately, it was Amazon who took the action to remove the listings. (Unnecessary disclaimer: I'm a huge fan of Amazon, and hardly a week goes by that I don't buy something or other from them.)
    - stcredzero 17y ago
      Your logic simply doesn't hold. If some guy repaints highway signs to cause a car crash, then, if anyone dies, he should be up for murder, not the driver. The guilty party is the vandal in both cases, not the driver or the computer operator.
      - sokoloff 17y ago
        I'm going to take one last stab at this, and then let it go: But he didn't repaint the signs. At worst, he convinced a few other people to call up the DOT and say "That stop sign shouldn't be there, please change it to a 55 MPH speed limit sign." If the DOT then goes and changes the signs without appropriately verifying, then it's on them... I realize as programmers that we might think Weev's (purported) actions are directly responsible for the de-listing, but they aren't. It's ultimately Amazon's code that did the de-listing.
- run4yourlives 17y ago
  It shouldn't be illegal and he shouldn't be able to be sued. If I was an author of those books, who would compensate me for my lost income? You?
potatolicious 17y ago
I for one hope he does. He's not some internet freedom fighter going up against the man, nor is he a legitimate security expert in any way. He did it for the lulz, I hope he gets his ass sued off. He's like the kid dropping rocks off the overpass for shits and giggles - pathetic.
- lurkinggrue 17y ago
  What I do hope for is that one day when they get arrested that the officers let them know it's ok as they're going to prison for the lulz.
- sho 17y ago
  "He's like the kid dropping rocks off the overpass for shits and giggles - pathetic." Yeah man. Except for the overpass, and the kid, and the rocks, that is a very good analogy.

by dlytle 17y ago

sho 17y ago

I should certainly hope not. While he's certainly mischievous and possibly malicious, he didn't actually do anything that I think should be illegal. He merely used Amazon's flawed system against them, at considerably personal expense. He hacked them, in other words. I can't agree with his aims in this case but you've got to hand it to him really - you don't have to like trolling in general to admit that was an amazing troll. It shouldn't be illegal and he shouldn't be able to be sued. Society would be worse for it, counterintutive as it may seem.

tjic 17y ago
> he didn't actually do anything that I think should be illegal. Registering multiple false user names? Giving false feedback? Restraint of trade? I'm not a fan of government prosecuting someone for registering on Facebook with the user name "Joe Schmoe" in order to blog anonymously about their crappy job at Microsoft. ...but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm? > He merely used Amazon's flawed system against them I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me. "Oh, all I did was hang a sign in the window saying 'A child molester lives here' - what LOLZ!" Yeah, OK, great, that's a wonderful "hack".
- axod 17y ago
  All he did was enable Amazon to be sent some data. Amazon shouldn't just blindly accept data and trust it is legitimate. Same with creating false accounts. You can't really compare it with breaking and entering a house.
  - stcredzero 17y ago
    Actually, it compares very well. Your typical consumer door lock might as well just not be there to a skilled lock picker.
    - axod 17y ago
      I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't the one using the resources. It was the users visiting the websites containing the iframe. At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.
      - stcredzero 17y ago
        Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
        axod 17y ago
        A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
        stcredzero 17y ago
        So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
- sho 17y ago
  "Registering multiple false user names? Giving false feedback?" Well then, unless your actual name is "tjic" then we are both criminals right off the bat. And since when is the government in the business of checking whether feedback is "false" or not? That's the company's job. It's not illegal to lie unless you are under oath, and nobody was. "Restraint of trade?" I don't see how Amazon's trade has been restrained in any way, shape or form. Unless you consider criticism or bad reputation to be restraint of trade, in which case any criticism is fair game. Very dangerous ground. "but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?" Who says it's bad data? What's wrong with aliases? You're trying to legislate against intent. And your example of how Joe Schmoe should be protected even though he's slagging off Microsoft - MS will say that's bad data bringing a PR firestorm. It just doesn't work. "I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me." Dear god, not this argument again. Look, physical security is NOT the same as network security. It is impossible to totally guarantee physical security. It is possible, even easy, to create perfect network security. The two are totally at odds. Creating a few fake accounts and submitting some votes (which Amazon encourages) is not even remotely similar to breaking into your house and placing signs advertising your partiality to child molestation. You are giving Amazon a free pass for their lax security practises, and placing all the blame on some random guy who had the balls to admit he did it. And if it was illegal, the only thing that would change is that he wouldn't have admitted it. You can't have laws like that. You may as well try to make a law that everyone has to be nice.
  - stcredzero 17y ago
    Dear god, not this argument again. Sometimes that's a sign that your point of view is out of whack. (And being able to realize this is a mark of true learning. And yeah, it is painful sometimes.) What happened here is more like Whole Foods setting out free samples. If someone concocted a scheme to walk out the front door with all of the free samples, I would not be at all surprised if the perpetrator were taken off to jail. "But Whole Foods encourages you to take them!" yeah, right. Something smacks of rationalization here.
- jrockway 17y ago
  I agree with you, it's all about intent. If you give false feedback to avoid having your family killed, that should be legal. If you do it to troll Amazon, that's malicious, and should be a crime. This guy is a jerk, and he's making society slightly less good. As a society, we should try and avoid the tragedy of the commons, or else we won't have a society for much longer. Someone needs to remind this guy, in an official capacity, that his actions are not appreciated or tolerated.
philh 17y ago
Laws exist to deter people from doing things that are possible, so the fact that their system allowed him to do it is irrelevant. The quality of the troll is also irrelevant. The fact that you commit a crime really well doesn't make it any less illegal. That said, I'm not certain what he did should have been illegal. But I can't think of a single reason he shouldn't be sued. There's no way he didn't forsee loss of revenue for Amazon. If you deliberately cause harm to another person, even if you work out how to do it without technically breaking the law, they should absolutely be able to get their loss back from you.
- Retric 17y ago
  Posting a message that you got food poising from a local restaurant will cause them to lose money without you breaking the law. Would you say it's reasonable for them to sue you if you where telling the truth?
  - stcredzero 17y ago
    It certainly would be reasonable for them to sue you if you had lied.
    - sho 17y ago
      Then we have fundamentally different opinions of what should and should not be legally actionable. How the hell should anyone be able to drag someone through the courts on the grounds that they might have lied about about feeling sick or not? And what could you possibly do when he just says "I did feel sick" - "no you didn't"? Yes I did, no you didn't? I don't think you've given much thought to the complexities here. Laws have to be workable and practical and err on the side of freedom of speech and action. Trying to legislate niceness and truthfulness is pure folly, especially considering the imbalance of power between a corporation (or restaurant!) and a person.
      - DeCarabas 17y ago
        Libel and Slander are well-established legal concepts that have been around for ages. http://en.wikipedia.org/wiki/Defamation http://en.wikipedia.org/wiki/Defamation
stcredzero 17y ago
"counter-intuitive" is your code word for "I can't justify it but I like it anyway?" If his hack involved writing an innocuous demo script and presenting it to Amazon or at a conference, this would be one thing, and society is better off for the freedom to make such discoveries and talk and write about them. Society is certainly better off when it accords freedom of speech. But academic freedom ends where you start to impact other's freedom of speech. (Like effective censorship of Amazon listings.) All my life, I've had this background occurrence of strangers have coming out of nowhere to try and haze me with some racial epithet. Almost all of these idiots carry this air of striking some sort of blow for truth and beauty, as if they're defending motherhood and the American way through their yelling and insults. To me, Weev and his ilk have the exact same sort of misguided self-righteousness. I'm sure the one who hazed that young girl into committing suicide on MySpace felt just as clever and justified. (Many of those Weev targets may have the same self-righteous chip on their shoulder as well, and may be just as bad in their way. It's just not a productive way to expend mental energy.)
- sokoloff 17y ago
  Let's be clear here. Weev didn't censor Amazon listings. If what Weev claims is true, the most you can say is that he helped trick Amazon into choosing, via automated means, to censor those titles. But ultimately, it was Amazon who took the action to remove the listings. (Unnecessary disclaimer: I'm a huge fan of Amazon, and hardly a week goes by that I don't buy something or other from them.)
  - stcredzero 17y ago
    Your logic simply doesn't hold. If some guy repaints highway signs to cause a car crash, then, if anyone dies, he should be up for murder, not the driver. The guilty party is the vandal in both cases, not the driver or the computer operator.
    - sokoloff 17y ago
      I'm going to take one last stab at this, and then let it go: But he didn't repaint the signs. At worst, he convinced a few other people to call up the DOT and say "That stop sign shouldn't be there, please change it to a 55 MPH speed limit sign." If the DOT then goes and changes the signs without appropriately verifying, then it's on them... I realize as programmers that we might think Weev's (purported) actions are directly responsible for the de-listing, but they aren't. It's ultimately Amazon's code that did the de-listing.
run4yourlives 17y ago
It shouldn't be illegal and he shouldn't be able to be sued. If I was an author of those books, who would compensate me for my lost income? You?

potatolicious 17y ago

I for one hope he does. He's not some internet freedom fighter going up against the man, nor is he a legitimate security expert in any way. He did it for the lulz, I hope he gets his ass sued off. He's like the kid dropping rocks off the overpass for shits and giggles - pathetic.

lurkinggrue 17y ago
What I do hope for is that one day when they get arrested that the officers let them know it's ok as they're going to prison for the lulz.
sho 17y ago
"He's like the kid dropping rocks off the overpass for shits and giggles - pathetic." Yeah man. Except for the overpass, and the kid, and the rocks, that is a very good analogy.