5 ms·

If someone steals my laptop from your apartment, the person stealing is still guilty of a crime. Depending on our arrangement you may also be liable for the los

If someone steals my laptop from your apartment, the person stealing is still guilty of a crime. Depending on our arrangement you may also be liable for the loss of my laptop, but that doesn't excuse the thief's action.

msandford 13y ago
What if you leave a laptop sitting in the middle of the street with no identifying information on it and no password required to login. I would argue that picking that laptop up and keeping it isn't theft but rather simply FINDING it. In this case AT&T put the laptop in a brown paper bag (in the middle of the street) and then were shocked, SHOCKED that someone would open it up to see what's inside. EDIT: Security through obscurity is no security at all.
- rayiner 13y ago
  It is actually theft to take a laptop in a brown paper bag in the middle of the street unless there is an indiction the owner intended to abandon it. Finders are supposed to make efforts to locate the owner or otherwise turn in what was found.
  - adamnemecek 13y ago
    Which is kind of what weev did by reporting it.
    - tptacek 13y ago
      The words "kind of" are doing a lot of work in that sentence.
      - adamnemecek 13y ago
        In the sense that he made the owner aware of it.
    - unreal37 13y ago
      Agree with tptacek - by "kind of" you mean "not at all" what he did.
      - wnight 13y ago
        When it's a laptop full of customer information left around in the street - as this analogously was, do you tell the company so they can cover it up or the news so people know to watch for fraudulent charges? Weev joked about a lot. Stuff that would have been fitting to have happen to AT&T considering their negligent practices and disgraceful follow-up, but if we're guilty of what we joke about ...
jlgreco 13y ago
Somebody cannot steal things from my apartment without being in a jurisdiction that I presumably have decided is sane. Meanwhile when AT&T forgets to lock the door to the stuff I have entrusted them with, anyone in the world can get at that. AT&T relying on the law being able to eventually get baddies after the fact is not sufficient.
dopamean 13y ago
I believe that the person doing the stealing needs to be held responsible. I also think that the entity holding the data needs to be held responsible for a lack of security. If your kid is kidnapped from a daycare because they didnt lock doors or have any security measures they can be held accountable for that as well as the kidnapper.
Houshalter 13y ago
To be fair, there is a difference between actually stealing your stuff, and just walking into your house to prove your security sucks. It would be like if I just opened up a bank vault and walked inside and shouted "Hey, this bank sucks, no one put your money here!" without actually stealing anything.
- rayiner 13y ago
  Yes, there is a difference. And Weev could have downloaded one e-mail address just to prove his point.
  - wnight 13y ago
    That's just concern troll nonsense, or what someone who'd never heard of software would say. It's easier to download a range of IDs than to guess which ones are valid. And "three email addresses leaked - hacker claims more could be at risk" is pathetic and you know it would be ignored. By the company, by the news, and ultimately, by users. Also, there's a fallacy here. You admit it's reasonable to download, leak, etc, but then make it seem unreasonable because he did too much of it. The joke of it though, is that ultimately you-all can piss and moan about your convenient morals, but what Weev should have done - by your "anything legal is A-OK" standards - is to emigrate to Russia (or elsewhere) and sell the data to a local "security firm". Then he'd have been rich, and safe, and AT&T would either be secure or out of business. But instead he did the honest thing (and inconvenienced a wealthy corporation in doing so) and suffers greatly. Next time, zero-day through Tor. Just saying.

msandford 13y ago

What if you leave a laptop sitting in the middle of the street with no identifying information on it and no password required to login. I would argue that picking that laptop up and keeping it isn't theft but rather simply FINDING it. In this case AT&T put the laptop in a brown paper bag (in the middle of the street) and then were shocked, SHOCKED that someone would open it up to see what's inside. EDIT: Security through obscurity is no security at all.

rayiner 13y ago
It is actually theft to take a laptop in a brown paper bag in the middle of the street unless there is an indiction the owner intended to abandon it. Finders are supposed to make efforts to locate the owner or otherwise turn in what was found.
- adamnemecek 13y ago
  Which is kind of what weev did by reporting it.
  - tptacek 13y ago
    The words "kind of" are doing a lot of work in that sentence.
    - adamnemecek 13y ago
      In the sense that he made the owner aware of it.
  - unreal37 13y ago
    Agree with tptacek - by "kind of" you mean "not at all" what he did.
    - wnight 13y ago
      When it's a laptop full of customer information left around in the street - as this analogously was, do you tell the company so they can cover it up or the news so people know to watch for fraudulent charges? Weev joked about a lot. Stuff that would have been fitting to have happen to AT&T considering their negligent practices and disgraceful follow-up, but if we're guilty of what we joke about ...

jlgreco 13y ago

Somebody cannot steal things from my apartment without being in a jurisdiction that I presumably have decided is sane. Meanwhile when AT&T forgets to lock the door to the stuff I have entrusted them with, anyone in the world can get at that. AT&T relying on the law being able to eventually get baddies after the fact is not sufficient.

dopamean 13y ago

I believe that the person doing the stealing needs to be held responsible. I also think that the entity holding the data needs to be held responsible for a lack of security. If your kid is kidnapped from a daycare because they didnt lock doors or have any security measures they can be held accountable for that as well as the kidnapper.

Houshalter 13y ago

To be fair, there is a difference between actually stealing your stuff, and just walking into your house to prove your security sucks. It would be like if I just opened up a bank vault and walked inside and shouted "Hey, this bank sucks, no one put your money here!" without actually stealing anything.

rayiner 13y ago
Yes, there is a difference. And Weev could have downloaded one e-mail address just to prove his point.
- wnight 13y ago
  That's just concern troll nonsense, or what someone who'd never heard of software would say. It's easier to download a range of IDs than to guess which ones are valid. And "three email addresses leaked - hacker claims more could be at risk" is pathetic and you know it would be ignored. By the company, by the news, and ultimately, by users. Also, there's a fallacy here. You admit it's reasonable to download, leak, etc, but then make it seem unreasonable because he did too much of it. The joke of it though, is that ultimately you-all can piss and moan about your convenient morals, but what Weev should have done - by your "anything legal is A-OK" standards - is to emigrate to Russia (or elsewhere) and sell the data to a local "security firm". Then he'd have been rich, and safe, and AT&T would either be secure or out of business. But instead he did the honest thing (and inconvenienced a wealthy corporation in doing so) and suffers greatly. Next time, zero-day through Tor. Just saying.