5 ms·

> This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonab

by jMyles 11y ago

> This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation and just happened to be the first (or the first noticed) to use applications in a way unintended by the designers.

gph 11y ago
>This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.
- jMyles 11y ago
  Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.
  - tptacek 11y ago
    This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
    - jMyles 11y ago
      The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.
- msandford 11y ago
  OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?
  - gph 11y ago
    Of course harm will come to me, the point is that those doing the harm should still be held accountable if they're caught. Yes the law is far from perfect and it's easy to imagine absurd scenarios like yours where the law falls apart. Certainly that should be fixed. But in this particular case Weev knew he was going onto a portion of the webpage that wasn't meant to be public, even if technically anyone could access it because of AT&T's ineptitude. There weren't any links to that exact URL, and in a sense it took some reverse engineering (ok basically just guess and check) for him to find it. It wasn't a public webpage in the sense that he stumbled upon it from some link or a google search. He put thought into purposefully discovering that exact URL and opening it, knowing as a computer security enthusiast that it wasn't meant for public consumption.
    - msandford 11y ago
      I'm afriad I have to respectfully disagree with the idea that "he should have known better". Most analogies fall flat because webservers do EXACTLY WHAT YOU TELL THEM even if what you tell them to do isn't what you actually want them to do. Our laws are generally organized around the idea of reasonable adults doing reasonable things and being understood by other reasonable people. The average, reasonable person can't comprehend a webserver. If you give a robot a gun and tell it to shoot anything that comes through that door and it shoots your wife/husband/child/parent, its not them who is at fault nor is it the robot. Its your fault and you should be tried for murder. I hope the comparison is clear.
      - gph 11y ago
        >The average, reasonable person can't comprehend a webserver. But weev could. We don't apply laws as if the defendant is some mythical "reasonable" person. We try each case based on it's unique circumstances. It's not that he "should have known better", it's that he absolutely did know better. The comparison is clear, but it has no relevance.
- msandford 11y ago
  > That's basically victim blaming though. Not really. Nobody's blaming AT&T's CUSTOMERS for doing anything wrong. They are the victims. They are the ones who had their personal information made available to people outside of AT&T. This might better be called perpetrator blaming. The perpetrator is the person who commits a crime. AT&T had an obligation to keep customer data safe regarding the privacy policy that they tell customers that they will uphold. They failed to uphold it in any kind of meaningful way, by failing to provide any kind of access control to said personal information. Calling it victim blaming is to fail to apply any kind of critical thinking to the situation.
  - deleted 11y ago
    [deleted]
Nadya 11y ago
As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - your door is open already. Do I have permission to waltz right in?
- tedunangst 11y ago
  I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?
  - Nadya 11y ago
    Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
    - tedunangst 11y ago
      Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
      - msandford 11y ago
        Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
        11y ago
tptacek 11y ago
Whatever your tastes might be, that's not what the law in the US says.
- jMyles 11y ago
  Oh, I understand that; I have no illusions otherwise. But I thought this thread was precisely about how strange the laws are?

by jMyles 11y ago

gph 11y ago

>This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.

jMyles 11y ago
Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.
- tptacek 11y ago
  This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
  - jMyles 11y ago
    The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.
msandford 11y ago
OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?
- gph 11y ago
  Of course harm will come to me, the point is that those doing the harm should still be held accountable if they're caught. Yes the law is far from perfect and it's easy to imagine absurd scenarios like yours where the law falls apart. Certainly that should be fixed. But in this particular case Weev knew he was going onto a portion of the webpage that wasn't meant to be public, even if technically anyone could access it because of AT&T's ineptitude. There weren't any links to that exact URL, and in a sense it took some reverse engineering (ok basically just guess and check) for him to find it. It wasn't a public webpage in the sense that he stumbled upon it from some link or a google search. He put thought into purposefully discovering that exact URL and opening it, knowing as a computer security enthusiast that it wasn't meant for public consumption.
  - msandford 11y ago
    I'm afriad I have to respectfully disagree with the idea that "he should have known better". Most analogies fall flat because webservers do EXACTLY WHAT YOU TELL THEM even if what you tell them to do isn't what you actually want them to do. Our laws are generally organized around the idea of reasonable adults doing reasonable things and being understood by other reasonable people. The average, reasonable person can't comprehend a webserver. If you give a robot a gun and tell it to shoot anything that comes through that door and it shoots your wife/husband/child/parent, its not them who is at fault nor is it the robot. Its your fault and you should be tried for murder. I hope the comparison is clear.
    - gph 11y ago
      >The average, reasonable person can't comprehend a webserver. But weev could. We don't apply laws as if the defendant is some mythical "reasonable" person. We try each case based on it's unique circumstances. It's not that he "should have known better", it's that he absolutely did know better. The comparison is clear, but it has no relevance.
msandford 11y ago
> That's basically victim blaming though. Not really. Nobody's blaming AT&T's CUSTOMERS for doing anything wrong. They are the victims. They are the ones who had their personal information made available to people outside of AT&T. This might better be called perpetrator blaming. The perpetrator is the person who commits a crime. AT&T had an obligation to keep customer data safe regarding the privacy policy that they tell customers that they will uphold. They failed to uphold it in any kind of meaningful way, by failing to provide any kind of access control to said personal information. Calling it victim blaming is to fail to apply any kind of critical thinking to the situation.
- deleted 11y ago
  [deleted]

Nadya 11y ago

As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - your door is open already. Do I have permission to waltz right in?

tedunangst 11y ago
I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?
- Nadya 11y ago
  Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
  - tedunangst 11y ago
    Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
    - msandford 11y ago
      Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
      - 11y ago

tptacek 11y ago

Whatever your tastes might be, that's not what the law in the US says.

jMyles 11y ago
Oh, I understand that; I have no illusions otherwise. But I thought this thread was precisely about how strange the laws are?