4 ms·

A lot of HN readers appear to place the blame on the system engineers rather than the kid. Some go so far as to say that the kid did a good thing in teaching th

by cduan 17y ago

A lot of HN readers appear to place the blame on the system engineers rather than the kid. Some go so far as to say that the kid did a good thing in teaching the engineers a lesson. The implicit principle seems to be that unwanted intrusions are acceptable--even applaudable--actions in the face of systems unsecured against them. I would ask of you whether you would apply this principle in other systems. Shall we call it a "good lesson" if the kid went around shooting people in the train, as a lesson that the trains need to be bulletproofed? Folks, the criminal law exists to punish certain undesirable actions, so that the general public can save itself the cost of self-protection. I don't walk around wearing a bulletproof vest all the time, because I believe that the law and its enforcement will sufficiently deter others from deciding to intrude upon my body with a bullet. So should it be with technological intrusions as well as physical. Certainly it is feasible to build secure systems. So is it feasible for me to wear a bulletproof vest all the time. But secure systems, like bulletproof vests, are costly things--they require hiring good engineers, spending time to evaluate security risks, testing systems for robustness, and so on. And if these costs are sufficiently high, then it would be economically inefficient to impose them on systems engineers by allowing hacking like this to go unpunished. I'm not saying that anyone should be lax in building secure systems. I am, however, saying that intrusive behavior like this kid's should not be applauded. It should be recognized for what it is: a societally detrimental act, for which he should be held accountable as any other societally detrimental act is held under the law.

HalcyonMuse 17y ago
Nonsense. There are people out there who have the goal "kill large numbers of people." Their motive is sometimes political, sometimes simply sociopathic... but the motive is irrelevant. If a fourteen year old boy can hack the train system and cause some minor damage (i.e. expensive train derailments) what could a motivated, fully grown adult do if they had that remote control instead? I suspect the answer is hundreds dead - maybe thousands with sufficient coordination and vulnerable systems. A security hole like this is extremely dangerous due to the magnitude of its ignorance. Systems like mass transit should HAVE good engineers that spend time evaluating security risks and testing systems for robustness et cetera. I doubt the hole would have been patched if someone called up their local Mass Transit Authority and said "Hey, uh, I've got this 0-day..." A 14 year old boy exploiting it, on the other hand, is probably going to draw some attention to it, and that attention will likely get the hole fixed, potentially saving hundreds of lives in the future. If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station.
- davidw 17y ago
  > If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station. If the radio station were aware that playing that song would result in loss of life, they would not play it, and would be at fault if they did, or at least in for a percentage of it.

by cduan 17y ago

HalcyonMuse 17y ago

Nonsense. There are people out there who have the goal "kill large numbers of people." Their motive is sometimes political, sometimes simply sociopathic... but the motive is irrelevant. If a fourteen year old boy can hack the train system and cause some minor damage (i.e. expensive train derailments) what could a motivated, fully grown adult do if they had that remote control instead? I suspect the answer is hundreds dead - maybe thousands with sufficient coordination and vulnerable systems. A security hole like this is extremely dangerous due to the magnitude of its ignorance. Systems like mass transit should HAVE good engineers that spend time evaluating security risks and testing systems for robustness et cetera. I doubt the hole would have been patched if someone called up their local Mass Transit Authority and said "Hey, uh, I've got this 0-day..." A 14 year old boy exploiting it, on the other hand, is probably going to draw some attention to it, and that attention will likely get the hole fixed, potentially saving hundreds of lives in the future. If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station.

davidw 17y ago
> If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station. If the radio station were aware that playing that song would result in loss of life, they would not play it, and would be at fault if they did, or at least in for a percentage of it.