10 ms·

> he didn't actually do anything that I think should be illegal. Registering multiple false user names? Giving false feedback? Restraint of trade? I'm not

by tjic 18y ago

> he didn't actually do anything that I think should be illegal. Registering multiple false user names? Giving false feedback? Restraint of trade? I'm not a fan of government prosecuting someone for registering on Facebook with the user name "Joe Schmoe" in order to blog anonymously about their crappy job at Microsoft. ...but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm? > He merely used Amazon's flawed system against them I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me. "Oh, all I did was hang a sign in the window saying 'A child molester lives here' - what LOLZ!" Yeah, OK, great, that's a wonderful "hack".

axod 18y ago
All he did was enable Amazon to be sent some data. Amazon shouldn't just blindly accept data and trust it is legitimate. Same with creating false accounts. You can't really compare it with breaking and entering a house.
- stcredzero 18y ago
  Actually, it compares very well. Your typical consumer door lock might as well just not be there to a skilled lock picker.
  - axod 18y ago
    I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't the one using the resources. It was the users visiting the websites containing the iframe. At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.
    - stcredzero 18y ago
      Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
      - axod 18y ago
        A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
        stcredzero 18y ago
        So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
        axod 18y ago
        If I hide all of my money on my front lawn in a bag, I can't really be that surprised when it gets stolen.
      - sho 18y ago
        Well, actually, it is those "lusers" who executed the trojan, and their computers, capable of action and under their control, that sent the packets. Since when is "but I didn't know!" an excuse? Sounds like negligence to me; widespread perhaps, but negligence nonetheless. It's like those people who buy those terrible cheap car alarms that go off at anything at all and then don't stop for an hour. Their car is sitting there, ruining everyone's quality of life with its incessant blaring. Can they just excuse themselves by saying "well it's not me, it's the car alarm"? Of course not. If you own something, and that something is capable of harm, it's your responsibility to ensure its integrity. Blithe ignorance is no excuse at all. The door lock/money under the mattress analogy doesn't hold up. Mrs Smith did not invite millions of visitors from around the world into her house to walk around her bedroom, relying solely on the mattress to hide her treasure, and if she had no-one would have much sympathy when one of them eventually looked there. Amazon did invite such behaviour and should have taken appropriate safeguards. This is no-one's fault but their own.
sho 18y ago
"Registering multiple false user names? Giving false feedback?" Well then, unless your actual name is "tjic" then we are both criminals right off the bat. And since when is the government in the business of checking whether feedback is "false" or not? That's the company's job. It's not illegal to lie unless you are under oath, and nobody was. "Restraint of trade?" I don't see how Amazon's trade has been restrained in any way, shape or form. Unless you consider criticism or bad reputation to be restraint of trade, in which case any criticism is fair game. Very dangerous ground. "but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?" Who says it's bad data? What's wrong with aliases? You're trying to legislate against intent. And your example of how Joe Schmoe should be protected even though he's slagging off Microsoft - MS will say that's bad data bringing a PR firestorm. It just doesn't work. "I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me." Dear god, not this argument again. Look, physical security is NOT the same as network security. It is impossible to totally guarantee physical security. It is possible, even easy, to create perfect network security. The two are totally at odds. Creating a few fake accounts and submitting some votes (which Amazon encourages) is not even remotely similar to breaking into your house and placing signs advertising your partiality to child molestation. You are giving Amazon a free pass for their lax security practises, and placing all the blame on some random guy who had the balls to admit he did it. And if it was illegal, the only thing that would change is that he wouldn't have admitted it. You can't have laws like that. You may as well try to make a law that everyone has to be nice.
- stcredzero 18y ago
  Dear god, not this argument again. Sometimes that's a sign that your point of view is out of whack. (And being able to realize this is a mark of true learning. And yeah, it is painful sometimes.) What happened here is more like Whole Foods setting out free samples. If someone concocted a scheme to walk out the front door with all of the free samples, I would not be at all surprised if the perpetrator were taken off to jail. "But Whole Foods encourages you to take them!" yeah, right. Something smacks of rationalization here.
jrockway 18y ago
I agree with you, it's all about intent. If you give false feedback to avoid having your family killed, that should be legal. If you do it to troll Amazon, that's malicious, and should be a crime. This guy is a jerk, and he's making society slightly less good. As a society, we should try and avoid the tragedy of the commons, or else we won't have a society for much longer. Someone needs to remind this guy, in an official capacity, that his actions are not appreciated or tolerated.

by tjic 18y ago

axod 18y ago

All he did was enable Amazon to be sent some data. Amazon shouldn't just blindly accept data and trust it is legitimate. Same with creating false accounts. You can't really compare it with breaking and entering a house.

stcredzero 18y ago
Actually, it compares very well. Your typical consumer door lock might as well just not be there to a skilled lock picker.
- axod 18y ago
  I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't the one using the resources. It was the users visiting the websites containing the iframe. At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.
  - stcredzero 18y ago
    Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
    - axod 18y ago
      A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
      - stcredzero 18y ago
        So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
        axod 18y ago
        If I hide all of my money on my front lawn in a bag, I can't really be that surprised when it gets stolen.
    - sho 18y ago
      Well, actually, it is those "lusers" who executed the trojan, and their computers, capable of action and under their control, that sent the packets. Since when is "but I didn't know!" an excuse? Sounds like negligence to me; widespread perhaps, but negligence nonetheless. It's like those people who buy those terrible cheap car alarms that go off at anything at all and then don't stop for an hour. Their car is sitting there, ruining everyone's quality of life with its incessant blaring. Can they just excuse themselves by saying "well it's not me, it's the car alarm"? Of course not. If you own something, and that something is capable of harm, it's your responsibility to ensure its integrity. Blithe ignorance is no excuse at all. The door lock/money under the mattress analogy doesn't hold up. Mrs Smith did not invite millions of visitors from around the world into her house to walk around her bedroom, relying solely on the mattress to hide her treasure, and if she had no-one would have much sympathy when one of them eventually looked there. Amazon did invite such behaviour and should have taken appropriate safeguards. This is no-one's fault but their own.

sho 18y ago

"Registering multiple false user names? Giving false feedback?" Well then, unless your actual name is "tjic" then we are both criminals right off the bat. And since when is the government in the business of checking whether feedback is "false" or not? That's the company's job. It's not illegal to lie unless you are under oath, and nobody was. "Restraint of trade?" I don't see how Amazon's trade has been restrained in any way, shape or form. Unless you consider criticism or bad reputation to be restraint of trade, in which case any criticism is fair game. Very dangerous ground. "but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?" Who says it's bad data? What's wrong with aliases? You're trying to legislate against intent. And your example of how Joe Schmoe should be protected even though he's slagging off Microsoft - MS will say that's bad data bringing a PR firestorm. It just doesn't work. "I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me." Dear god, not this argument again. Look, physical security is NOT the same as network security. It is impossible to totally guarantee physical security. It is possible, even easy, to create perfect network security. The two are totally at odds. Creating a few fake accounts and submitting some votes (which Amazon encourages) is not even remotely similar to breaking into your house and placing signs advertising your partiality to child molestation. You are giving Amazon a free pass for their lax security practises, and placing all the blame on some random guy who had the balls to admit he did it. And if it was illegal, the only thing that would change is that he wouldn't have admitted it. You can't have laws like that. You may as well try to make a law that everyone has to be nice.

stcredzero 18y ago
Dear god, not this argument again. Sometimes that's a sign that your point of view is out of whack. (And being able to realize this is a mark of true learning. And yeah, it is painful sometimes.) What happened here is more like Whole Foods setting out free samples. If someone concocted a scheme to walk out the front door with all of the free samples, I would not be at all surprised if the perpetrator were taken off to jail. "But Whole Foods encourages you to take them!" yeah, right. Something smacks of rationalization here.

jrockway 18y ago

I agree with you, it's all about intent. If you give false feedback to avoid having your family killed, that should be legal. If you do it to troll Amazon, that's malicious, and should be a crime. This guy is a jerk, and he's making society slightly less good. As a society, we should try and avoid the tragedy of the commons, or else we won't have a society for much longer. Someone needs to remind this guy, in an official capacity, that his actions are not appreciated or tolerated.