6 ms·

> It's cultiavating a culture of "It's OK to have no security" This is how the rest of our culture works. If you leave your door unlocked and somebody robs yo

by jforman 13y ago

> It's cultiavating a culture of "It's OK to have no security" This is how the rest of our culture works. If you leave your door unlocked and somebody robs your house, we charge that person with robbery and put them in jail. We might shake our head at your naivete, but you won't get in trouble for having lax security. If the tech community wants this standard to change when dealing with intellectual property, we need to articulate why and get people on board, because it's certainly not the default in either our current culture or our current laws.

deleted 13y ago
[deleted]
67726e 13y ago
At what point do you differentiate naïveté from negligence?
- MartinCron 13y ago
  When it has external impact. Leaving your own door unlocked is very different from leaving everyone's safe deposit boxes unlocked.
- jforman 13y ago
  With real property, you can't get sued for negligence just for having lax security. You can incur liability if somebody gets onto your property and hurts themselves (the particulars of which I'm not familiar with since IANAL), and you may lose some protection for property damage/loss, but the standard for that is also very much in favor of the property owner.
- columbo 13y ago
  When a company makes a guarantee that they do not uphold. You buy a storage bin from a company that guarantees 24x7 security and your stuff is stolen because there was no nightwatchman on duty then you have a case against the company. That doesn't give the thief a free pass or make their actions right, however partial blame does go to the storage company. The same theory should apply to the internet.
- samuellevy 13y ago
  At a certain level, naïveté is negligence. I work with systems that have to comply with HIPPA regulations. If we didn't comply, we couldn't say "Oh, we didn't know, we'll do better next time". It is our job to know, and to comply with regulations; anything else is us being negligent of our duties. A company the size of AOL? They're negligent. This doesn't mean that what Weev did was good, or OK, or even that he should be the poster boy for reform. He also knew what he was doing, and the fact that AOL's security was poor doesn't excuse it. If anything he'll become the poster boy for "why these laws need to exist".
davidw 13y ago
> If you leave your door unlocked and somebody robs your house, we charge that person with robbery and put them in jail. Certainly! And rightly so. If they wanted to be a good neighbor, they could politely point out that you did something stupid without actually going inside your house. > We might shake our head at your naivete, but you won't get in trouble for having lax security. A business is a bit different though. I don't know the relevant laws, but some businesses have a duty to protect their customers' data - a moral one, if nothing else.
jamesmcs 13y ago
"This is how the rest of our culture works." Your analogy is way off. We're talking about other peoples things here, not personal negligence. In Europe a company can face large fines for inadequately protecting customer data. If someone broke into your bank and emptied your account, would you "shake your head" at your bank and be done with it?
- nandemo 13y ago
  In Japan too. In large companies all employees have to learn about customer data privacy, as part of compliance training. But I wouldn't assume the company would be fined in this case. Just because somebody got unauthorized access to customer data, it doesn't necessarily mean that the company was negligent according to the law.
noonespecial 13y ago
AT&T leaves the door open with your stuff inside. Its a little different. They should have some responsibility to protect all that personal goodness they seem oh so willing to demand of you.
- axus 13y ago
  Customers should be the ones punishing AT&T. The government could do a better job advertising the security failures to potential customers, rather than pursuing legal action for mediocre fines.
  - ckeck 13y ago
    True but customers MUST be willing to vote with their dollars and so very few are. I have countless friends or acquaintances who constantly complain about a service/product/provider/etc and I simply tell them to switch or stop using said service. Rarely will people stop because it's simply too "inconvenient". If you and large numbers of others don't vote with your wallet, do not expect change.
    - etha 13y ago
      Or maybe we should accept that security ultimately doesn't matter.
- cstejerean 13y ago
  If someone steals my laptop from your apartment, the person stealing is still guilty of a crime. Depending on our arrangement you may also be liable for the loss of my laptop, but that doesn't excuse the thief's action.
  - msandford 13y ago
    What if you leave a laptop sitting in the middle of the street with no identifying information on it and no password required to login. I would argue that picking that laptop up and keeping it isn't theft but rather simply FINDING it. In this case AT&T put the laptop in a brown paper bag (in the middle of the street) and then were shocked, SHOCKED that someone would open it up to see what's inside. EDIT: Security through obscurity is no security at all.
AnthonyMouse 13y ago
>If the tech community wants this standard to change when dealing with intellectual property, we need to articulate why and get people on board, because it's certainly not the default in either our current culture or our current laws. As others have pointed out, the difference here is that you have one party responsible for the data of another. But I'm with you on not necessarily wanting the law to punish someone for this kind of negligence. But let's go through our alternatives here for the situation at hand. This isn't a case where some criminal aims to profit from credit card fraud, or where some irreparable injury has occurred to anyone. In those cases you have an obvious need to punish the perpetrator, and there are already separate laws against such things. In this case the primary "harm" is to the reputation of a negligent party, and their costs in responding to the consequences of their own security failure. So what are our alternatives? In the first case we can punish AT&T for allowing the vulnerability. However, there is a real problem with doing this: A small penalty will have no effect, and a penalty large enough to motivate AT&T will also be large enough to bankrupt any startup, which would increase risks and compliance costs for small businesses and quite plausibly outweigh the benefit of deterring insecurity. On top of that, if companies are punished for vulnerabilities then they may just not report them at all, even in cases of explicitly malicious attackers, which would go so far as to prevent the third parties affected from trying to mitigate the damage. The second alternative would be to punish the party who conducts an unauthorized but mostly harmless investigation into a vulnerability without the consent of the party who negligently created it. Naturally this may deter some proportion of the people likely to engage in such behavior from doing so. However, that deterrence is not particularly productive, because it leaves the vulnerabilities in place. Someone who harvests email addresses and publishes them to prove the vulnerability shames the negligent party into fixing it before some greater harm occurs, like a more malicious party harvesting the emails to use for a phishing scheme, which achieves the converse of the original: Instead of publishing the vulnerability and causing it to be fixed with minimal harm, you have a secret but significant and continuing harm and the vulnerability may never be exposed or fixed. A third alternative would be to do both: Punish the party that created the vulnerability and the party that demonstrates it. But that's just the worst of both worlds. You deter those who would have the vulnerability fixed and leave it open for exploitation in secret by organized crime or foreign governments, meanwhile you still impose significant legal risk and compliance costs on the economy. Which leaves the alternative of not punishing anyone. In that case the vulnerabilities get published and the corporations are shamed into fixing them. A corporation that repeatedly suffers security vulnerabilities has its reputation destroyed and suffers in the marketplace to the degree that its customers place a value on the security of their data, providing a market-based incentive for good security. Meanwhile "attackers" who merely experiment and publish vulnerabilities are encouraged to do more of that work, but those who engage in e.g. fraud are still punished under the specific laws against that class of behavior. Between those four, it seems to me the last is best.
deleted 13y ago
[deleted]

by jforman 13y ago

deleted 13y ago

[deleted]

67726e 13y ago

At what point do you differentiate naïveté from negligence?

MartinCron 13y ago
When it has external impact. Leaving your own door unlocked is very different from leaving everyone's safe deposit boxes unlocked.
jforman 13y ago
With real property, you can't get sued for negligence just for having lax security. You can incur liability if somebody gets onto your property and hurts themselves (the particulars of which I'm not familiar with since IANAL), and you may lose some protection for property damage/loss, but the standard for that is also very much in favor of the property owner.
columbo 13y ago
When a company makes a guarantee that they do not uphold. You buy a storage bin from a company that guarantees 24x7 security and your stuff is stolen because there was no nightwatchman on duty then you have a case against the company. That doesn't give the thief a free pass or make their actions right, however partial blame does go to the storage company. The same theory should apply to the internet.
samuellevy 13y ago
At a certain level, naïveté is negligence. I work with systems that have to comply with HIPPA regulations. If we didn't comply, we couldn't say "Oh, we didn't know, we'll do better next time". It is our job to know, and to comply with regulations; anything else is us being negligent of our duties. A company the size of AOL? They're negligent. This doesn't mean that what Weev did was good, or OK, or even that he should be the poster boy for reform. He also knew what he was doing, and the fact that AOL's security was poor doesn't excuse it. If anything he'll become the poster boy for "why these laws need to exist".

davidw 13y ago

> If you leave your door unlocked and somebody robs your house, we charge that person with robbery and put them in jail. Certainly! And rightly so. If they wanted to be a good neighbor, they could politely point out that you did something stupid without actually going inside your house. > We might shake our head at your naivete, but you won't get in trouble for having lax security. A business is a bit different though. I don't know the relevant laws, but some businesses have a duty to protect their customers' data - a moral one, if nothing else.

jamesmcs 13y ago

"This is how the rest of our culture works." Your analogy is way off. We're talking about other peoples things here, not personal negligence. In Europe a company can face large fines for inadequately protecting customer data. If someone broke into your bank and emptied your account, would you "shake your head" at your bank and be done with it?

nandemo 13y ago
In Japan too. In large companies all employees have to learn about customer data privacy, as part of compliance training. But I wouldn't assume the company would be fined in this case. Just because somebody got unauthorized access to customer data, it doesn't necessarily mean that the company was negligent according to the law.

noonespecial 13y ago

AT&T leaves the door open with your stuff inside. Its a little different. They should have some responsibility to protect all that personal goodness they seem oh so willing to demand of you.

axus 13y ago
Customers should be the ones punishing AT&T. The government could do a better job advertising the security failures to potential customers, rather than pursuing legal action for mediocre fines.
- ckeck 13y ago
  True but customers MUST be willing to vote with their dollars and so very few are. I have countless friends or acquaintances who constantly complain about a service/product/provider/etc and I simply tell them to switch or stop using said service. Rarely will people stop because it's simply too "inconvenient". If you and large numbers of others don't vote with your wallet, do not expect change.
  - etha 13y ago
    Or maybe we should accept that security ultimately doesn't matter.
cstejerean 13y ago
If someone steals my laptop from your apartment, the person stealing is still guilty of a crime. Depending on our arrangement you may also be liable for the loss of my laptop, but that doesn't excuse the thief's action.
- msandford 13y ago
  What if you leave a laptop sitting in the middle of the street with no identifying information on it and no password required to login. I would argue that picking that laptop up and keeping it isn't theft but rather simply FINDING it. In this case AT&T put the laptop in a brown paper bag (in the middle of the street) and then were shocked, SHOCKED that someone would open it up to see what's inside. EDIT: Security through obscurity is no security at all.

AnthonyMouse 13y ago

>If the tech community wants this standard to change when dealing with intellectual property, we need to articulate why and get people on board, because it's certainly not the default in either our current culture or our current laws. As others have pointed out, the difference here is that you have one party responsible for the data of another. But I'm with you on not necessarily wanting the law to punish someone for this kind of negligence. But let's go through our alternatives here for the situation at hand. This isn't a case where some criminal aims to profit from credit card fraud, or where some irreparable injury has occurred to anyone. In those cases you have an obvious need to punish the perpetrator, and there are already separate laws against such things. In this case the primary "harm" is to the reputation of a negligent party, and their costs in responding to the consequences of their own security failure. So what are our alternatives? In the first case we can punish AT&T for allowing the vulnerability. However, there is a real problem with doing this: A small penalty will have no effect, and a penalty large enough to motivate AT&T will also be large enough to bankrupt any startup, which would increase risks and compliance costs for small businesses and quite plausibly outweigh the benefit of deterring insecurity. On top of that, if companies are punished for vulnerabilities then they may just not report them at all, even in cases of explicitly malicious attackers, which would go so far as to prevent the third parties affected from trying to mitigate the damage. The second alternative would be to punish the party who conducts an unauthorized but mostly harmless investigation into a vulnerability without the consent of the party who negligently created it. Naturally this may deter some proportion of the people likely to engage in such behavior from doing so. However, that deterrence is not particularly productive, because it leaves the vulnerabilities in place. Someone who harvests email addresses and publishes them to prove the vulnerability shames the negligent party into fixing it before some greater harm occurs, like a more malicious party harvesting the emails to use for a phishing scheme, which achieves the converse of the original: Instead of publishing the vulnerability and causing it to be fixed with minimal harm, you have a secret but significant and continuing harm and the vulnerability may never be exposed or fixed. A third alternative would be to do both: Punish the party that created the vulnerability and the party that demonstrates it. But that's just the worst of both worlds. You deter those who would have the vulnerability fixed and leave it open for exploitation in secret by organized crime or foreign governments, meanwhile you still impose significant legal risk and compliance costs on the economy. Which leaves the alternative of not punishing anyone. In that case the vulnerabilities get published and the corporations are shamed into fixing them. A corporation that repeatedly suffers security vulnerabilities has its reputation destroyed and suffers in the marketplace to the degree that its customers place a value on the security of their data, providing a market-based incentive for good security. Meanwhile "attackers" who merely experiment and publish vulnerabilities are encouraged to do more of that work, but those who engage in e.g. fraud are still punished under the specific laws against that class of behavior. Between those four, it seems to me the last is best.

deleted 13y ago

[deleted]