"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbefd0@news.povray.org...
> somebody <x### [at] ycom> wrote:

> > >   Finding a security weakness and then *not* exploiting it for your
own
> > > selfish purposes but instead reporting the weakness so that they will
> > > patch it justifies it.

> > If the end justifies the means, am I to assume you also agree that
breaking
> > into people's homes to expose their security flaws and pretend-robbing
> > people at gunpoint to expose their unprotectedness are also just dandy,
and
> > moreover a good deed, provided you don't actually steal anything?

>   Yes, those two things are completely equivalent.
>
>   Breaking into someone's home usually causes material damage which costs
> money. Breaking into a computer system usually doesn't.

You can break into a house without costing material damage. Ever head of
picking locks? Does that legitimize it?

>   Breaking into someone's home exploits a security flaw which everyone
> *already knows*.

No. Do you know how secure your lock is? Do you know how long it takes to
pick it? I'm doing you a service by demonstrating how easy it is.

> There's nothing to prove.

Ah, that's the crux of the matter: A hacker proves his superiority!

> It's up to the owner of the
> house to decide whether he wants to fix it or not. Breaking into a
computer
> system exploits a flaw which is *not known* by the system administrators.

Whether it's known or not known or in the process of being fixed or not is
completely irrelevant. Hacking is a crime, same as lockpicking without
owner's consent.

If the admins invited him to hack, that would be fine. As it is if you
invite a locksmith to pick your lock.

>   Upgrading the security of a house is expensive. Security upgrades of
> a computer system are usually part of the software license (ever heard
> of free security patches?)

Again, completely immaterial how expensive or cheap it is to fix something.
Having said that, it's not necessarily cheap to fix security flaws either.

>   A malicious robber breaking into a house causes damage to the owner
> of that house only. A malicious hacker breaking into a university computer
> can potentially cause damage to thousands of people.

That makes no sense whatsover. If anything, you are legitimizing breaking
into institutions instead of houses. Maybe I should change my example to
breaking into a business, a hospital, a school, a military bases... etc. I'm
sure courts will then give me even bigger medals of honour for doing the
public a service which affects many more people.

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbfe62@news.povray.org...
> somebody <x### [at] ycom> wrote:

> > There are many costs (including waking up the sys-admin in the middle of
the
> > night and paying overtime wages, or taking the system offline for a
while
> > and inconvenience legitimate users) with any systems attack.

>   A security hole report does not cause wakin gup the sysadmin in the
> middle of the night and paying overtime wages or taking the system
offline.

Really? If I send you an e-mail listing all your financial and confidential
information, won't you be wasting the rest of your day frantically calling
every bank, agency, government institution, and business to inform them to
disable your cards, change numbers, accounts... etc? In the meantime, you
won't have access to those things. Now consider confidential information of
thousands of students and do the math. Everything has a cost. Even if fixing
the system doesn't cost money (hah, in a dream world!), major damage is done
with any such reckless act.

>   It causes the sysadmin to send a report to the software house with which
> they have a software license so that they will fix the security hole. At
> regular working hours.

Not all systems are such turnkey operations, and the vendor won't himself
have a fix for every type of security breach even if they were.

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbee01@news.povray.org...
> somebody <x### [at] ycom> wrote:

> > You get permission (and probably supervision)
> > before testing other people's systems security flaws. You don't go
around
> > breaking into other people's systems to prove your machismo, and more
than
> > you go around breaking into other people's homes.

>   A student goes to the university directors and asks permission to try
> to hack the system? Haha!

What's wrong with that? If he makes a good case, he has a good chance of
being taken seriously. And if not, and if he's really obsessed, he can
suggest that he will hack regardless and give them the option to keep it
clean and under wraps. I don't recommend such borderline blackmail, but even
that is still better than committing a more serious and costly crime.

>   This would only lead for the security flaw to never be found and fixed.

You are guessing.

> Well, not until a malicious cracker exploits it first.

Again, that's a guess.

Post a reply to this message

somebody <x### [at] ycom> wrote:
> >   A security hole report does not cause waking up the sysadmin in the
> > middle of the night and paying overtime wages or taking the system
> offline.

> Really? If I send you an e-mail listing all your financial and confidential
> information, won't you

  No, because I don't read my email in the middle of the night, while
sleeping.

> be wasting the rest of your day frantically calling
> every bank, agency, government institution, and business to inform them to
> disable your cards, change numbers, accounts... etc? In the meantime, you
> won't have access to those things. Now consider confidential information of
> thousands of students and do the math. Everything has a cost. Even if fixing
> the system doesn't cost money (hah, in a dream world!), major damage is done
> with any such reckless act.

  So basically if the sysadmin is kept ignorant of the security hole,
no extra money is wasted and everybody is happy (but the security hole
goes unnoticed and unfixed). Apparently this is the desirable thing,
according to you.

> >   It causes the sysadmin to send a report to the software house with which
> > they have a software license so that they will fix the security hole. At
> > regular working hours.

> Not all systems are such turnkey operations, and the vendor won't himself
> have a fix for every type of security breach even if they were.

  And thus it's better for the sysadmins *not* knowing about the security
hole?

-- 
                                                          - Warp

Post a reply to this message

somebody <x### [at] ycom> wrote:
> > There's nothing to prove.

> Ah, that's the crux of the matter: A hacker proves his superiority!

  No, the hacker proves that there's a concrete security hole which
should be fixed.

> If the admins invited him to hack, that would be fine. As it is if you
> invite a locksmith to pick your lock.

  So as long as he didn't ask permission it's better that the sysadmins
are kept ignorant of the security flaw in the system.

  Basically the situation is that the sysadmins *benefited* from the
hacking, and as a reward, the university sues the person who performed
the hacking.

> >   Upgrading the security of a house is expensive. Security upgrades of
> > a computer system are usually part of the software license (ever heard
> > of free security patches?)

> Again, completely immaterial how expensive or cheap it is to fix something.
> Having said that, it's not necessarily cheap to fix security flaws either.

  Which is not the fault of the hacker, really. He shouldn't be punished
because fixing a security hole (which was not created by the hacker) is
expensive to fix.

> >   A malicious robber breaking into a house causes damage to the owner
> > of that house only. A malicious hacker breaking into a university computer
> > can potentially cause damage to thousands of people.

> That makes no sense whatsover. If anything, you are legitimizing breaking
> into institutions instead of houses. Maybe I should change my example to
> breaking into a business, a hospital, a school, a military bases... etc. I'm
> sure courts will then give me even bigger medals of honour for doing the
> public a service which affects many more people.

  No. If you break into a big institution and then make a report on how
you did it and which flaws you exploited, the institution will benefit
from it (because they will be able to fix those flaws), and you will be
rewarded with jailtime.

  Of course nobody breaks into institutions for the sole reason of
reporting how he did it. Too much work for no benefit.

  Hacking a computer, however, is a hobby.

-- 
                                                          - Warp

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cc040e@news.povray.org...

>   Basically the situation is that the sysadmins *benefited* from the
> hacking,

Hardly. They'll likely get into trouble themselves, if not fired. You may
think that's justified since they didn't do a perfect job, but it's
disingenuous to present the hacker as the victim and everyone else as
ungrateful beneficiaries.

[...]

>   Hacking a computer, however, is a hobby.

Everyone's entitled to their own opinions, but it's this type of thinking
that glorifies something that which in actuality is a crime.

Post a reply to this message

somebody a écrit :
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cc040e@news.povray.org...
>>   Hacking a computer, however, is a hobby.
> 
> Everyone's entitled to their own opinions, but it's this type of thinking
> that glorifies something that which in actuality is a crime.
> 

Besides, that's hardly a justification. Martial arts are one of my 
hobbies, and yet I don't go attacking people randomly just to prove them 
that their self-defence training is lacking... Even without causing 
significant harm (which would be possible) it would be illegal and 
normally prosecuted without any discussion of this sort happening.

-- 
Vincent

Post a reply to this message

somebody <x### [at] ycom> wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cc040e@news.povray.org...

> >   Basically the situation is that the sysadmins *benefited* from the
> > hacking,

> Hardly. They'll likely get into trouble themselves, if not fired.

  Why would they get fired?

> >   Hacking a computer, however, is a hobby.

> Everyone's entitled to their own opinions, but it's this type of thinking
> that glorifies something that which in actuality is a crime.

  Perhaps you understood incorrectly my sentence. "Hobby" did have a
completely neutral meaning in it.

-- 
                                                          - Warp

Post a reply to this message

Vincent Le Chevalier <gal### [at] libertyallsurfspamfr> wrote:
> somebody a écrit :
> > "Warp" <war### [at] tagpovrayorg> wrote in message
> > news:48cc040e@news.povray.org...
> >>   Hacking a computer, however, is a hobby.
> > 
> > Everyone's entitled to their own opinions, but it's this type of thinking
> > that glorifies something that which in actuality is a crime.

> Besides, that's hardly a justification.

  I didn't say it as a justification. Put it in the original context
of my post, rather than taking that one sentence alone.

-- 
                                                          - Warp

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cc1a36@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > "Warp" <war### [at] tagpovrayorg> wrote in message

> > >   Hacking a computer, however, is a hobby.

> > Everyone's entitled to their own opinions, but it's this type of
thinking
> > that glorifies something that which in actuality is a crime.

>   Perhaps you understood incorrectly my sentence. "Hobby" did have a
> completely neutral meaning in it.

That's my point, calling it a hobby gives a legitimizing impresion. Hacking
into other people's systems can no longer be called a hobby than robbing
banks can. It's not neutral, it carries a criminal element. Why is it so
hard to understand that certain "bit and bytes" can fall into "other
people's property" category? It's their system, their data. You have no
right whatsoever, even with good intentions, to violate their property.

Post a reply to this message

somebody <x### [at] ycom> wrote:
> That's my point, calling it a hobby gives a legitimizing impresion.

  You still misunderstand my sentence (on its context). Probably on
purpose. You are sticking to one word I used, rather than trying to
aknowledge what I meant with the whole post.

  Fine, if that's the best argument you can come up with, so be it.

-- 
                                                          - Warp

Post a reply to this message

Doctor John nous illumina en ce 2008-09-13 08:58 -->
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1

> 
> 
> Can't make my mind up on this; is the university right in prosecuting or 
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing 
> to be convinced otherwise
> 
> John
> 
That guy acted as a "troubleshooter".
What he did was:
I enter your system.
I tell you hwo I did it.
I tell you what the vulnerability is or are.
I tell you HOW to correct the vulnerability I used.

If you act correctly, the result is a safer system, with one or several less 
vulnerability.
If you act foolishly, you procecute the guy, you do nothing about the flaws he 
showed you, and your system is still at least as vulnerable as before.

-- 
Alain
-------------------------------------------------
You know you've been raytracing too long when...
you ever saw a beautiful scenery and regretted not to take your 6" reflective 
ball and a digital camera, thinking "this would have been a perfect light probe"
         -Johnny D

Post a reply to this message

somebody nous illumina en ce 2008-09-13 12:10 -->
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cbd5e0@news.povray.org...
>> somebody <x### [at] ycom> wrote:
> 
>>> The question you should be asking is, did anyone ask you to fix their
>>> security in the first place? Spend your time and energy on things that
> there
>>> is a demand for, not on things that you are unwelcome to do.
> 
>>   It's exactly that kind of bastard mentality that causes all the
>> ridiculous lawsuits.
> 
> No, it's the type of mentality that keeps a civilized society running. If
> the society approved of people who sought to fix the problems they perceived
> on others their own way, we would go back to lawlessness and every man fend
> for himself.
> 
> 
In everydays life, you're right... mostly. When you stumble on something wrong, 
you are bound to report it to someone competent on the mather, or correct it 
yourself if you are abilited or competent to do so. If you search for something 
wrong, for any reason, and find something, you must act about it.

In computer world, we NEED hackers to find and report flaws. Why do you think 
patches are isued for every OSs and most applications? Only because some hackers 
hunted for flaws and put them under the noses of devlopers. In the computer 
world, hackers are our private investigators. Many hackers are now paid workers 
at various software firms and security agencies. Calling every hackers 
"criminal" is insanely gross over symplification. It all depend on why he hack, 
and what he does after the hacking.

-- 
Alain
-------------------------------------------------
Don't kiss an elephant on the lips today.

Post a reply to this message

somebody wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cbee01@news.povray.org...
>> somebody <x### [at] ycom> wrote:
> 
>>   This would only lead for the security flaw to never be found and fixed.
> 
> You are guessing.
> 

No more so, given the evidence of how such things "always" lead, than 
"guessing" that the odds of rolling a seven with two six sided dice is 
likely to be higher than rolling a 12.

-- 
void main () {
   If Schrödingers_cat is alive or version > 98 {
     if version = "Vista" {
       call slow_by_half();
       call DRM_everything();
     }
     call functional_code();
   }
   else
     call crash_windows();
}

<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models, 
3D Content, and 3D Software at DAZ3D!</A>

Post a reply to this message

Doctor John wrote:
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1

> 
> 
> Can't make my mind up on this; is the university right in prosecuting or 
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing 
> to be convinced otherwise

The university is acting within its rights.  There were other ways of 
drawing attention to the problem other than breaking the law.  Notifying 
the security people risk, and then their non-IT bosses, are prudent 
steps, and I see no indication that the student did this *prior* to his 
own hacking.

Granted, you cannot *prove* that the vulnerability is real without 
making a successful penetration, but that really is beside the point.

It is not substantively different from a situation where you live in an 
apartment for which the landlord has failed to install adequate door 
locks.  You cannot break into other people's apartments in order to 
demonstrate the inadequacy of the existing security.  You tell the 
landlord, advise the tenants, and if nothing happens, move out.

Consider for a moment the results of allowing people to hack first, and 
then report the results of their hacking.  People who are hacking for 
criminal reasons will, if caught, claim that as a defense.

Regards,
John

Post a reply to this message

On 14-Sep-08 5:43, John VanSickle wrote:
> Doctor John wrote:
>>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1

>>
>>
>> Can't make my mind up on this; is the university right in prosecuting 
>> or are they overreacting to cover their own insecure *ssh*les?
>> Right now I'm leaning in the direction of overreacting but I'm willing 
>> to be convinced otherwise
> 
> The university is acting within its rights.  There were other ways of 
> drawing attention to the problem other than breaking the law.  Notifying 
> the security people risk, and then their non-IT bosses, are prudent 
> steps, and I see no indication that the student did this *prior* to his 
> own hacking.
> 
> Granted, you cannot *prove* that the vulnerability is real without 
> making a successful penetration, but that really is beside the point.
> 
> It is not substantively different from a situation where you live in an 
> apartment for which the landlord has failed to install adequate door 
> locks.  You cannot break into other people's apartments in order to 
> demonstrate the inadequacy of the existing security.  You tell the 
> landlord, advise the tenants, and if nothing happens, move out.

It is the same sort of wrong comparison that 'somebody' made. The 
difference is that this vulnerability is known and hacking a system 
often involves a new exploit that is unknown to the owners. A better 
comparison might be a house owner with a large fence around his house 
with spikes on top. One day a guy walks up to him and says: 'You know 
that large tree on your property, that has very long branches reaching 
over the fence. I was walking past that and though it might be a easy 
access to your property. I tried the largest low hanging branch and 
indeed it could easily support me.' After which the house owner calls 
the cops and have him arrested for breaking into his property.

> Consider for a moment the results of allowing people to hack first, and 
> then report the results of their hacking.  People who are hacking for 
> criminal reasons will, if caught, claim that as a defense.

Not necessary, the guy in question apparently had no criminal intentions 
and can prove that by notifying the sysop. If he had been caught in the 
act he would have had a serious problem.

I can understand your position, but I also know that there is a large 
group of systems that is not adequately protected. If the system will be 
hacked mostly third persons will suffer the consequences. Protecting the 
sysops with a law that prohibits hacking will increase the problem. A 
more balanced law would include:
- hacking is illegal
- reporting a hack to the sysop with a full disclosure of the 
vulnerability and a proof that no harm has been done during the hacking 
will result in dropping the case by the prosecution. (I don't know if 
that can be implemented in the US, we have a couple of such 
constructions within the Dutch system).
- prosecuting the sysops that fail to secure their systems. With 
different penalties for systems that can be used as e.g. zombie 
machines, machines containing privacy information, machines with 
financial information.
- prosecuting software companies that knowingly introduce vulnerabilities.

Hmm, this seems to be also the order of likeliness of implementation. 
The first is easy, no objection from large pressure groups, the second 
would imply that you educate judges and lawyers, the third will be 
opposed by small firms and the last one is impossible as that would lead 
to prosecution of MS and SONY, to name a few.

Post a reply to this message

On Sat, 13 Sep 2008 13:58:35 +0100, Doctor John <joh### [at] homecom> wrote:

>http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>
>Can't make my mind up on this; is the university right in prosecuting or 
>are they overreacting to cover their own insecure *ssh*les?
>Right now I'm leaning in the direction of overreacting but I'm willing 
>to be convinced otherwise
>
>John

I agree with "somebody".
Wrong is wrong, illegal is illegal no mater the intentions. As others have said
there are other ways to let people know if there is a security leak. Also
further education should not only teach technical subjects but some
understanding of morals as well. I think that some of the differences in answers
has to do with age and experience. Younger people often think that if they mean
no harm then they are doing no wrong. 
It is also up to the authorities what any punishment is due. Whether it is light
or heavy.
-- 

Regards
     Stephen

Post a reply to this message

On 13 Sep 2008 12:52:33 -0400, Warp <war### [at] tagpovrayorg> wrote:

>  Breaking into someone's home usually causes material damage which costs
>money. Breaking into a computer system usually doesn't.

Even if no material damage is done breaking into someone's (no relation) house
generally psychological damage is done.
-- 

Regards
     Stephen

Post a reply to this message

andrel <a_l### [at] hotmailcom> wrote:
> - prosecuting the sysops that fail to secure their systems.

  The prosecutor would have to prove that it was possible to secure the
system after the flaw was known by reasonable means.

> the last one is impossible as that would lead 
> to prosecution of MS and SONY, to name a few.

  AFAIR Sony has been prosecuted for their rootkit fiasco in many countries.

-- 
                                                          - Warp

Post a reply to this message

On 14-Sep-08 14:46, Stephen wrote:
> On Sat, 13 Sep 2008 13:58:35 +0100, Doctor John <joh### [at] homecom> wrote:
> 
>>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>>
>> Can't make my mind up on this; is the university right in prosecuting or 
>> are they overreacting to cover their own insecure *ssh*les?
>> Right now I'm leaning in the direction of overreacting but I'm willing 
>> to be convinced otherwise
>>
>> John
> 
> I agree with "somebody".
> Wrong is wrong, illegal is illegal no mater the intentions. As others have said
> there are other ways to let people know if there is a security leak. Also
> further education should not only teach technical subjects but some
> understanding of morals as well. I think that some of the differences in answers
> has to do with age and experience. Younger people often think that if they mean
> no harm then they are doing no wrong. 

And partly by cultural background. As a true Dutchman I am horrified by 
laws passed on good intentions and 'ethics'. You should pass laws that 
solve problems (preferably after identifying what the real problem is), 
not ones that are counterproductive.

Possibly the dividing line in this discussion is that on the one hand 
people argue that it is forbidden and others who argue that that law 
simply should not have existed in that way.

> It is also up to the authorities what any punishment is due. Whether it is light
> or heavy.

The case is in Canada so there may be some hope that the judgment is by 
authorities based on facts. I don't know the details of the Canadian system.

Post a reply to this message

Stephen <mcavoysAT@aoldotcom> wrote:
> Wrong is wrong, illegal is illegal no mater the intentions.

  Not all crimes have the same severity, and crimes can have mitigating
factors. It's not even uncommon for someone to not to be prosecuted even
though he broke the letter of the law, because the circustances were so
mitigating.

-- 
                                                          - Warp

Post a reply to this message

On 14 Sep 2008 09:14:54 -0400, Warp <war### [at] tagpovrayorg> wrote:

>Stephen <mcavoysAT@aoldotcom> wrote:
>> Wrong is wrong, illegal is illegal no mater the intentions.
>
>  Not all crimes have the same severity, and crimes can have mitigating
>factors. It's not even uncommon for someone to not to be prosecuted even
>though he broke the letter of the law, because the circustances were so
>mitigating.

This is true and in my opinion correct. John's question hangs on this point but
another aspect is; did the person in question "know" what he did was "wrong in
law" whether he agreed with the law or not.
-- 

Regards
     Stephen

Post a reply to this message

On Sun, 14 Sep 2008 15:15:41 +0200, andrel <a_l### [at] hotmailcom> wrote:


>> 
>> I agree with "somebody".
>> Wrong is wrong, illegal is illegal no mater the intentions. As others have said
>> there are other ways to let people know if there is a security leak. Also
>> further education should not only teach technical subjects but some
>> understanding of morals as well. I think that some of the differences in answers
>> has to do with age and experience. Younger people often think that if they mean
>> no harm then they are doing no wrong. 
>
>And partly by cultural background. As a true Dutchman I am horrified by 
>laws passed on good intentions and 'ethics'. You should pass laws that 
>solve problems (preferably after identifying what the real problem is), 
>not ones that are counterproductive.
>

We have a saying: "The road to Hell is paved with good intentions"

>Possibly the dividing line in this discussion is that on the one hand 
>people argue that it is forbidden and others who argue that that law 
>simply should not have existed in that way.
>
>> It is also up to the authorities what any punishment is due. Whether it is light
>> or heavy.
>
>The case is in Canada so there may be some hope that the judgment is by 
>authorities based on facts. I don't know the details of the Canadian system.

If it is based on facts then he is "guilty as charged" If it is based on
intentions then the spirit of the law can be taken into account.
-- 

Regards
     Stephen

Post a reply to this message

"andrel" <a_l### [at] hotmailcom> wrote in message
news:48C### [at] hotmailcom...
> On 14-Sep-08 5:43, John VanSickle wrote:
> > Doctor John wrote:
> >>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1

> > It is not substantively different from a situation where you live in an
> > apartment for which the landlord has failed to install adequate door
> > locks.  You cannot break into other people's apartments in order to
> > demonstrate the inadequacy of the existing security.  You tell the
> > landlord, advise the tenants, and if nothing happens, move out.

> It is the same sort of wrong comparison that 'somebody' made. The
> difference is that this vulnerability is known and hacking a system
> often involves a new exploit that is unknown to the owners. A better
> comparison might be a house owner with a large fence around his house
> with spikes on top. One day a guy walks up to him and says: 'You know
> that large tree on your property, that has very long branches reaching
> over the fence. I was walking past that and though it might be a easy
> access to your property. I tried the largest low hanging branch and
> indeed it could easily support me.' After which the house owner calls
> the cops and have him arrested for breaking into his property.

Good for him. I'd call the cops too. What's it his business entering my
property? "I was walking by" doesn't make sense either. Nobody walking by
"accidentally" climbs a tree. And if he was really concerned for my safety,
why not come point out to me the branch *without* violating the law?

That it was easy to do or that the owner failed to perfectly secure
something is not an excuse for breaking the law. Where do you draw the line?
If the guy had to use a ladder to get to a branch, would you then willing to
consider it a crime? If the guy had to use a helicopter to land on the tree
or the property, would you consider that a crime now? See, there are always
ways to compromise a property or a system if you have a criminal mind.
Unless the suspect can show that he went into the property by mistake during
his daily walk, and if the property owner did not draw a line around his
property, then I'd let him go. Otherwise, if he's made an effort to climb a
tree, use a ladder, use a helicopter... etc, it's clear what he intended to
break the law, clear and simple.

> > Consider for a moment the results of allowing people to hack first, and
> > then report the results of their hacking.  People who are hacking for
> > criminal reasons will, if caught, claim that as a defense.

> Not necessary, the guy in question apparently had no criminal intentions

What do you call breaking the law?

> I can understand your position, but I also know that there is a large
> group of systems that is not adequately protected. If the system will be
> hacked mostly third persons will suffer the consequences. Protecting the
> sysops with a law that prohibits hacking will increase the problem.

False dichotomy again. Why do you assume that the system will be hacked by a
third person? It's a matter of opportunity, means and motive, and not all
are present for anyone on the street. Clairvoyance defenses like that don't
work, and with good reason. If you see someone speeding down the street, are
you given a free pass to ram him? After all, he's going to get into an
accident, right? And it's better that at least the other side anticipates
the accident...

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cc0297@news.povray.org...
> somebody <x### [at] ycom> wrote:

> > >   A security hole report does not cause waking up the sysadmin in the
> > > middle of the night and paying overtime wages or taking the system
> > offline.

> > Really? If I send you an e-mail listing all your financial and
confidential
> > information, won't you

>   No, because I don't read my email in the middle of the night, while
> sleeping.

You should. If you did, you'd only waste the rest of your night. If you read
your e-mail in the morning and get my e-mail, you'll waste the rest of the
day.

> > >   It causes the sysadmin to send a report to the software house with
which
> > > they have a software license so that they will fix the security hole.
At
> > > regular working hours.

> > Not all systems are such turnkey operations, and the vendor won't
himself
> > have a fix for every type of security breach even if they were.

>   And thus it's better for the sysadmins *not* knowing about the security
> hole?

It's best for the sysadmins to have fixed the hole before anybody hacked the
system. Next best is for them knowing about the hole and nobody having
hacked the system. Next best is for them to not know about the hole and
nobody having hacked the system... etc.

You are using the psychic defense: If I didn't hack the system, someone more
malicious than I would, so I'm doing the sysadmins a favour. Sorry, that's a
ridiculous argument .

Yes, crimes sometimes can have positive after effects. Had someone had shot
the engineer of the passenger train that crashed in California that morning,
everything would have turned out better, no? But can we base our legal
systems on possibilities?

Post a reply to this message

On 14-Sep-08 16:50, somebody wrote:
> "andrel" <a_l### [at] hotmailcom> wrote in message
> news:48C### [at] hotmailcom...
>> On 14-Sep-08 5:43, John VanSickle wrote:
>>> Doctor John wrote:
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
> 
>>> It is not substantively different from a situation where you live in an
>>> apartment for which the landlord has failed to install adequate door
>>> locks.  You cannot break into other people's apartments in order to
>>> demonstrate the inadequacy of the existing security.  You tell the
>>> landlord, advise the tenants, and if nothing happens, move out.
> 
>> It is the same sort of wrong comparison that 'somebody' made. The
>> difference is that this vulnerability is known and hacking a system
>> often involves a new exploit that is unknown to the owners. A better
>> comparison might be a house owner with a large fence around his house
>> with spikes on top. One day a guy walks up to him and says: 'You know
>> that large tree on your property, that has very long branches reaching
>> over the fence. I was walking past that and though it might be a easy
>> access to your property. I tried the largest low hanging branch and
>> indeed it could easily support me.' After which the house owner calls
>> the cops and have him arrested for breaking into his property.
> 
> Good for him. I'd call the cops too. What's it his business entering my
> property? "I was walking by" doesn't make sense either. Nobody walking by
> "accidentally" climbs a tree. And if he was really concerned for my safety,
> why not come point out to me the branch *without* violating the law?

1) if the branch is weak enough there is no danger, so no need to call
2) as you failed to notice, I never said he entered the property. You 
(and my fictional character) assume that he did, just as the assumption 
in our case here is that the student was doing something malicious. (yes 
I come to that later)

> 
> That it was easy to do or that the owner failed to perfectly secure
> something is not an excuse for breaking the law. Where do you draw the line?
> If the guy had to use a ladder to get to a branch, would you then willing to
> consider it a crime? If the guy had to use a helicopter to land on the tree
> or the property, would you consider that a crime now? See, there are always
> ways to compromise a property or a system if you have a criminal mind.
> Unless the suspect can show that he went into the property by mistake during
> his daily walk, and if the property owner did not draw a line around his
> property, then I'd let him go. Otherwise, if he's made an effort to climb a
> tree, use a ladder, use a helicopter... etc, it's clear what he intended to
> break the law, clear and simple.
> 
>>> Consider for a moment the results of allowing people to hack first, and
>>> then report the results of their hacking.  People who are hacking for
>>> criminal reasons will, if caught, claim that as a defense.
> 
>> Not necessary, the guy in question apparently had no criminal intentions
> 
> What do you call breaking the law?

The student had apparently no intention to cause harm to the system or 
gain himself or anybody else anything by the act. The only reason you 
may call him a criminal is that there is a law there that should have 
been different. As a student you may excuse him for not yet knowing that 
some laws don't make sense and can be used in perverse ways. In this 
case a law that was intended to prosecute malicious hackers is misused 
to protect an incompetent sysop at the expense of a naive student.

Aside: I don't know about your place, but here we consider somebody 
innocent until proven to have broken the law.

>> I can understand your position, but I also know that there is a large
>> group of systems that is not adequately protected. If the system will be
>> hacked mostly third persons will suffer the consequences. Protecting the
>> sysops with a law that prohibits hacking will increase the problem.
> 
> False dichotomy again. Why do you assume that the system will be hacked by a
> third person? It's a matter of opportunity, means and motive, and not all
> are present for anyone on the street. Clairvoyance defenses like that don't
> work, and with good reason. If you see someone speeding down the street, are
> you given a free pass to ram him? After all, he's going to get into an
> accident, right? And it's better that at least the other side anticipates
> the accident...
> 
Either you did not understand what I said, or you have absolute no idea 
how the world works.

BTW I consider this discussion closed as far as I am concerned. I feel 
very uncomfortable talking to a 'somebody' with an e-mail address of 
'x### [at] ycom'. Feel free to start a new tread on anonymity in our newsgroups.

Post a reply to this message

somebody wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cc0297@news.povray.org...
>>   No, because I don't read my email in the middle of the night, while
>> sleeping.
> 
> You should. If you did, you'd only waste the rest of your night. If you
> read your e-mail in the morning and get my e-mail, you'll waste the rest
> of the day.

o_O

Are you seriously suggesting I should read my email in the middle of the
night just in case somebody mailed me with my financial information?

Post a reply to this message

John VanSickle wrote:
> and if nothing happens, move out.

And the problem remains unsolved.

Post a reply to this message

On Sun, 14 Sep 2008 17:40:37 +0200, andrel <a_l### [at] hotmailcom> wrote:

>
> I feel very uncomfortable talking to a 'somebody' with an e-mail address of 
>'x### [at] ycom'. Feel free to start a new tread on anonymity in our newsgroups.

I concur. 
-- 

Regards
     Stephen

Post a reply to this message

"Nicolas Alvarez" <nic### [at] gmailcom> wrote in message
news:48cd392c@news.povray.org...
> somebody wrote:
> > "Warp" <war### [at] tagpovrayorg> wrote in message
> > news:48cc0297@news.povray.org...

> >>   No, because I don't read my email in the middle of the night, while
> >> sleeping.

> > You should. If you did, you'd only waste the rest of your night. If you
> > read your e-mail in the morning and get my e-mail, you'll waste the rest
> > of the day.

> o_O
>
> Are you seriously

Well, you answered your own question there, didn't you?

> suggesting I should read my email in the middle of the
> night just in case somebody mailed me with my financial information?

Post a reply to this message

"andrel" <a_l### [at] hotmailcom> wrote in message
news:48C### [at] hotmailcom...
> On 14-Sep-08 16:50, somebody wrote:
> > "andrel" <a_l### [at] hotmailcom> wrote in message
> > news:48C### [at] hotmailcom...

> > Good for him. I'd call the cops too. What's it his business entering my
> > property? "I was walking by" doesn't make sense either. Nobody walking
by
> > "accidentally" climbs a tree. And if he was really concerned for my
safety,
> > why not come point out to me the branch *without* violating the law?

> 1) if the branch is weak enough there is no danger, so no need to call
> 2) as you failed to notice, I never said he entered the property. You
> (and my fictional character) assume that he did, just as the assumption
> in our case here is that the student was doing something malicious. (yes
> I come to that later)

But he did hack into the system and retrieve the passwords. If he didn't
enter the property, your analogy doesn't compute. If he did, then he did
violate the property rights. You cannot have your cake and eat it too.

> >> Not necessary, the guy in question apparently had no criminal
intentions

> > What do you call breaking the law?

> The student had apparently no intention to cause harm to the system or

So if I go over the speed limit but have no intention to get into an
accident, I can expect to avoid a ticket?

> gain himself or anybody else anything by the act. The only reason you
> may call him a criminal is that there is a law there that should have
> been different.

You can argue that the law is unfair (it would be a bad argument, granted,
but laws are of course not set in stone). But so long as it's there, it's by
definition, a crime to break it.

> As a student you may excuse him for not yet knowing that
> some laws don't make sense and can be used in perverse ways.

Ignorance of the law is (almost always) unacceptable as a defense. Too much
room for abuse.

> Aside: I don't know about your place, but here we consider somebody
> innocent until proven to have broken the law.

True, but I'm not the judge or the jury, nor are we sentencing him here. I
can express my opinion based on what I have read so far.

> BTW I consider this discussion closed as far as I am concerned. I feel
> very uncomfortable talking to a 'somebody' with an e-mail address of
> 'x### [at] ycom'.

That's an ad hominem. Somebody (else) might claim he doesn't feel
comfortable with people with hotmail accounts. Nonetheless, be it so.

Post a reply to this message

>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>
> Can't make my mind up on this; is the university right in prosecuting or 
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing to 
> be convinced otherwise

Seems to me like he installed some keyloggers and card readers and simply 
skimmed off log in information.  Then he actually admitted doing this to the 
university - very clever...

He should have sent the 16-page report to the university without actually 
performing the illegal acts or sending the document to 37 of his mates.  If 
they had refused to improve security, then he could have gone to the local 
student papers etc and kicked up a fuss.

Post a reply to this message

>  No, he spotted a technical security flaw in the computer system, and
> pointed it out so that it could be fixed,

But his mistake was to go several steps further, and actually "demonstrate" 
the security floor by installing keyloggers and magnetic card readers, then 
accessing 32 different student accounts illegally and sending his findings 
to 37 of his mates.  Had he just written the document and sent it to the 
university, fine.

Post a reply to this message

On 15-Sep-08 4:14, somebody wrote:
> 
>> BTW I consider this discussion closed as far as I am concerned. I feel
>> very uncomfortable talking to a 'somebody' with an e-mail address of
>> 'x### [at] ycom'.
> 
> That's an ad hominem. 

- no, that was the point it is an ad inhominem
- it is also not one because I tell you what I feel, without even 
suggesting that what you did would make your points less valuable.
- over the years there were a few cases of people here in the newsgroups 
that, like you, tried to discredit other people by accusing them of 
rhetoric tricks. It is my impression that that said more about 
themselves than of the addressed person. Just an observation.

> Somebody (else) might claim he doesn't feel
> comfortable with people with hotmail accounts. 

Not the best attempt to return a compliment that I have seen. FYI I use 
a hotmail account in newsgroups for obvious reasons. I am not hiding 
behind a fictitious address. I will answer e-mails sent to that address 
and it reflects even my name IRL.

> Nonetheless, be it so.

It is your choice. I think of this group as a group of (mostly) friends. 
Your choice sort of spoils that idea for me. Many people here use 
aliases and many use e-mail addresses that are either invalid or 
mangled. Yet, because they have a recognizable identity I can think of 
them as a human being. To me you're more a ghost than a human being. So 
again, it is absolutely your own choice on whether you want to be part 
of this group or not, but I (and perhaps others) might not respond to 
anything you say. (Obviously, I make an exception for this metadicussion.)

Post a reply to this message

"andrel" <a_l### [at] hotmailcom> wrote in message
news:48C### [at] hotmailcom...

> FYI I use
> a hotmail account in newsgroups for obvious reasons. I am not hiding
> behind a fictitious address.

What would the purpose of a legitimate (or legitimate looking) e-mail
address be if I don't wish to receive any e-mails?

> I will answer e-mails sent to that address
> and it reflects even my name IRL.

I don't care, so long as there aren't two "andrel"s to confuse. Avoiding
confusion to me is the only reason d'etre of a name or a handle.

> It is your choice. I think of this group as a group of (mostly) friends.
> Your choice sort of spoils that idea for me. Many people here use
> aliases and many use e-mail addresses that are either invalid or
> mangled. Yet, because they have a recognizable identity I can think of
> them as a human being. To me you're more a ghost than a human being.

I'm well aware that had I called myself "Sebastian", "Zippy", or even "mtu",
I would automatically command more respect. It's quite interesting, really.

> So
> again, it is absolutely your own choice on whether you want to be part
> of this group or not, but I (and perhaps others) might not respond to
> anything you say. (Obviously, I make an exception for this metadicussion.)

I prefer to discuss and challenge ideas, rather than get on a personal
level. To that end, a reduced audience is not a big problem.

Post a reply to this message

On 15-Sep-08 22:43, somebody wrote:
> "andrel" <a_l### [at] hotmailcom> wrote in message
> news:48C### [at] hotmailcom...
> 
>> FYI I use
>> a hotmail account in newsgroups for obvious reasons. I am not hiding
>> behind a fictitious address.
> 
> What would the purpose of a legitimate (or legitimate looking) e-mail
> address be if I don't wish to receive any e-mails?

none at all.

> 
>> I will answer e-mails sent to that address
>> and it reflects even my name IRL.
> 
> I don't care, so long as there aren't two "andrel"s to confuse. Avoiding
> confusion to me is the only reason d'etre of a name or a handle.

It may be something more than that. If you know that I am a real person 
with a real background (and not a group or a 15 yo pretending to be 
someone else) it may indicate that what I write is probably sincere and 
that I am not trolling.

>> It is your choice. I think of this group as a group of (mostly) friends.
>> Your choice sort of spoils that idea for me. Many people here use
>> aliases and many use e-mail addresses that are either invalid or
>> mangled. Yet, because they have a recognizable identity I can think of
>> them as a human being. To me you're more a ghost than a human being.
> 
> I'm well aware that had I called myself "Sebastian", "Zippy", or even "mtu",
> I would automatically command more respect. It's quite interesting, really.

I know, I find that interesting too. One of the factors seems to be that 
'somebody' invokes not the image of a specific person, but of one that 
deliberately hides everything personal. We all hide things, but 
'somebody' is advertising to want only to take and does not intend to 
share. You could have called yourself 'antisocial' of 'psychopath' but 
even that would not have the same effect as nobody would take that 
serious. Even 'nobody' would be different as we can take that as a 
reference that you at least know your classics. I can only assume that 
you chose this alias to get a certain effect. Well congratulations, you 
achieved your goal.

>> So
>> again, it is absolutely your own choice on whether you want to be part
>> of this group or not, but I (and perhaps others) might not respond to
>> anything you say. (Obviously, I make an exception for this metadicussion.)
> 
> I prefer to discuss and challenge ideas, rather than get on a personal
> level. To that end, a reduced audience is not a big problem.

Let's hope that makes sense to you.

Post a reply to this message

scott <sco### [at] scottcom> wrote:
> >  No, he spotted a technical security flaw in the computer system, and
> > pointed it out so that it could be fixed,

> But his mistake was to go several steps further, and actually "demonstrate" 
> the security floor by installing keyloggers and magnetic card readers, then 
> accessing 32 different student accounts illegally and sending his findings 
> to 37 of his mates.  Had he just written the document and sent it to the 
> university, fine.

  Yes, that caused tons of expensive damage, so he must be punished. That
will teach him to never tell about his hacking again. Next time he will
just hack and don't tell anyone. That way everybody will be happy.

-- 
                                                          - Warp

Post a reply to this message

somebody wrote:
> "Nicolas Alvarez" <nic### [at] gmailcom> wrote in message
> news:48cd392c@news.povray.org...
>> somebody wrote:
>> > You should. If you did, you'd only waste the rest of your night. If you
>> > read your e-mail in the morning and get my e-mail, you'll waste the
>> > rest of the day.
> 
>> o_O
>>
>> Are you seriously
> 
> Well, you answered your own question there, didn't you?
> 
>> suggesting I should read my email in the middle of the
>> night just in case somebody mailed me with my financial information?

Huh?!

Post a reply to this message

"Nicolas Alvarez" <nic### [at] gmailcom> wrote in message
news:48cef56a@news.povray.org...
> somebody wrote:
> > "Nicolas Alvarez" <nic### [at] gmailcom> wrote in message
> >> somebody wrote:

> >> > You should. If you did, you'd only waste the rest of your night. If
you
> >> > read your e-mail in the morning and get my e-mail, you'll waste the
> >> > rest of the day.

> >> o_O
> >>
> >> Are you seriously

> > Well, you answered your own question there, didn't you?

> Huh?!

I was of course not serious. Can one not indulge in non-emoticonated levity
any more?

Post a reply to this message

>> But his mistake was to go several steps further, and actually 
>> "demonstrate"
>> the security floor by installing keyloggers and magnetic card readers, 
>> then
>> accessing 32 different student accounts illegally and sending his 
>> findings
>> to 37 of his mates.  Had he just written the document and sent it to the
>> university, fine.
>
>  Yes, that caused tons of expensive damage, so he must be punished.

Would you be happy if your details had been sent to 37 of his mates?  I 
guess those 32 students that had their data published had to go and change 
all their details, and the university had to go and check all their accounts 
with them to see if there was anything on their debit cards that shouldn't 
have been.  SO yes, I'm sure a lot of people are having to waste a lot of 
time now that they shouldn't have done, and yes he should be punished so 
that others don't do the same.

> That
> will teach him to never tell about his hacking again.

No, that will teach him to actually go ahead and carry out an illegal 
security hack on 32 students, rather than informing the authorities about 
it.  How on Earth can you say that installing a disguised magnetic card 
reader to skim cards does not deserve to be punished?

Post a reply to this message

"scott" <sco### [at] scottcom> wrote in message
news:48cf65d4$1@news.povray.org...

> > That
> > will teach him to never tell about his hacking again.

> No, that will teach him to actually go ahead and carry out an illegal
> security hack on 32 students, rather than informing the authorities about
> it.  How on Earth can you say that installing a disguised magnetic card
> reader to skim cards does not deserve to be punished?

Forget punishment, that's not even the point. Warp and some others think
that *reporting* of the incident was wrong, and that the hacker should have
been rewarded instead, which is an order of magnitude harder to understand.

Post a reply to this message

> Forget punishment, that's not even the point. Warp and some others think
> that *reporting* of the incident was wrong, and that the hacker should 
> have
> been rewarded instead, which is an order of magnitude harder to 
> understand.

Yeh, I didn't really understand why Warp said:

"That will teach him to never tell about his hacking again."

When the *telling* about the security hole is not the problem, the problem 
is when he actually *did* the hacking on 32 students, and even much worse, 
distributed the data to lots of people (and not just the system owners).

I know for sure that I could install a keylogger on my colleagues computer 
and get his password.  Does that mean that I should be allowed to do it 
without permission from the system owners and send the results to my 
friends, "for the sake of improving security"?  Absolutely no way, not in a 
million years.

Post a reply to this message

somebody <x### [at] ycom> wrote:
> Warp and some others think
> that *reporting* of the incident was wrong,

  That's not what I have said. When I have said something like that it has
been pure sarcasm.

> and that the hacker should have
> been rewarded instead

  I never talked about rewards (except sarcastically), and that sentence
of yours doesn't even make sense with the firt one.

  You are badly twisting what I have said.

-- 
                                                          - Warp

Post a reply to this message

scott <sco### [at] scottcom> wrote:
> Yeh, I didn't really understand why Warp said:

> "That will teach him to never tell about his hacking again."

  Do you understand what the concept "sarcasm" means?

> I know for sure that I could install a keylogger on my colleagues computer 
> and get his password.  Does that mean that I should be allowed to do it 
> without permission from the system owners and send the results to my 
> friends, "for the sake of improving security"?  Absolutely no way, not in a 
> million years.

  And exactly what are you doing to prevent some malicious person from
doing so? Are you simply taking a "not my problem" stance?

-- 
                                                          - Warp

Post a reply to this message

"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cfc9e8@news.povray.org...
> somebody <x### [at] ycom> wrote:

> > Warp and some others think
> > that *reporting* of the incident was wrong,

>   That's not what I have said. When I have said something like that it has
> been pure sarcasm.

> > and that the hacker should have
> > been rewarded instead

>   I never talked about rewards (except sarcastically), and that sentence
> of yours doesn't even make sense with the firt one.
>
>   You are badly twisting what I have said.

At different times, you said

"No good deed goes unpunished."

"Finding a security weakness and then *not* exploiting it for your own
selfish purposes but instead reporting the weakness so that they will
patch it justifies it."

"Basically the situation is that the sysadmins *benefited* from the
hacking, and as a reward, the university sues the person who performed
the hacking."

...etc

If there's sarcasm, and there seems to be, it's in the opposite direction
(ie directed at the expense of the university administration, for their
"mishandling" of the situation). It's of course possible that I'm reading it
all wrong and you in fact believe that the hacker did a bad thing, in which
case I apologize and take back what I said, but interpreting those quotes as
something other than suggesting that he did a good deed, it was a favour to
sysadmins, and if anything, he should have been rewarded, sounds like a
stretch.

Post a reply to this message

>> I know for sure that I could install a keylogger on my colleagues 
>> computer
>> and get his password.  Does that mean that I should be allowed to do it
>> without permission from the system owners and send the results to my
>> friends, "for the sake of improving security"?  Absolutely no way, not in 
>> a
>> million years.
>
>  And exactly what are you doing to prevent some malicious person from
> doing so? Are you simply taking a "not my problem" stance?

Pretty much, yes, IT know the risk of the above and they have decided it's 
not worth doing anything extra, like putting bars on the windows, CCTV in 
all the offices, or reformatting the hard discs every night.  If I came 
across another security hole I didn't think they were aware of, of course I 
would inform them about it.

Like when someone nearly got their laptop stolen and I kept on about getting 
them all encrypted.  I didn't go and actually steal someones laptop then 
email confidential data to IT, I just informed them about the hole.  Now 
it's fixed and I didn't need to do anything illegal.

Post a reply to this message

scott <sco### [at] scottcom> wrote:
> IT know the risk of the above

  Well, that's one fundamental difference.

  What if you discovered a security hole which your IT staff doesn't know of?

-- 
                                                          - Warp

Post a reply to this message

somebody <x### [at] ycom> wrote:
> At different times, you said

> "No good deed goes unpunished."

  That's not the same thing as "his deed should have been rewarded".

> "Finding a security weakness and then *not* exploiting it for your own
> selfish purposes but instead reporting the weakness so that they will
> patch it justifies it."

  Still nothing about rewards.

> "Basically the situation is that the sysadmins *benefited* from the
> hacking, and as a reward, the university sues the person who performed
> the hacking."

  Sarcasm. Doesn't mean "they should have rewarded him with something
positive".

> If there's sarcasm, and there seems to be, it's in the opposite direction
> (ie directed at the expense of the university administration, for their
> "mishandling" of the situation).

  What I meant was that IMO the lawsuit was probably an exaggeration.

> It's of course possible that I'm reading it
> all wrong and you in fact believe that the hacker did a bad thing

  No, you said that in my opinion "the hacker should have been rewarded
instead". I never said anything like that.

-- 
                                                          - Warp

Post a reply to this message

>> IT know the risk of the above
>
>  Well, that's one fundamental difference.
>
>  What if you discovered a security hole which your IT staff doesn't know 
> of?

You should learn to read the whole post before replying ;-)

Post a reply to this message

Nicolas Alvarez wrote:
> John VanSickle wrote:
>> and if nothing happens, move out.
> 
> And the problem remains unsolved.

The person who does as I advise solves his own problem.  Believe it or 
not, you do not have the right to solve other people's problems; it is a 
privilege obtained with their consent.

Regards,
John

Post a reply to this message