3 ms·

I've spent about 10 minutes reading articles from OP and I have to say he comes across poorly. To be very blunt, OP you come across as a jerk. The funny thing

by 300bps 12y ago

I've spent about 10 minutes reading articles from OP and I have to say he comes across poorly. To be very blunt, OP you come across as a jerk. The funny thing is I'm naturally sympathetic - I don't think what you did is even a crime! For examples: https://scott.arciszewski.me/blog/2014/03/black-and-white-2600-article https://scott.arciszewski.me/blog/2014/03/black-and-white-26... The total "intrusion" lasted only 23 minutes, according to court documents. I'd be concerned if someone intruded into my computer for 23 seconds. Attempting to minimize what you're accused of with statements like this will likely turn people against you. As usual, the game was rigged, and I lost Sometimes introspection allows us to see that we legitimately lose; that things aren't always rigged against us. It also lets us see that our attitude can be our own worst enemy. My last semester was erased (which screwed up my taxes for the next year and is probably illegal) "Woe is me" doesn't play well when you are experiencing the negative consequences of having committed an alleged crime. Also don't accuse others of illegal activities unless you can prove them; it destroys your credibility. For the digital equivalent of knocking on someone's front door, it swinging ajar, looking in, seeing nobody home, going on my way, and then being put on house arrest Again, you're minimizing what you did. A more apt analogy based on your own description of what you did would be coming up to a locked door, seeing it is Brand X locks, purposely seeking out an exploit on how to pick Brand X locks, spending time picking the lock and then broadcasting to the world what you did. I could go on, but the summary is that being a humble and contrite person will often allow a guilty person to go off scot-free. When I was arrested for hacking, that's what happened to me and I was literally let go with no record. On the flip side, rightly or wrongly coming across with a negative attitude can help an innocent person go to jail. Fair or not, that's the world we live in.

tptacek 12y ago
"runner up: Not using Tor, an overseas VPN, or an SSH tunnel when I knew how" wasn't a particularly great thing to say here.
- sarciszewski 12y ago
  The number one response I hear from infosec people (which was the intended audience of 2600) was, "Dude, you should've used a proxy!" I recognize that failing to do so was reckless and stupid.
  - danielweber 12y ago
    No, talking about one your biggest regrets being "getting caught" is a problem today. The textbook example of someone who isn't sorry for what he did is that he explains his mistakes as "I got caught."
  - sarciszewski 12y ago
    @danielweber: I think it's very easy to misconstrue what I'm saying for "I regret getting caught". My point is that I knew how to hide, but didn't, so anyone who calls me stupid for not doing so is correct. Poor risk management.
    - tptacek 12y ago
      No, I'm saying it was a bad idea to talk about what you did wrong to get caught. It creates the perception that you think exploiting flaws in someone's site without permission wasn't the big thing you did wrong. Which, you can believe that or not, but in terms of mitigating risks perceived by employers, not creating that impression should be your #1 priority.
alt2319 12y ago
Well he was kind of railroaded by a law that sucks. $9,000 in damages by planting 3 files on a website? Worse, it's impossible to argue intent / mens rea in these cases. It doesn't matter if your intent was to cause no damage because the crime isn't defined by the damage but by the access. As long as you intended to access the internet-connected device, and knew you were exceeding your permitted access, you're guilty. The "damage" doesn't have to be intentional. The opportunity is gone now, but I really wish he'd fought this case and gotten it in front of a jury. It's very technical testimony and I think a jury could really question the damage amount. If it were below $5,000 this law doesn't apply. How much did it really cost? They had to delete 3 files and apply patches that they should have applied all along. It's also just weird how punishment scales work. I used to go to my probation officer's office and see all the other guys he was monitoring. Most were serious drug dealers or weapons violations. It seemed so out of whack. But then when I'd go do community service I'd see people sentenced to 20 hours of community service, hundreds of dollars in fines, and weeks in jail for crap like shoplifting a 99 cent air freshener or a pack of cigarettes.
- tptacek 12y ago
  His lawyer was probably very right. He's conceding on this thread a fact pattern that will, by the jury instructions, mechanically result in a conviction. He'd spent many tens of thousands of dollars to achieve the same guilty verdict, with the sweetener of a short custodial sentence. I'm not entirely sure what the punishment Scott received actually was, but he served no time, so it sounds like his sentencing level was below the noise floor.
  - alt2319 12y ago
    I believe he got almost exactly what I got: six months "imprisonment" (served as home detention), five years probation, restitution ($9,000-ish for him), 100 hours of community service, and a few assorted court and administrative fees. Probably also had to pay fees for an ankle monitor system while on home detention, but not sure. Unless it's changed, I think under the normal federal sentencing guidelines, that amount of "damage" doesn't even qualify for any prison time at all, but the specific offense overrides that to impose a minimum of six months. That's because of a little outcry in the 1990s over hackers not serving any time and the (maybe valid) perception that they actually benefited from the notoriety of a conviction.
sarciszewski 12y ago
I see your point that the wording is not the humblest, most submissive, self-loathing etc. thing I could have written about it, but I was honestly expressing how I feel about the whole incident. To be pedantic, the door WAS unlocked. You did not even need a user account to upload files. In hindsight, I probably could have argued that "authorized access" was never exceeded because the form I used was publicly accessible as part of a DotNetNuke design flaw, but I didn't want to drag to court battle out any longer. I was in the wrong, even if I wasn't the only one.
- tptacek 12y ago
  Well, here you get to choose your own adventure. You can publicly mollify your complicated feelings about what happened to you in angry posts to the Internet, or you can get an early start on repairing the damage you've done to your career. You are not a spectator for your own life. You aren't limited to expressing opinions about it. You are free to act that way. You can try to play a victim card that only a tiny fraction of people will even understand, let alone sympathize with. You can choose to make your life about this event. Or you can make your life about something else, and put this behind you. I'd just worry that you probably can't do both of those things. If you're going to do the latter, my advice is this: any time you talk about what happened with you and that stupid website, have a clear goal behind whatever it is you're saying. Make sure that goal squares up with your overall goal of getting this in the past. The Internet really, really, really, really wants you to pick it apart and debate it. That creates drama, and drama is fun. Personally, I think you've donated enough drama to the Internet, and you don't owe anyone any more of it.
  - KB1JWQ 12y ago
    Amazingly well said. OP: Eventually the narrative will shift to "I was young and stupid, and it was a long time ago," which is exactly what you want. By continuing to defend what you did, you're actively delaying the time until you can begin using that line. Frankly, whether you believe you're right or not is beside the point; no hiring manager is going to care, and your current attitude towards it presents as toxic.

by 300bps 12y ago

tptacek 12y ago

"runner up: Not using Tor, an overseas VPN, or an SSH tunnel when I knew how" wasn't a particularly great thing to say here.

sarciszewski 12y ago
The number one response I hear from infosec people (which was the intended audience of 2600) was, "Dude, you should've used a proxy!" I recognize that failing to do so was reckless and stupid.
- danielweber 12y ago
  No, talking about one your biggest regrets being "getting caught" is a problem today. The textbook example of someone who isn't sorry for what he did is that he explains his mistakes as "I got caught."
- sarciszewski 12y ago
  @danielweber: I think it's very easy to misconstrue what I'm saying for "I regret getting caught". My point is that I knew how to hide, but didn't, so anyone who calls me stupid for not doing so is correct. Poor risk management.
  - tptacek 12y ago
    No, I'm saying it was a bad idea to talk about what you did wrong to get caught. It creates the perception that you think exploiting flaws in someone's site without permission wasn't the big thing you did wrong. Which, you can believe that or not, but in terms of mitigating risks perceived by employers, not creating that impression should be your #1 priority.

alt2319 12y ago

Well he was kind of railroaded by a law that sucks. $9,000 in damages by planting 3 files on a website? Worse, it's impossible to argue intent / mens rea in these cases. It doesn't matter if your intent was to cause no damage because the crime isn't defined by the damage but by the access. As long as you intended to access the internet-connected device, and knew you were exceeding your permitted access, you're guilty. The "damage" doesn't have to be intentional. The opportunity is gone now, but I really wish he'd fought this case and gotten it in front of a jury. It's very technical testimony and I think a jury could really question the damage amount. If it were below $5,000 this law doesn't apply. How much did it really cost? They had to delete 3 files and apply patches that they should have applied all along. It's also just weird how punishment scales work. I used to go to my probation officer's office and see all the other guys he was monitoring. Most were serious drug dealers or weapons violations. It seemed so out of whack. But then when I'd go do community service I'd see people sentenced to 20 hours of community service, hundreds of dollars in fines, and weeks in jail for crap like shoplifting a 99 cent air freshener or a pack of cigarettes.

tptacek 12y ago
His lawyer was probably very right. He's conceding on this thread a fact pattern that will, by the jury instructions, mechanically result in a conviction. He'd spent many tens of thousands of dollars to achieve the same guilty verdict, with the sweetener of a short custodial sentence. I'm not entirely sure what the punishment Scott received actually was, but he served no time, so it sounds like his sentencing level was below the noise floor.
- alt2319 12y ago
  I believe he got almost exactly what I got: six months "imprisonment" (served as home detention), five years probation, restitution ($9,000-ish for him), 100 hours of community service, and a few assorted court and administrative fees. Probably also had to pay fees for an ankle monitor system while on home detention, but not sure. Unless it's changed, I think under the normal federal sentencing guidelines, that amount of "damage" doesn't even qualify for any prison time at all, but the specific offense overrides that to impose a minimum of six months. That's because of a little outcry in the 1990s over hackers not serving any time and the (maybe valid) perception that they actually benefited from the notoriety of a conviction.

sarciszewski 12y ago

I see your point that the wording is not the humblest, most submissive, self-loathing etc. thing I could have written about it, but I was honestly expressing how I feel about the whole incident. To be pedantic, the door WAS unlocked. You did not even need a user account to upload files. In hindsight, I probably could have argued that "authorized access" was never exceeded because the form I used was publicly accessible as part of a DotNetNuke design flaw, but I didn't want to drag to court battle out any longer. I was in the wrong, even if I wasn't the only one.

tptacek 12y ago
Well, here you get to choose your own adventure. You can publicly mollify your complicated feelings about what happened to you in angry posts to the Internet, or you can get an early start on repairing the damage you've done to your career. You are not a spectator for your own life. You aren't limited to expressing opinions about it. You are free to act that way. You can try to play a victim card that only a tiny fraction of people will even understand, let alone sympathize with. You can choose to make your life about this event. Or you can make your life about something else, and put this behind you. I'd just worry that you probably can't do both of those things. If you're going to do the latter, my advice is this: any time you talk about what happened with you and that stupid website, have a clear goal behind whatever it is you're saying. Make sure that goal squares up with your overall goal of getting this in the past. The Internet really, really, really, really wants you to pick it apart and debate it. That creates drama, and drama is fun. Personally, I think you've donated enough drama to the Internet, and you don't owe anyone any more of it.
- KB1JWQ 12y ago
  Amazingly well said. OP: Eventually the narrative will shift to "I was young and stupid, and it was a long time ago," which is exactly what you want. By continuing to defend what you did, you're actively delaying the time until you can begin using that line. Frankly, whether you believe you're right or not is beside the point; no hiring manager is going to care, and your current attitude towards it presents as toxic.