3 ms·

I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't th

by axod 18y ago

I don't know... maybe this could fall into the category of 'spam' - using up resources of a remote computer without permission etc, but the fact is he wasn't the one using the resources. It was the users visiting the websites containing the iframe. At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.

stcredzero 18y ago
Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
- axod 18y ago
  A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
  - stcredzero 18y ago
    So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
    - axod 18y ago
      If I hide all of my money on my front lawn in a bag, I can't really be that surprised when it gets stolen.
- sho 18y ago
  Well, actually, it is those "lusers" who executed the trojan, and their computers, capable of action and under their control, that sent the packets. Since when is "but I didn't know!" an excuse? Sounds like negligence to me; widespread perhaps, but negligence nonetheless. It's like those people who buy those terrible cheap car alarms that go off at anything at all and then don't stop for an hour. Their car is sitting there, ruining everyone's quality of life with its incessant blaring. Can they just excuse themselves by saying "well it's not me, it's the car alarm"? Of course not. If you own something, and that something is capable of harm, it's your responsibility to ensure its integrity. Blithe ignorance is no excuse at all. The door lock/money under the mattress analogy doesn't hold up. Mrs Smith did not invite millions of visitors from around the world into her house to walk around her bedroom, relying solely on the mattress to hide her treasure, and if she had no-one would have much sympathy when one of them eventually looked there. Amazon did invite such behaviour and should have taken appropriate safeguards. This is no-one's fault but their own.
  - stcredzero 18y ago
    Another's negligence does not justify being an asshole! If Mrs. Smith was running a bric-a-brac store and didn't know how to secure her display cases, then it's alright to shoplift from her? If Mrs. Smith was holding a big party at her house, then it's alright for a party goer to steal her life savings? If I hand a firearm disguised as a jelly donut to a random bystander, then they shoot someone with it, it's their fault and not mine? Amazon messed up. It doesn't justify Weev's action. He could've just told them. Deception and malicious intent are markings of crime or antisocial behavior. That's just common sense!
    - sho 18y ago
      Guh. Here we are, about 3 steps into an argument, and already it's a quagmire of complexity, grey areas and sliding scales. I could now posit the example that it's actually more like Mrs Smith leaving the money in a bag on the floor of her store (or house) but seriously we could go on like this forever. My Infinite Biased Analogy Generator is in good working order and I can tell yours is in full effect also. The fact is, nothing was stolen and no-one died. You're all about "intent" so intend this: this whole story is one guy exploiting Amazon's flawed security to annoy gay people. I do not even like Weev. This is nothing but principle, namely - should the government be papering, with the full force of the law, over the cracks in Amazon's security? I say, "no". You say "yes". We are each convinced of our righteousness. Let's leave it there.

by axod 18y ago

stcredzero 18y ago

Whoa, this is smacking of rationalization. How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!" How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."

axod 18y ago
A company like Amazon should be able to deal with DDOS and CSFR in it's stride though. They should present absolutely no challenge. The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity. But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
- stcredzero 18y ago
  So the victim's capabilities are to be taken into account? If Mrs. Smith was trained as a ninja guard, trying to abscond with her mattress stash is ok? I don't buy it. Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker. If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute. Someone else being stupid doesn't give you a "Get away with being an asshat" card.
  - axod 18y ago
    If I hide all of my money on my front lawn in a bag, I can't really be that surprised when it gets stolen.
sho 18y ago
Well, actually, it is those "lusers" who executed the trojan, and their computers, capable of action and under their control, that sent the packets. Since when is "but I didn't know!" an excuse? Sounds like negligence to me; widespread perhaps, but negligence nonetheless. It's like those people who buy those terrible cheap car alarms that go off at anything at all and then don't stop for an hour. Their car is sitting there, ruining everyone's quality of life with its incessant blaring. Can they just excuse themselves by saying "well it's not me, it's the car alarm"? Of course not. If you own something, and that something is capable of harm, it's your responsibility to ensure its integrity. Blithe ignorance is no excuse at all. The door lock/money under the mattress analogy doesn't hold up. Mrs Smith did not invite millions of visitors from around the world into her house to walk around her bedroom, relying solely on the mattress to hide her treasure, and if she had no-one would have much sympathy when one of them eventually looked there. Amazon did invite such behaviour and should have taken appropriate safeguards. This is no-one's fault but their own.
- stcredzero 18y ago
  Another's negligence does not justify being an asshole! If Mrs. Smith was running a bric-a-brac store and didn't know how to secure her display cases, then it's alright to shoplift from her? If Mrs. Smith was holding a big party at her house, then it's alright for a party goer to steal her life savings? If I hand a firearm disguised as a jelly donut to a random bystander, then they shoot someone with it, it's their fault and not mine? Amazon messed up. It doesn't justify Weev's action. He could've just told them. Deception and malicious intent are markings of crime or antisocial behavior. That's just common sense!
  - sho 18y ago
    Guh. Here we are, about 3 steps into an argument, and already it's a quagmire of complexity, grey areas and sliding scales. I could now posit the example that it's actually more like Mrs Smith leaving the money in a bag on the floor of her store (or house) but seriously we could go on like this forever. My Infinite Biased Analogy Generator is in good working order and I can tell yours is in full effect also. The fact is, nothing was stolen and no-one died. You're all about "intent" so intend this: this whole story is one guy exploiting Amazon's flawed security to annoy gay people. I do not even like Weev. This is nothing but principle, namely - should the government be papering, with the full force of the law, over the cracks in Amazon's security? I say, "no". You say "yes". We are each convinced of our righteousness. Let's leave it there.