14 ms·
You May Not Like Weev, But Your Online Freedom Depends on His Appeal
- andyzweb 13y agofree weev
- lesslaw 13y agoIt is a terrible decision curl http://domain.com/showdocument?[00000-99999] should not be a crime!!
- davidw 13y agoWhat if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account? Don't you think that the consequences should depend on what the action actually accomplished, rather than the action itself? Flicking a lighter is generally pretty innocuous, but if done to light a house on fire, it means it's a bit different - right? Yes, it's their fault too for leaving it open, but you had a choice when you decided to access it N000 times, rather than saying "oops, that does something bad, I think I'll stop". I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. Once you've shown that someone stupidly left their door open, the polite thing is to let them know, rather than walking around in their house looking at all their things to show them the error of their ways. IMO a fine would more than suffice as a punishment, though.
- betterunix 13y ago"What if doing so killed a person for each ID at showdocument? Ok, that's pretty absurd. What if it wiped out their bank account?" Shouldn't you hold the people who created that system responsible, rather than the person who used it? If I rig up my cell phone to a gun, so that every time someone calls it it shoots at a crowd of people, should the people who call it go to prison while I walk free?
- davidw 13y agoIf they know what happens when they call, yes, they should go to jail too. He knew what he was doing once he'd pulled down a few records. Also, yes, ATT should be held responsible for implementing lame security.
- betterunix 13y agoSure, but my point is that he has no greater responsibility than AT&T does. Why are we acting like AT&T is an innocent victim?
- davidw 13y ago> Why are we acting like AT&T is an innocent victim? No one here is. I'm not sure why no one has done anything to them, legally. It'd be interesting if someone who actually knows what they're talking about in terms of the legal system about could comment on it.
- FlyingAvatar 13y agoI think that the problem with this thinking is: (a) Even altering a parameter once in the address could be considered illegal under the current laws. (b) The access of information in and of itself would not be illegal alone. Say I kept a bunch of people's information in paper files in file cabinets. Then I gave you access to retrieve yours from the file drawer yourself. It is sleazy, but not necessarily illegal to look at other files in the drawer, as I have given you access to their container. (c) Even if you want to make the action in (b) illegal, the reasonable punishment is almost certainly not a double digit prison sentence.
- publicfig 13y agoThis analogy has been flawed from the beginning, but to extend it just for the fun of it, that's like pulling the trigger of a gun and then blaming the gun for having the mechanics to turn that trigger pull into a fired bullet that kills someone. The action being done is on your end, and the system, though possibly flawed, is not the cause of the results. It may be a factor and it may enable those results, but the actor is the cause in that situation. I honestly don't even know where I stand on the actual discussion point, but I do know where I stand in the weird analogy tree we've made.
- dorkitude 13y agoThat would be a crime, because then the email addresses would've been "possessed" or "transferred" "in connection with" another distinct and separate crime. But giving them to a responsible journalist for whistle-blowing purposes is not a crime. It's a public service.
- walid 13y ago> I don't think the punishment fits the crime in this case, but I don't think he's entirely innocent either. In this case there is no crime. And I repeat this again, AT&T was behaving like http://www.mailinator.com/ http://www.mailinator.com/
- DomreiRoam 13y agoGET method should be Safe ( and Idempotent). The implementation is not respecting the RFC 2616. The RFC says at the point 9.1.1 that: "Naturally, it is not possible to ensure that the server does not generate side-effects as a result of performing a GET request; in fact, some dynamic resources consider that a feature. The important distinction here is that the user did not request the effects, so therefore cannot be held accountable for them."
- IanCal 13y agoShould I be allowed to brute force passwords then?
- betterunix 13y agoYes, because organizations that use simple password-based authentication to secure important things (bank accounts, private messages, etc.) should be held responsible for the outcomes of such attacks. In such a world the state of computer security would not be so pitiful.
- twoodfin 13y agoYou and sneak seem to be proposing a legal regime under which no "hacking" of any kind is illegal. If the system will perform action B given request A, issuing request A, no matter the intent, cannot be a crime? If I'm missing an important distinction you'd make, I'd very much like to hear what it is.
- betterunix 13y agoI would prefer if the system punished people for what they did with their access to data, not simply for having that access; organizations that hold private or sensitive information should be punished if unauthorized people can access it by any means. Having email addresses or credit card numbers should not be the crime, regardless of how you obtained that information. Committing credit card fraud or selling credit card information to other unauthorized people should be crimes (or failing to secure your computer where you store said information). So Weev should not be punished for downloading the email addresses. AT&T should be punished for making the list available to him (and likewise, if Weev made the list available to others, he should be punished for that).
- twoodfin 13y agoApologies for crossing threads, but aren't you pretty upset that the NSA simply has Verizon phone records, despite a lack of evidence they're planning on doing anything nefarious with them? Anyway, as I understand it, weev did speculate about selling the information. And would you be so sanguine if this were health records or private photographs? I'm not seeing a plausible guiding principle here.
- efdee 13y agoHow about curl http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&password=[aaaaa-zzzzz] http://domain.com/attemptlogin?username=[aaaaa-zzzzz]&passwo..., followed by curl http://domain.com/admin/wipeeverything?username=x&password=y http://domain.com/admin/wipeeverything?username=x&password=y ?
- rpicard 13y agoCouldn't we draw a line between retrieving information and modifying it?
- stfu 13y agoI, for one like Weev. He is a boundary pusher. Many even around here on hn might perceive his stuff as tasteless. But I sincerely wished more people were as dedicated to their "ideals" as Weev is. Defending free speech means standing up for people who have controversial views - no matter how unease you personally are with these views.
- theorique 13y agoDefinitely. Free speech stands or falls on the most offensive speech. It's easy to support free speech when all you say or hear is motherhood and apple pie. It's the things that make people uncomfortable that need protection from censorship.
- sliverstorm 13y agoIt's the things that make people uncomfortable that need protection from censorship Agreed; things like "Fire!" when there isn't a fire.
- theorique 13y agoI was thinking more about things that make people emotionally uncomfortable, rather than real-life trolling that has the potential to trigger a life-threatening stampede to the exits.
- rayiner 13y agoHow do you make this a speech issue?
- mjn 13y agoThe brief is actually quite readable: https://www.eff.org/file/37297 https://www.eff.org/file/37297 If you're already familiar with the background of the case, for the meat of the argument on appeal, skip to p. 15 (26th page of the PDF), starting with "Summary of Argument". That section lays out the five objections being raised on appeal, and is then followed by five sections making the detailed arguments. edit: direct link, https://www.eff.org/file/37297#page/26/mode/1up https://www.eff.org/file/37297#page/26/mode/1up
- nicholassmith 13y agoI agree with the sentiment that computer use crimes need to be reworked, and that weev shouldn't have been hoisted by the fact he is a colossal dick but the article seems to gloss over things for the sake of the argument. - `The spoofing was irrelevant; Spitler would have gotten the same email addresses if he had manually inputted the URLs on an iPad rather than a spoofed desktop browser.`, the spoofing is incredibly relevant, it's an important technical detail. Sure he could have sat and put each string in in a long laborious process, but they circumvented that and went straight to the faster option. Once they'd established there was a hole they could have stopped rather than going for the motherlode. - `if there’s no technical barrier...`, there was a technical barrier, it was just very, very small. Don't misunderstand me, AT&T are massive idiots for letting a security violation on that scale leak out into the wild, and they should't have been surprised for it to be discovered, but if you're doing live security research and find a hole is taking 114k email addresses a particularly good way to report it? He certainly didn't deserve the ridiculous amount of time that he got, but he's not an innocent in this example by any stretch of the imagination.
- sneak 13y agoIt doesn't matter if they accessed one or a million - accessing information published on the web SHOULD NOT BE CRIMINAL. Whether you agree with his methods or not, there is no stretch of the imagination that makes prison for downloading (even 114k of) them make sense. It wasn't a hole or bug— it was an expressly implemented feature. ATT decided to do it this way to reduce resubscription friction. The iPad sends the sim serial (ICCID), and ATT sends the HTML form with the email address already filled in, so all the user has to do is enter the password. As it turns out, ICCIDs are sequential integers. It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. Weev knew that the greater the number of records he got, the worse it would reflect upon ATT, and rightfully so.
- res0nat0r 13y ago>It should always be perfectly legal to access a remote computer system via a publicly accessible interface. It's up to that remote system to respond appropriately. In this case, it was working exactly as ATT intended. The law can never be this black and white, it is all about context. Just because you may somehow access something on the web, doesn't mean it is automatically ok to do so.
- onedognight 13y agoThis is the same as if the URL was the following and all you had to do was change the phone number and you would get an email address. http://att.com/email?phone=555-1212 And Weev noticed this and wrote a for loop to try all phone numbers.
- linuxhansl 13y agoA few points that stuck out: * "AT&T representative testified its reputation suffered as a result of the hack" No, their reputation suffered, because they were incompetent. Ironically, without this trial I would have never heard about this. * "At sentencing, instead of hearing about the effects of the iPad “hack,” the government recounted in detail Weev’s “attitudes” towards others on the internet." That is because of the adversarial legal system in the US. All that matters is to sway an uninformed jury. The specific matter of the case is almost irrelevant as long as the jury comes to a "guilty" verdict. Lastly, this reminds of a civil version of the current Snowden debacle: Attempt to prosecute anybody who reveals wrong doing or incompetence.
- dllthomas 13y agoI don't think I go as far as others here. I am not sure an open door is an invitation to dig through someone's diary; that is, even if someone is incompetent in managing their security, there should probably still be a point at which abusing that crosses a line - though I am very open to discussing just where that point is (and some liability should certainly still sit with those who deployed an insecure system). All of that said, I wholeheartedly agree that damage to reputation (where such damage comes only from revelation of the insecurity) is the fault of the people failing to live up to their reputation, not those exposing the reality of it.
- rhizome 13y agoWhat if the diary is left open on the kitchen table, the "kitchen table" being the internet?
- IanDrake 13y agohttps://www.eff.org/deeplinks/2013/06/eff-access-public-website-not-crime https://www.eff.org/deeplinks/2013/06/eff-access-public-webs... A link to the Craigslist vs. 3Taps spat in this article brought back memories. Craigslist had also threatened me with a C&D letter suggesting they'd use the CFAA to lock me up. I contacted the EFF who promptly told me to go screw... I assumed that was because Craig is on the board of advisers and CL was a major sponsor. I'm glad to see they're finally helping someone against the giant internet bully that is CL.
- coding123 13y agoso here's the solution. 1) Make a website called "freeweev.com" or something 2) Put some legal mumbojumbo at the bottom of the site that says something about unauthorized usage of this website is a crime. 3) Make the post-signup page URL look something like this: http://freeweev.com/?id=12 http://freeweev.com/?id=12 That simply says "Your email: ...@gmail.com will be updated when we have info on the case. Thanks for your interest" 4) Let people "find this" 5) Get lots of people to report on the problem 6) Fix the problem after the press gets it 7) Freeweev.com takes everyone to criminal court under CFAA. No lawyers necessary, just tell the Judge that there appears to be no difference in these cases as the AT&T case, all of these people that hacked our site should go to jail for 41 months. Also make sure that this involves MANY people. 8) Legal breakdown, no software development for anyone (like the screen-writers strike right?)
- aclevernickname 13y agoWhat a useless article. Jury found weev guilty already, and now they're filing an appeal. No word on when the appeal will be heard, just 1,000 words to fill up that lack of information, combined with linkbait headline.