4 ms·
Wow. Anyone who owns, or hopes to own, an internet-based community of any type should read this, just to get a sense of the sophisticated methods and the length
by sho 18y ago
Wow. Anyone who owns, or hopes to own, an internet-based community of any type should read this, just to get a sense of the sophisticated methods and the lengths trolls will go to. While I have to hand it to this guy for deviousness and persistence, he is, after all, the "enemy" as far as the Web Site Owner is concerned.
It boggles the mind that anyone would do this, but they evidently do, and you may well have to defend against it.
- tdavis 18y agoHe could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse. If Amazon has one CSRF vulnerability via an improper use of GET, there may well be more. This incident may help them tighten their systems against more malicious attacks.
- sdurkin 18y agoAnalogous: Someone breaks your car window with a brick, but doesn't steal anything. You thank them for showing that car windows aren't brick-proof.
- jordyhoyt 18y agoAnd also, less people want to ride in your car. How nice!
- chime 18y agoHow is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.
- stewiecat 18y agoI see your point, but also that of the parent post. Is losing salesrank of a novel over the weekend (a holiday weekend no less), really a boom-or-bust kind of thing? If he'd been more malicious with this then this would be a crime with actual victims, but in this case I just can't reason through it enough to believe that.
- johns 18y agoIf you walk into a bookstore and steal a bunch of books, even on a slow business day and it causes the store/publisher/author to lose sales, but not that much, is it a victimless crime?
- uninverted 18y agoWhat? He didn't steal anything. It's more like standing outside of the bookstore yelling about the owner.
- potatolicious 18y agoIt's more like breaking into the store at night and changing all the signage to read "I molest little children".
- ori_b 18y agoThrough a door that was left wide open, and in erasable marker.
- potatolicious 18y agoValid analogy - but flimsy security is still not justification for breaking and entering, nor defamation.
- run4yourlives 18y agoAnd? The intent is the same whether or not you walk through the open door or break the window.
- johns 18y agoYou're right. Replace "steal" with "deface"
- potatolicious 18y agoHow many customers did Amazon lose this weekend that will likely never hear that this was a hack? He directly and irreparably harmed the reputation of a company, how is this victimless at all?
- gojomo 18y agoFor 48-72 hours, some books appeared fewer places on Amazon's site. Many of those same books got lots of extra attention from elsewhere, as examples of affected titles. So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles). If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.
- cduan 18y agoPerhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors. It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself. (Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)
- tdavis 18y agoEven if one could accept that Amazon cannot possibly plug all vulnerabilities and should not be expected to do so against all attacks, we're still left with the obvious mistake of implicitly entrusting their users with the ability to -- automatically and without proper vetting -- alter whether or not certain items display on certain areas of their site. This fact, given automation via a bug or not, means that the tactic could have been used more maliciously and more covertly to bring additional damage (say, by getting an author's book delisted). At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.
- ibsulon 18y agoAmazon is losing a lot of business in the GLBT community, historically a reliable demographic group in both online spending and books. (This actually wouldn't be so bad if they had been more forthcoming, and quickly made a statement apologizing profusely. However, just saying that there's a "glitch" after customer support had suggested that much of the material was indeed adult in various posts hovering around, this has resulted in a significant loss of goodwill.) As for me, I'm considering looking for a new default myself. Powells, here I come?
- kingkongrevenge 18y agoOh come on. They'd lose way more money if it were widely trumpeted that they're making a buck off what I'm assuming is literary homo smut.
- jonknee 18y ago> As for me, I'm considering looking for a new default myself. Powells, here I come? Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?
- davidw 18y agoAs an aside, if you ever go anywhere near Portland, Oregon, go to Powell's, and don't forget to visit Powell's technical too. I really miss those stores (I miss less all the rain that makes sitting inside and reading a compelling alternative so much of the time...)
- j2d2 18y agoHistory is littered with the blood of people fighting over social issues... We shouldn't be too surprised by the lengths, but the appeals for security concerns rings loud and true.
- arjungmenon 18y agoApparently, this guy seems to be a long time troll: http://valleywag.gawker.com/5032989/journalists-do-it-for-the-lulz http://valleywag.gawker.com/5032989/journalists-do-it-for-th... http://www.nytimes.com/2008/08/03/magazine/03trolls-t.html http://www.nytimes.com/2008/08/03/magazine/03trolls-t.html