6 ms·

He could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse

by tdavis 18y ago

He could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse. If Amazon has one CSRF vulnerability via an improper use of GET, there may well be more. This incident may help them tighten their systems against more malicious attacks.

sdurkin 18y ago
Analogous: Someone breaks your car window with a brick, but doesn't steal anything. You thank them for showing that car windows aren't brick-proof.
- jordyhoyt 18y ago
  And also, less people want to ride in your car. How nice!
chime 18y ago
How is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.
- stewiecat 18y ago
  I see your point, but also that of the parent post. Is losing salesrank of a novel over the weekend (a holiday weekend no less), really a boom-or-bust kind of thing? If he'd been more malicious with this then this would be a crime with actual victims, but in this case I just can't reason through it enough to believe that.
  - johns 18y ago
    If you walk into a bookstore and steal a bunch of books, even on a slow business day and it causes the store/publisher/author to lose sales, but not that much, is it a victimless crime?
    - uninverted 18y ago
      What? He didn't steal anything. It's more like standing outside of the bookstore yelling about the owner.
      - potatolicious 18y ago
        It's more like breaking into the store at night and changing all the signage to read "I molest little children".
        ori_b 18y ago
        Through a door that was left wide open, and in erasable marker.
        potatolicious 18y ago
        Valid analogy - but flimsy security is still not justification for breaking and entering, nor defamation.
        run4yourlives 18y ago
        And? The intent is the same whether or not you walk through the open door or break the window.
      - johns 18y ago
        You're right. Replace "steal" with "deface"
  - potatolicious 18y ago
    How many customers did Amazon lose this weekend that will likely never hear that this was a hack? He directly and irreparably harmed the reputation of a company, how is this victimless at all?
    - jrockway 18y ago
      You could also go out in the street with a sign that says "Amazon sucks" and it would probably deter as many people as this did.
      - run4yourlives 18y ago
        Well, that's simply not true. If it was he wouldn't have done it. While I admire the guile and technical reasoning required to pull this off, it's high time the community at large stop admiring this type of crap. Authors of the books in question lost real money. It doesn't matter how much. Amazon lost credibility from all sides. There is a difference between screaming that the Emperor has no clothes and stealing his wallet.
    - deleted 18y ago
      [deleted]
    - tutwabee 18y ago
      He may have hurt the reputation of Amazon, but not through his crime. Publicizing vulnerabilities in Amazon's ranking system is what may hurt Amazon's reputation. The "crime" of messing with Amazon's system didn't hurt Amazon's reputation let alone their website much at all.
- gojomo 18y ago
  For 48-72 hours, some books appeared fewer places on Amazon's site. Many of those same books got lots of extra attention from elsewhere, as examples of affected titles. So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles). If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.
  - cduan 18y ago
    Perhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors. It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself. (Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)
    - tdavis 18y ago
      Even if one could accept that Amazon cannot possibly plug all vulnerabilities and should not be expected to do so against all attacks, we're still left with the obvious mistake of implicitly entrusting their users with the ability to -- automatically and without proper vetting -- alter whether or not certain items display on certain areas of their site. This fact, given automation via a bug or not, means that the tactic could have been used more maliciously and more covertly to bring additional damage (say, by getting an author's book delisted). At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.
ibsulon 18y ago
Amazon is losing a lot of business in the GLBT community, historically a reliable demographic group in both online spending and books. (This actually wouldn't be so bad if they had been more forthcoming, and quickly made a statement apologizing profusely. However, just saying that there's a "glitch" after customer support had suggested that much of the material was indeed adult in various posts hovering around, this has resulted in a significant loss of goodwill.) As for me, I'm considering looking for a new default myself. Powells, here I come?
- kingkongrevenge 18y ago
  Oh come on. They'd lose way more money if it were widely trumpeted that they're making a buck off what I'm assuming is literary homo smut.
- jonknee 18y ago
  > As for me, I'm considering looking for a new default myself. Powells, here I come? Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?
- davidw 18y ago
  As an aside, if you ever go anywhere near Portland, Oregon, go to Powell's, and don't forget to visit Powell's technical too. I really miss those stores (I miss less all the rain that makes sitting inside and reading a compelling alternative so much of the time...)

by tdavis 18y ago

sdurkin 18y ago

Analogous: Someone breaks your car window with a brick, but doesn't steal anything. You thank them for showing that car windows aren't brick-proof.

jordyhoyt 18y ago
And also, less people want to ride in your car. How nice!

chime 18y ago

How is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.

stewiecat 18y ago
I see your point, but also that of the parent post. Is losing salesrank of a novel over the weekend (a holiday weekend no less), really a boom-or-bust kind of thing? If he'd been more malicious with this then this would be a crime with actual victims, but in this case I just can't reason through it enough to believe that.
- johns 18y ago
  If you walk into a bookstore and steal a bunch of books, even on a slow business day and it causes the store/publisher/author to lose sales, but not that much, is it a victimless crime?
  - uninverted 18y ago
    What? He didn't steal anything. It's more like standing outside of the bookstore yelling about the owner.
    - potatolicious 18y ago
      It's more like breaking into the store at night and changing all the signage to read "I molest little children".
      - ori_b 18y ago
        Through a door that was left wide open, and in erasable marker.
        potatolicious 18y ago
        Valid analogy - but flimsy security is still not justification for breaking and entering, nor defamation.
        run4yourlives 18y ago
        And? The intent is the same whether or not you walk through the open door or break the window.
    - johns 18y ago
      You're right. Replace "steal" with "deface"
- potatolicious 18y ago
  How many customers did Amazon lose this weekend that will likely never hear that this was a hack? He directly and irreparably harmed the reputation of a company, how is this victimless at all?
  - jrockway 18y ago
    You could also go out in the street with a sign that says "Amazon sucks" and it would probably deter as many people as this did.
    - run4yourlives 18y ago
      Well, that's simply not true. If it was he wouldn't have done it. While I admire the guile and technical reasoning required to pull this off, it's high time the community at large stop admiring this type of crap. Authors of the books in question lost real money. It doesn't matter how much. Amazon lost credibility from all sides. There is a difference between screaming that the Emperor has no clothes and stealing his wallet.
  - deleted 18y ago
    [deleted]
  - tutwabee 18y ago
    He may have hurt the reputation of Amazon, but not through his crime. Publicizing vulnerabilities in Amazon's ranking system is what may hurt Amazon's reputation. The "crime" of messing with Amazon's system didn't hurt Amazon's reputation let alone their website much at all.
gojomo 18y ago
For 48-72 hours, some books appeared fewer places on Amazon's site. Many of those same books got lots of extra attention from elsewhere, as examples of affected titles. So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles). If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.
- cduan 18y ago
  Perhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors. It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself. (Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)
  - tdavis 18y ago
    Even if one could accept that Amazon cannot possibly plug all vulnerabilities and should not be expected to do so against all attacks, we're still left with the obvious mistake of implicitly entrusting their users with the ability to -- automatically and without proper vetting -- alter whether or not certain items display on certain areas of their site. This fact, given automation via a bug or not, means that the tactic could have been used more maliciously and more covertly to bring additional damage (say, by getting an author's book delisted). At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.

ibsulon 18y ago

Amazon is losing a lot of business in the GLBT community, historically a reliable demographic group in both online spending and books. (This actually wouldn't be so bad if they had been more forthcoming, and quickly made a statement apologizing profusely. However, just saying that there's a "glitch" after customer support had suggested that much of the material was indeed adult in various posts hovering around, this has resulted in a significant loss of goodwill.) As for me, I'm considering looking for a new default myself. Powells, here I come?

kingkongrevenge 18y ago
Oh come on. They'd lose way more money if it were widely trumpeted that they're making a buck off what I'm assuming is literary homo smut.
jonknee 18y ago
> As for me, I'm considering looking for a new default myself. Powells, here I come? Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?
davidw 18y ago
As an aside, if you ever go anywhere near Portland, Oregon, go to Powell's, and don't forget to visit Powell's technical too. I really miss those stores (I miss less all the rain that makes sitting inside and reading a compelling alternative so much of the time...)