 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
Can't make my mind up on this; is the university right in prosecuting or
are they overreacting to cover their own insecure *ssh*les?
Right now I'm leaning in the direction of overreacting but I'm willing
to be convinced otherwise
John
--
"Eppur si muove" - Galileo Galilei
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Doctor John <joh### [at] home com> wrote:
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
> Can't make my mind up on this; is the university right in prosecuting or
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing
> to be convinced otherwise
No good deed goes unpunished. (Although this is certainly not the worst
case of someone reporting security weaknesses to some company and getting
sued for it.)
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> No good deed goes unpunished. (Although this is certainly not the worst
> case of someone reporting security weaknesses to some company and getting
> sued for it.)
The trouble is, if you say "hey, your security is really weak, you
should fix it", people tend to not believe you. And if you walk up and
say "hey, your security is really weak, I just hacked all your systems",
they go "OMG, you're a hacker! DIE!!!"
There seems to be no way to win.
Of course, from the other side, *anybody* can walk up and claim that a
system is insecure. That doesn't necessarily mean they know what the
hell they're talking about. And if somebody breaks into your system, you
can either enjoy the bad publicity of having "poor security", or you can
sue the person, which makes them look like the bad guy, not you.
It's easier and cheaper to scapegoat somebody else than fix the problem...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbc7b9@news.povray.org...
> Doctor John <joh### [at] homecom> wrote:
> >
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
> > Can't make my mind up on this; is the university right in prosecuting or
> > are they overreacting to cover their own insecure *ssh*les?
> > Right now I'm leaning in the direction of overreacting but I'm willing
> > to be convinced otherwise
> No good deed goes unpunished. (Although this is certainly not the worst
> case of someone reporting security weaknesses to some company and getting
> sued for it.)
So it would be a good deed for me to break into neighbourhood houses (which
would be trivial, as practically all have unprotected ground level glass
windows) when the owner is away and place a note on the coffee table to tell
them their house is insecure.
Or, maybe it's a good deed worth a good samaritan medal to rob someone at
gunpoint, and when you get the money, to hand it back to them, saying that
you were demonstrating the point that they should not be walking alone at
that time of the day in that place.
*Reporting* a security weakness is a good deed. *Exploiting* a security
weaknes is a bad deed, even if followed by reporting.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48cbcbf6$1@news.povray.org...
> Warp wrote:
> > No good deed goes unpunished. (Although this is certainly not the
worst
> > case of someone reporting security weaknesses to some company and
getting
> > sued for it.)
> The trouble is, if you say "hey, your security is really weak, you
> should fix it", people tend to not believe you.
That's fine. Not everyone has to believe everything you say. You do a good
deed, and move on. You don't try to force things down other people's
throats, especially if doing so will also break the law.
> And if you walk up and
> say "hey, your security is really weak, I just hacked all your systems",
> they go "OMG, you're a hacker! DIE!!!"
The question you should be asking is, did anyone ask you to fix their
security in the first place? Spend your time and energy on things that there
is a demand for, not on things that you are unwelcome to do.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbc7b9@news.povray.org...
> Doctor John <joh### [at] homecom> wrote:
> >
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
> > Can't make my mind up on this; is the university right in prosecuting or
> > are they overreacting to cover their own insecure *ssh*les?
> > Right now I'm leaning in the direction of overreacting but I'm willing
> > to be convinced otherwise
> No good deed goes unpunished. (Although this is certainly not the worst
> case of someone reporting security weaknesses to some company and getting
> sued for it.)
And one more thing to say on the subject: Why is it that people think the
ease by which one can commit a cybercrime justifies it? That doesn't work
like that in real life. Nobody gives the excuse "Well officer, sure I was
doing 200 mph, but see, that's a security flaw in the system. The car or the
road should not allow me to depress that lever that hard". It's ridiculously
easy in real life to commit crimes. Pretty much *everything* is insecure. I
would walk with thousands of dollars worth of goods just strolling around a
market or a mall with open displays. No shop owner is required to keep their
wares under lock in all times in order to be able to charge a thief. It's
understood that it's their goods, they own it. Well, university records are
property of the institution, I don't think the hacker could possibly be
confused on that matter. And it's not like the hacker accidentally came
across them in his browsing, he had a clear intent to break in and worked at
it.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 wrote:
> Warp wrote:
>
>> No good deed goes unpunished. (Although this is certainly not the worst
>> case of someone reporting security weaknesses to some company and getting
>> sued for it.)
Agreed, the "shoot-the-messenger" mind-set seems to be endemic
> The trouble is, if you say "hey, your security is really weak, you
> should fix it", people tend to not believe you. And if you walk up and
> say "hey, your security is really weak, I just hacked all your systems",
> they go "OMG, you're a hacker! DIE!!!"
>
> There seems to be no way to win.
>
> Of course, from the other side, *anybody* can walk up and claim that a
> system is insecure. That doesn't necessarily mean they know what the
> hell they're talking about. And if somebody breaks into your system, you
> can either enjoy the bad publicity of having "poor security", or you can
> sue the person, which makes them look like the bad guy, not you.
>
> It's easier and cheaper to scapegoat somebody else than fix the problem...
>
My problem here is that the young hacker in question seems to have been
naive rather than malicious.
1. Hacking the system without permission is not legal.
2. Pointing out the vulnerabilities (and taking the time
to compile a report) is helpful.
3. Actually producing and printing out the list of user
passwords was probably overkill.
IMO what the lad should have done was to offer to demonstrate the
vulnerabilities whilst their techies were present.
Of course, he may have already tried going down that route but was
turned down in which case he turned to the course of hacking the system
to get attention. I suppose that will presented in his defence if the
case actually gets to court.
My advice to Carleton, drop the charges and talk to the student. Point
out the error of hacking a system without permission but thank him for
helping to ensure the system is now secured. (I assume they have patched
the holes :-) )
BTW Look at the guy's name. I trust this is not another "war-on-terror"
overreaction.
John
--
"Eppur si muove" - Galileo Galilei
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> The question you should be asking is, did anyone ask you to fix their
> security in the first place? Spend your time and energy on things that there
> is a demand for, not on things that you are unwelcome to do.
It's exactly that kind of bastard mentality that causes all the
ridiculous lawsuits.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> *Reporting* a security weakness is a good deed. *Exploiting* a security
> weaknes is a bad deed, even if followed by reporting.
Now please explain to us the exact means by which you will know the
security weakness without actually testing it. You will consult a
psychic? Or read it from tarot cards? Maybe you will see a vision
while you are on an LSD trip. Or perhaps you will use telepathy to
read the minds of the programmers who created the system, study their
code and then find the weakness. Yeah, that will work.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> And one more thing to say on the subject: Why is it that people think the
> ease by which one can commit a cybercrime justifies it?
Finding a security weakness and then *not* exploiting it for your own
selfish purposes but instead reporting the weakness so that they will
patch it justifies it.
The other alternative is that you will not report it (for the fear of
a lawsuit) and then a malicious hacker will find it and exploit it for
malicious purposes. And then everyone is happy?
> And it's not like the hacker accidentally came
> across them in his browsing, he had a clear intent to break in and worked at
> it.
Oh, right. If you accidentally find a weakness and report it, that's
just ok, but if you intentionally try to find weaknesses in order to
report them, you should go to jail. That makes sense.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> somebody <x### [at] ycom> wrote:
>> The question you should be asking is, did anyone ask you to fix their
>> security in the first place? Spend your time and energy on things that there
>> is a demand for, not on things that you are unwelcome to do.
>
> It's exactly that kind of bastard mentality that causes all the
> ridiculous lawsuits.
Indeed. And, um, isn't this a *student* we're talking about? Presumably
he wanted his uni to fix their security so his own details didn't get
stolen? I know *I* would!
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody wrote:
> So it would be a good deed for me to break into neighbourhood houses (which
> would be trivial, as practically all have unprotected ground level glass
> windows) when the owner is away and place a note on the coffee table to tell
> them their house is insecure.
Well, no, because fixing a broken window costs money.
You can "break into" a computer system without causing damage that has
to be repaired.
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbd6b6@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > *Reporting* a security weakness is a good deed. *Exploiting* a security
> > weaknes is a bad deed, even if followed by reporting.
> Now please explain to us the exact means by which you will know the
> security weakness without actually testing it. You will consult a
> psychic? Or read it from tarot cards? Maybe you will see a vision
> while you are on an LSD trip. Or perhaps you will use telepathy to
> read the minds of the programmers who created the system, study their
> code and then find the weakness. Yeah, that will work.
Do you break into your neighbour's houses to "test" their security
weaknesses? To answer your question, that's so easy that I'm surprised you
cannot see the solution: You get permission (and probably supervision)
before testing other people's systems security flaws. You don't go around
breaking into other people's systems to prove your machismo, and more than
you go around breaking into other people's homes.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody wrote:
> And one more thing to say on the subject: Why is it that people think the
> ease by which one can commit a cybercrime justifies it?
I don't think anybody does.
> No shop owner is required to keep their
> wares under lock in all times in order to be able to charge a thief.
No, but you know what? Their wares usually have somebody standing over
them to protect them. I rather suspect that if you just took some stuff
and left it unattended in the middle of the street and then tried to
prosecute the guy who stole it, you wouldn't get very far.
It's not that you have to make theft "impossible", but you have to make
*some* kind of effort.
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbd79c@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > And one more thing to say on the subject: Why is it that people think
the
> > ease by which one can commit a cybercrime justifies it?
> Finding a security weakness and then *not* exploiting it for your own
> selfish purposes but instead reporting the weakness so that they will
> patch it justifies it.
If the end justifies the means, am I to assume you also agree that breaking
into people's homes to expose their security flaws and pretend-robbing
people at gunpoint to expose their unprotectedness are also just dandy, and
moreover a good deed, provided you don't actually steal anything?
> The other alternative is that you will not report it (for the fear of
> a lawsuit) and then a malicious hacker will find it and exploit it for
> malicious purposes. And then everyone is happy?
Then, the alternative to above scenarios is that a psycho will find about
the lack of secutiry in a home and slaughert all the family, and that a gun
wielding coke addict will shoot the person in the head to steal his wallet.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48cbdc9b$1@news.povray.org...
> somebody wrote:
> > So it would be a good deed for me to break into neighbourhood houses
(which
> > would be trivial, as practically all have unprotected ground level glass
> > windows) when the owner is away and place a note on the coffee table to
tell
> > them their house is insecure.
> Well, no, because fixing a broken window costs money.
And it doesn't cost money to fix a compromised system?
> You can "break into" a computer system without causing damage that has
> to be repaired.
OK, assume I only go into houses that have windows that are ajar, or that I
leave money for the window repair, or that I pick the lock instead... etc.
You are objecting to irrelevant non-issues.
What about the pretend-robbery on the street? That doesn't cost any money.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48cbdeca@news.povray.org...
> somebody wrote:
> > And one more thing to say on the subject: Why is it that people think
the
> > ease by which one can commit a cybercrime justifies it?
> I don't think anybody does.
I do think many do.
> > No shop owner is required to keep their
> > wares under lock in all times in order to be able to charge a thief.
> No, but you know what? Their wares usually have somebody standing over
> them to protect them.
No, not really. There's a whole bunch of clothes, shoes, ... etc sitting on
racks on the outside of the store by the door. All the salespeople are
inside and none of them can see the street. They are completely unprotected
and insecure. I think I'll help myself to a new outfit.
> I rather suspect that if you just took some stuff
> and left it unattended in the middle of the street and then tried to
> prosecute the guy who stole it, you wouldn't get very far.
University system is hardly "the middle of the street". It's obviously not
abandoned or refuse. There's no question whatsoever about who owns the
system or the data.
> It's not that you have to make theft "impossible", but you have to make
> *some* kind of effort.
That he used a keylogger means the university did make some kind of an
effort. Any security system can be compromised if you try hard enough. At
worst, you pay $4.95 and a packet of bubble gum to a user (I don't remember
the link now but there was a study on how alarmingly willing employees were
in exposing confidential business information, passwords... etc). But
bribing itself is still a crime, no matter how little of a bribe you were
able to get away with.
Again, the point is, if you break the law, you are a criminal, regardless of
how easy it was to break the law. I can go to a random person on the street
and punch him in the face with no trouble whatsoever. Do you think the
defense that he wasn't wearing a motorcycle helmet will fly in court?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbd5e0@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > The question you should be asking is, did anyone ask you to fix their
> > security in the first place? Spend your time and energy on things that
there
> > is a demand for, not on things that you are unwelcome to do.
> It's exactly that kind of bastard mentality that causes all the
> ridiculous lawsuits.
No, it's the type of mentality that keeps a civilized society running. If
the society approved of people who sought to fix the problems they perceived
on others their own way, we would go back to lawlessness and every man fend
for himself.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Well, no, because fixing a broken window costs money.
>
> And it doesn't cost money to fix a compromised system?
Depends how it was compromised, doesn't it?
>> You can "break into" a computer system without causing damage that has
>> to be repaired.
>
> OK, assume I only go into houses that have windows that are ajar, or that I
> leave money for the window repair, or that I pick the lock instead... etc.
If you tell somebody "hey, your window is ajar", they'll believe you.
If you tell somebody "hey, your computer system is insecure", it's
unfortunately rather unlikely that they'll believe you.
Now if some guy wanders round randomly trying to break into systems,
then yes, that's not really acceptable and they deserve to be convicted
with something. But if you tell somebody their system is insecure and
they fail to do anything about it... what else are you supposed to do? I
mean, if it has no impact on you, then fine. But if that system holds
data about you, presumably you'd *like* it to be nice and secure.
(Obviously, I don't know which of those two scenarious was actually the
case in this particular story. Presumably the court case will decide.)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Orchid XP v8" <voi### [at] devnull> wrote in message
news:48cbe6bb$1@news.povray.org...
> >> Well, no, because fixing a broken window costs money.
> > And it doesn't cost money to fix a compromised system?
> Depends how it was compromised, doesn't it?
There are many costs (including waking up the sys-admin in the middle of the
night and paying overtime wages, or taking the system offline for a while
and inconvenience legitimate users) with any systems attack. It's naive to
assume it's all bits and bytes so no physical harm is possible.
> >> You can "break into" a computer system without causing damage that has
> >> to be repaired.
> > OK, assume I only go into houses that have windows that are ajar, or
that I
> > leave money for the window repair, or that I pick the lock instead...
etc.
> If you tell somebody "hey, your window is ajar", they'll believe you.
What's this obsession with convincing people of something? Anyway, moving
on...
> If you tell somebody "hey, your computer system is insecure", it's
> unfortunately rather unlikely that they'll believe you.
Question: If you have not already hacked into the system, how do you know if
it's not secure?
> Now if some guy wanders round randomly trying to break into systems,
> then yes, that's not really acceptable and they deserve to be convicted
Ah. So since this guy presumably did not design the system himself, he'd not
know if it's secure or not. Like you yourself mentioned, as well as Warp
mentioned in another post, it's not like looking at a window that's ajar.
So, by your admission, "wandering round randomly trying to break into
systems" is precisely what he must have been doing. And by your conclusion,
"that's not really acceptable and they deserve to be convicted".
> with something. But if you tell somebody their system is insecure and
> they fail to do anything about it... what else are you supposed to do? I
> mean, if it has no impact on you, then fine. But if that system holds
> data about you, presumably you'd *like* it to be nice and secure.
What happened to good old method of communication?
> (Obviously, I don't know which of those two scenarious was actually the
> case in this particular story. Presumably the court case will decide.)
True. But regardless, it's a crime. And I'm tempted to think that he did not
contact and try to communicate with the sys-admin first. I don't know of
many hacker who do that before hacking.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cbd5e0@news.povray.org...
> > somebody <x### [at] ycom> wrote:
> > > The question you should be asking is, did anyone ask you to fix their
> > > security in the first place? Spend your time and energy on things that
> there
> > > is a demand for, not on things that you are unwelcome to do.
> > It's exactly that kind of bastard mentality that causes all the
> > ridiculous lawsuits.
> No, it's the type of mentality that keeps a civilized society running. If
> the society approved of people who sought to fix the problems they perceived
> on others their own way, we would go back to lawlessness and every man fend
> for himself.
Wait a minute. You are talking as if this person had pointed out what
he thought was a personality flaw on someone and got scolded because of
being impolite.
No, he spotted a technical security flaw in the computer system, and
pointed it out so that it could be fixed, so that the system would be
more secure for everyone (for the university, the students and himself).
Sure, he was actively searching for flaws, but his intention clearly were
not malicious. There would thus be two options:
1) He "obeys the law", doesn't try to hack the system, the security flaws
get unnoticed, and at some point a malicious cracker will exploit the
system because it was never fixed. The malicious cracker is probably from
southern Asia or eastern Europe or whatever, will never get caught and
will never get punished, and if he made serious damage to the system
both the university and the students will suffer from this. The only one
who wins in this situation is the malicious cracker.
2) He searches for security flaws because it's his hobby, and if he finds
one, he reports it so that it will get fixed. If it gets fixed, luckily
no crackers will ever exploit the flaw, and the data will be secure and
nobody will suffer. Except for this person who made the report. The only
loser in this situation is the one who helped finding the security hole.
This will teach him a lesson: Next time he will *not* report any flaws
he finds, so they will not get fixed, and we are back at option 1.
And the world is again a better place to live.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> You get permission (and probably supervision)
> before testing other people's systems security flaws. You don't go around
> breaking into other people's systems to prove your machismo, and more than
> you go around breaking into other people's homes.
A student goes to the university directors and asks permission to try
to hack the system? Haha!
This would only lead for the security flaw to never be found and fixed.
Well, not until a malicious cracker exploits it first.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> > Well, no, because fixing a broken window costs money.
> And it doesn't cost money to fix a compromised system?
The person who hacked into the system didn't cause the flaw. The flaw
is there regardless. The only difference is whether it's a known flaw
or not.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> > Finding a security weakness and then *not* exploiting it for your own
> > selfish purposes but instead reporting the weakness so that they will
> > patch it justifies it.
> If the end justifies the means, am I to assume you also agree that breaking
> into people's homes to expose their security flaws and pretend-robbing
> people at gunpoint to expose their unprotectedness are also just dandy, and
> moreover a good deed, provided you don't actually steal anything?
Yes, those two things are completely equivalent.
Breaking into someone's home usually causes material damage which costs
money. Breaking into a computer system usually doesn't.
Breaking into someone's home exploits a security flaw which everyone
*already knows*. There's nothing to prove. It's up to the owner of the
house to decide whether he wants to fix it or not. Breaking into a computer
system exploits a flaw which is *not known* by the system administrators.
Such discovered security holes are usually patched as soon as possible
(only stupid sysadmins would ignore such a security hole).
Upgrading the security of a house is expensive. Security upgrades of
a computer system are usually part of the software license (ever heard
of free security patches?)
A malicious robber breaking into a house causes damage to the owner
of that house only. A malicious hacker breaking into a university computer
can potentially cause damage to thousands of people.
Yes, I see how these two situations are completely comparable to each
other.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbee4f@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > > Well, no, because fixing a broken window costs money.
> > And it doesn't cost money to fix a compromised system?
> The person who hacked into the system didn't cause the flaw. The flaw
> is there regardless. The only difference is whether it's a known flaw
> or not.
The act of hacking incurs a cost. I gave some examples in another post.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> There are many costs (including waking up the sys-admin in the middle of the
> night and paying overtime wages, or taking the system offline for a while
> and inconvenience legitimate users) with any systems attack.
A security hole report does not cause wakin gup the sysadmin in the
middle of the night and paying overtime wages or taking the system offline.
It causes the sysadmin to send a report to the software house with which
they have a software license so that they will fix the security hole. At
regular working hours.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbefd0@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > > Finding a security weakness and then *not* exploiting it for your
own
> > > selfish purposes but instead reporting the weakness so that they will
> > > patch it justifies it.
> > If the end justifies the means, am I to assume you also agree that
breaking
> > into people's homes to expose their security flaws and pretend-robbing
> > people at gunpoint to expose their unprotectedness are also just dandy,
and
> > moreover a good deed, provided you don't actually steal anything?
> Yes, those two things are completely equivalent.
>
> Breaking into someone's home usually causes material damage which costs
> money. Breaking into a computer system usually doesn't.
You can break into a house without costing material damage. Ever head of
picking locks? Does that legitimize it?
> Breaking into someone's home exploits a security flaw which everyone
> *already knows*.
No. Do you know how secure your lock is? Do you know how long it takes to
pick it? I'm doing you a service by demonstrating how easy it is.
> There's nothing to prove.
Ah, that's the crux of the matter: A hacker proves his superiority!
> It's up to the owner of the
> house to decide whether he wants to fix it or not. Breaking into a
computer
> system exploits a flaw which is *not known* by the system administrators.
Whether it's known or not known or in the process of being fixed or not is
completely irrelevant. Hacking is a crime, same as lockpicking without
owner's consent.
If the admins invited him to hack, that would be fine. As it is if you
invite a locksmith to pick your lock.
> Upgrading the security of a house is expensive. Security upgrades of
> a computer system are usually part of the software license (ever heard
> of free security patches?)
Again, completely immaterial how expensive or cheap it is to fix something.
Having said that, it's not necessarily cheap to fix security flaws either.
> A malicious robber breaking into a house causes damage to the owner
> of that house only. A malicious hacker breaking into a university computer
> can potentially cause damage to thousands of people.
That makes no sense whatsover. If anything, you are legitimizing breaking
into institutions instead of houses. Maybe I should change my example to
breaking into a business, a hospital, a school, a military bases... etc. I'm
sure courts will then give me even bigger medals of honour for doing the
public a service which affects many more people.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbfe62@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > There are many costs (including waking up the sys-admin in the middle of
the
> > night and paying overtime wages, or taking the system offline for a
while
> > and inconvenience legitimate users) with any systems attack.
> A security hole report does not cause wakin gup the sysadmin in the
> middle of the night and paying overtime wages or taking the system
offline.
Really? If I send you an e-mail listing all your financial and confidential
information, won't you be wasting the rest of your day frantically calling
every bank, agency, government institution, and business to inform them to
disable your cards, change numbers, accounts... etc? In the meantime, you
won't have access to those things. Now consider confidential information of
thousands of students and do the math. Everything has a cost. Even if fixing
the system doesn't cost money (hah, in a dream world!), major damage is done
with any such reckless act.
> It causes the sysadmin to send a report to the software house with which
> they have a software license so that they will fix the security hole. At
> regular working hours.
Not all systems are such turnkey operations, and the vendor won't himself
have a fix for every type of security breach even if they were.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cbee01@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > You get permission (and probably supervision)
> > before testing other people's systems security flaws. You don't go
around
> > breaking into other people's systems to prove your machismo, and more
than
> > you go around breaking into other people's homes.
> A student goes to the university directors and asks permission to try
> to hack the system? Haha!
What's wrong with that? If he makes a good case, he has a good chance of
being taken seriously. And if not, and if he's really obsessed, he can
suggest that he will hack regardless and give them the option to keep it
clean and under wraps. I don't recommend such borderline blackmail, but even
that is still better than committing a more serious and costly crime.
> This would only lead for the security flaw to never be found and fixed.
You are guessing.
> Well, not until a malicious cracker exploits it first.
Again, that's a guess.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> > A security hole report does not cause waking up the sysadmin in the
> > middle of the night and paying overtime wages or taking the system
> offline.
> Really? If I send you an e-mail listing all your financial and confidential
> information, won't you
No, because I don't read my email in the middle of the night, while
sleeping.
> be wasting the rest of your day frantically calling
> every bank, agency, government institution, and business to inform them to
> disable your cards, change numbers, accounts... etc? In the meantime, you
> won't have access to those things. Now consider confidential information of
> thousands of students and do the math. Everything has a cost. Even if fixing
> the system doesn't cost money (hah, in a dream world!), major damage is done
> with any such reckless act.
So basically if the sysadmin is kept ignorant of the security hole,
no extra money is wasted and everybody is happy (but the security hole
goes unnoticed and unfixed). Apparently this is the desirable thing,
according to you.
> > It causes the sysadmin to send a report to the software house with which
> > they have a software license so that they will fix the security hole. At
> > regular working hours.
> Not all systems are such turnkey operations, and the vendor won't himself
> have a fix for every type of security breach even if they were.
And thus it's better for the sysadmins *not* knowing about the security
hole?
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> > There's nothing to prove.
> Ah, that's the crux of the matter: A hacker proves his superiority!
No, the hacker proves that there's a concrete security hole which
should be fixed.
> If the admins invited him to hack, that would be fine. As it is if you
> invite a locksmith to pick your lock.
So as long as he didn't ask permission it's better that the sysadmins
are kept ignorant of the security flaw in the system.
Basically the situation is that the sysadmins *benefited* from the
hacking, and as a reward, the university sues the person who performed
the hacking.
> > Upgrading the security of a house is expensive. Security upgrades of
> > a computer system are usually part of the software license (ever heard
> > of free security patches?)
> Again, completely immaterial how expensive or cheap it is to fix something.
> Having said that, it's not necessarily cheap to fix security flaws either.
Which is not the fault of the hacker, really. He shouldn't be punished
because fixing a security hole (which was not created by the hacker) is
expensive to fix.
> > A malicious robber breaking into a house causes damage to the owner
> > of that house only. A malicious hacker breaking into a university computer
> > can potentially cause damage to thousands of people.
> That makes no sense whatsover. If anything, you are legitimizing breaking
> into institutions instead of houses. Maybe I should change my example to
> breaking into a business, a hospital, a school, a military bases... etc. I'm
> sure courts will then give me even bigger medals of honour for doing the
> public a service which affects many more people.
No. If you break into a big institution and then make a report on how
you did it and which flaws you exploited, the institution will benefit
from it (because they will be able to fix those flaws), and you will be
rewarded with jailtime.
Of course nobody breaks into institutions for the sole reason of
reporting how he did it. Too much work for no benefit.
Hacking a computer, however, is a hobby.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cc040e@news.povray.org...
> Basically the situation is that the sysadmins *benefited* from the
> hacking,
Hardly. They'll likely get into trouble themselves, if not fired. You may
think that's justified since they didn't do a perfect job, but it's
disingenuous to present the hacker as the victim and everyone else as
ungrateful beneficiaries.
[...]
> Hacking a computer, however, is a hobby.
Everyone's entitled to their own opinions, but it's this type of thinking
that glorifies something that which in actuality is a crime.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody a écrit :
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cc040e@news.povray.org...
>> Hacking a computer, however, is a hobby.
>
> Everyone's entitled to their own opinions, but it's this type of thinking
> that glorifies something that which in actuality is a crime.
>
Besides, that's hardly a justification. Martial arts are one of my
hobbies, and yet I don't go attacking people randomly just to prove them
that their self-defence training is lacking... Even without causing
significant harm (which would be possible) it would be illegal and
normally prosecuted without any discussion of this sort happening.
--
Vincent
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cc040e@news.povray.org...
> > Basically the situation is that the sysadmins *benefited* from the
> > hacking,
> Hardly. They'll likely get into trouble themselves, if not fired.
Why would they get fired?
> > Hacking a computer, however, is a hobby.
> Everyone's entitled to their own opinions, but it's this type of thinking
> that glorifies something that which in actuality is a crime.
Perhaps you understood incorrectly my sentence. "Hobby" did have a
completely neutral meaning in it.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Vincent Le Chevalier <gal### [at] libertyallsurfspamfr> wrote:
> somebody a écrit :
> > "Warp" <war### [at] tagpovrayorg> wrote in message
> > news:48cc040e@news.povray.org...
> >> Hacking a computer, however, is a hobby.
> >
> > Everyone's entitled to their own opinions, but it's this type of thinking
> > that glorifies something that which in actuality is a crime.
> Besides, that's hardly a justification.
I didn't say it as a justification. Put it in the original context
of my post, rather than taking that one sentence alone.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"Warp" <war### [at] tagpovrayorg> wrote in message
news:48cc1a36@news.povray.org...
> somebody <x### [at] ycom> wrote:
> > "Warp" <war### [at] tagpovrayorg> wrote in message
> > > Hacking a computer, however, is a hobby.
> > Everyone's entitled to their own opinions, but it's this type of
thinking
> > that glorifies something that which in actuality is a crime.
> Perhaps you understood incorrectly my sentence. "Hobby" did have a
> completely neutral meaning in it.
That's my point, calling it a hobby gives a legitimizing impresion. Hacking
into other people's systems can no longer be called a hobby than robbing
banks can. It's not neutral, it carries a criminal element. Why is it so
hard to understand that certain "bit and bytes" can fall into "other
people's property" category? It's their system, their data. You have no
right whatsoever, even with good intentions, to violate their property.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody <x### [at] ycom> wrote:
> That's my point, calling it a hobby gives a legitimizing impresion.
You still misunderstand my sentence (on its context). Probably on
purpose. You are sticking to one word I used, rather than trying to
aknowledge what I meant with the whole post.
Fine, if that's the best argument you can come up with, so be it.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Doctor John nous illumina en ce 2008-09-13 08:58 -->
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>
>
> Can't make my mind up on this; is the university right in prosecuting or
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing
> to be convinced otherwise
>
> John
>
That guy acted as a "troubleshooter".
What he did was:
I enter your system.
I tell you hwo I did it.
I tell you what the vulnerability is or are.
I tell you HOW to correct the vulnerability I used.
If you act correctly, the result is a safer system, with one or several less
vulnerability.
If you act foolishly, you procecute the guy, you do nothing about the flaws he
showed you, and your system is still at least as vulnerable as before.
--
Alain
-------------------------------------------------
You know you've been raytracing too long when...
you ever saw a beautiful scenery and regretted not to take your 6" reflective
ball and a digital camera, thinking "this would have been a perfect light probe"
-Johnny D
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody nous illumina en ce 2008-09-13 12:10 -->
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cbd5e0@news.povray.org...
>> somebody <x### [at] ycom> wrote:
>
>>> The question you should be asking is, did anyone ask you to fix their
>>> security in the first place? Spend your time and energy on things that
> there
>>> is a demand for, not on things that you are unwelcome to do.
>
>> It's exactly that kind of bastard mentality that causes all the
>> ridiculous lawsuits.
>
> No, it's the type of mentality that keeps a civilized society running. If
> the society approved of people who sought to fix the problems they perceived
> on others their own way, we would go back to lawlessness and every man fend
> for himself.
>
>
In everydays life, you're right... mostly. When you stumble on something wrong,
you are bound to report it to someone competent on the mather, or correct it
yourself if you are abilited or competent to do so. If you search for something
wrong, for any reason, and find something, you must act about it.
In computer world, we NEED hackers to find and report flaws. Why do you think
patches are isued for every OSs and most applications? Only because some hackers
hunted for flaws and put them under the noses of devlopers. In the computer
world, hackers are our private investigators. Many hackers are now paid workers
at various software firms and security agencies. Calling every hackers
"criminal" is insanely gross over symplification. It all depend on why he hack,
and what he does after the hacking.
--
Alain
-------------------------------------------------
Don't kiss an elephant on the lips today.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
somebody wrote:
> "Warp" <war### [at] tagpovrayorg> wrote in message
> news:48cbee01@news.povray.org...
>> somebody <x### [at] ycom> wrote:
>
>> This would only lead for the security flaw to never be found and fixed.
>
> You are guessing.
>
No more so, given the evidence of how such things "always" lead, than
"guessing" that the odds of rolling a seven with two six sided dice is
likely to be higher than rolling a 12.
--
void main () {
If Schrödingers_cat is alive or version > 98 {
if version = "Vista" {
call slow_by_half();
call DRM_everything();
}
call functional_code();
}
else
call crash_windows();
}
<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models,
3D Content, and 3D Software at DAZ3D!</A>
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Doctor John wrote:
>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>
>
> Can't make my mind up on this; is the university right in prosecuting or
> are they overreacting to cover their own insecure *ssh*les?
> Right now I'm leaning in the direction of overreacting but I'm willing
> to be convinced otherwise
The university is acting within its rights. There were other ways of
drawing attention to the problem other than breaking the law. Notifying
the security people risk, and then their non-IT bosses, are prudent
steps, and I see no indication that the student did this *prior* to his
own hacking.
Granted, you cannot *prove* that the vulnerability is real without
making a successful penetration, but that really is beside the point.
It is not substantively different from a situation where you live in an
apartment for which the landlord has failed to install adequate door
locks. You cannot break into other people's apartments in order to
demonstrate the inadequacy of the existing security. You tell the
landlord, advise the tenants, and if nothing happens, move out.
Consider for a moment the results of allowing people to hack first, and
then report the results of their hacking. People who are hacking for
criminal reasons will, if caught, claim that as a defense.
Regards,
John
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 14-Sep-08 5:43, John VanSickle wrote:
> Doctor John wrote:
>>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>>
>>
>> Can't make my mind up on this; is the university right in prosecuting
>> or are they overreacting to cover their own insecure *ssh*les?
>> Right now I'm leaning in the direction of overreacting but I'm willing
>> to be convinced otherwise
>
> The university is acting within its rights. There were other ways of
> drawing attention to the problem other than breaking the law. Notifying
> the security people risk, and then their non-IT bosses, are prudent
> steps, and I see no indication that the student did this *prior* to his
> own hacking.
>
> Granted, you cannot *prove* that the vulnerability is real without
> making a successful penetration, but that really is beside the point.
>
> It is not substantively different from a situation where you live in an
> apartment for which the landlord has failed to install adequate door
> locks. You cannot break into other people's apartments in order to
> demonstrate the inadequacy of the existing security. You tell the
> landlord, advise the tenants, and if nothing happens, move out.
It is the same sort of wrong comparison that 'somebody' made. The
difference is that this vulnerability is known and hacking a system
often involves a new exploit that is unknown to the owners. A better
comparison might be a house owner with a large fence around his house
with spikes on top. One day a guy walks up to him and says: 'You know
that large tree on your property, that has very long branches reaching
over the fence. I was walking past that and though it might be a easy
access to your property. I tried the largest low hanging branch and
indeed it could easily support me.' After which the house owner calls
the cops and have him arrested for breaking into his property.
> Consider for a moment the results of allowing people to hack first, and
> then report the results of their hacking. People who are hacking for
> criminal reasons will, if caught, claim that as a defense.
Not necessary, the guy in question apparently had no criminal intentions
and can prove that by notifying the sysop. If he had been caught in the
act he would have had a serious problem.
I can understand your position, but I also know that there is a large
group of systems that is not adequately protected. If the system will be
hacked mostly third persons will suffer the consequences. Protecting the
sysops with a law that prohibits hacking will increase the problem. A
more balanced law would include:
- hacking is illegal
- reporting a hack to the sysop with a full disclosure of the
vulnerability and a proof that no harm has been done during the hacking
will result in dropping the case by the prosecution. (I don't know if
that can be implemented in the US, we have a couple of such
constructions within the Dutch system).
- prosecuting the sysops that fail to secure their systems. With
different penalties for systems that can be used as e.g. zombie
machines, machines containing privacy information, machines with
financial information.
- prosecuting software companies that knowingly introduce vulnerabilities.
Hmm, this seems to be also the order of likeliness of implementation.
The first is easy, no objection from large pressure groups, the second
would imply that you educate judges and lawyers, the third will be
opposed by small firms and the last one is impossible as that would lead
to prosecution of MS and SONY, to name a few.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sat, 13 Sep 2008 13:58:35 +0100, Doctor John <joh### [at] homecom> wrote:
>http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>
>Can't make my mind up on this; is the university right in prosecuting or
>are they overreacting to cover their own insecure *ssh*les?
>Right now I'm leaning in the direction of overreacting but I'm willing
>to be convinced otherwise
>
>John
I agree with "somebody".
Wrong is wrong, illegal is illegal no mater the intentions. As others have said
there are other ways to let people know if there is a security leak. Also
further education should not only teach technical subjects but some
understanding of morals as well. I think that some of the differences in answers
has to do with age and experience. Younger people often think that if they mean
no harm then they are doing no wrong.
It is also up to the authorities what any punishment is due. Whether it is light
or heavy.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 13 Sep 2008 12:52:33 -0400, Warp <war### [at] tagpovrayorg> wrote:
> Breaking into someone's home usually causes material damage which costs
>money. Breaking into a computer system usually doesn't.
Even if no material damage is done breaking into someone's (no relation) house
generally psychological damage is done.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
andrel <a_l### [at] hotmailcom> wrote:
> - prosecuting the sysops that fail to secure their systems.
The prosecutor would have to prove that it was possible to secure the
system after the flaw was known by reasonable means.
> the last one is impossible as that would lead
> to prosecution of MS and SONY, to name a few.
AFAIR Sony has been prosecuted for their rootkit fiasco in many countries.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 14-Sep-08 14:46, Stephen wrote:
> On Sat, 13 Sep 2008 13:58:35 +0100, Doctor John <joh### [at] homecom> wrote:
>
>>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
>>
>> Can't make my mind up on this; is the university right in prosecuting or
>> are they overreacting to cover their own insecure *ssh*les?
>> Right now I'm leaning in the direction of overreacting but I'm willing
>> to be convinced otherwise
>>
>> John
>
> I agree with "somebody".
> Wrong is wrong, illegal is illegal no mater the intentions. As others have said
> there are other ways to let people know if there is a security leak. Also
> further education should not only teach technical subjects but some
> understanding of morals as well. I think that some of the differences in answers
> has to do with age and experience. Younger people often think that if they mean
> no harm then they are doing no wrong.
And partly by cultural background. As a true Dutchman I am horrified by
laws passed on good intentions and 'ethics'. You should pass laws that
solve problems (preferably after identifying what the real problem is),
not ones that are counterproductive.
Possibly the dividing line in this discussion is that on the one hand
people argue that it is forbidden and others who argue that that law
simply should not have existed in that way.
> It is also up to the authorities what any punishment is due. Whether it is light
> or heavy.
The case is in Canada so there may be some hope that the judgment is by
authorities based on facts. I don't know the details of the Canadian system.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Stephen <mcavoysAT@aoldotcom> wrote:
> Wrong is wrong, illegal is illegal no mater the intentions.
Not all crimes have the same severity, and crimes can have mitigating
factors. It's not even uncommon for someone to not to be prosecuted even
though he broke the letter of the law, because the circustances were so
mitigating.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 14 Sep 2008 09:14:54 -0400, Warp <war### [at] tagpovrayorg> wrote:
>Stephen <mcavoysAT@aoldotcom> wrote:
>> Wrong is wrong, illegal is illegal no mater the intentions.
>
> Not all crimes have the same severity, and crimes can have mitigating
>factors. It's not even uncommon for someone to not to be prosecuted even
>though he broke the letter of the law, because the circustances were so
>mitigating.
This is true and in my opinion correct. John's question hangs on this point but
another aspect is; did the person in question "know" what he did was "wrong in
law" whether he agreed with the law or not.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sun, 14 Sep 2008 15:15:41 +0200, andrel <a_l### [at] hotmailcom> wrote:
>>
>> I agree with "somebody".
>> Wrong is wrong, illegal is illegal no mater the intentions. As others have said
>> there are other ways to let people know if there is a security leak. Also
>> further education should not only teach technical subjects but some
>> understanding of morals as well. I think that some of the differences in answers
>> has to do with age and experience. Younger people often think that if they mean
>> no harm then they are doing no wrong.
>
>And partly by cultural background. As a true Dutchman I am horrified by
>laws passed on good intentions and 'ethics'. You should pass laws that
>solve problems (preferably after identifying what the real problem is),
>not ones that are counterproductive.
>
We have a saying: "The road to Hell is paved with good intentions"
>Possibly the dividing line in this discussion is that on the one hand
>people argue that it is forbidden and others who argue that that law
>simply should not have existed in that way.
>
>> It is also up to the authorities what any punishment is due. Whether it is light
>> or heavy.
>
>The case is in Canada so there may be some hope that the judgment is by
>authorities based on facts. I don't know the details of the Canadian system.
If it is based on facts then he is "guilty as charged" If it is based on
intentions then the spirit of the law can be taken into account.
--
Regards
Stephen
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"andrel" <a_l### [at] hotmailcom> wrote in message
news:48C### [at] hotmailcom...
> On 14-Sep-08 5:43, John VanSickle wrote:
> > Doctor John wrote:
> >>
http://www.canada.com/ottawacitizen/news/city/story.html?id=25110a8f-a73a-43a0-a2a5-1daa08d147d1
> > It is not substantively different from a situation where you live in an
> > apartment for which the landlord has failed to install adequate door
> > locks. You cannot break into other people's apartments in order to
> > demonstrate the inadequacy of the existing security. You tell the
> > landlord, advise the tenants, and if nothing happens, move out.
> It is the same sort of wrong comparison that 'somebody' made. The
> difference is that this vulnerability is known and hacking a system
> often involves a new exploit that is unknown to the owners. A better
> comparison might be a house owner with a large fence around his house
> with spikes on top. One day a guy walks up to him and says: 'You know
> that large tree on your property, that has very long branches reaching
> over the fence. I was walking past that and though it might be a easy
> access to your property. I tried the largest low hanging branch and
> indeed it could easily support me.' After which the house owner calls
> the cops and have him arrested for breaking into his property.
Good for him. I'd call the cops too. What's it his business entering my
property? "I was walking by" doesn't make sense either. Nobody walking by
"accidentally" climbs a tree. And if he was really concerned for my safety,
why not come point out to me the branch *without* violating the law?
That it was easy to do or that the owner failed to perfectly secure
something is not an excuse for breaking the law. Where do you draw the line?
If the guy had to use a ladder to get to a branch, would you then willing to
consider it a crime? If the guy had to use a helicopter to land on the tree
or the property, would you consider that a crime now? See, there are always
ways to compromise a property or a system if you have a criminal mind.
Unless the suspect can show that he went into the property by mistake during
his daily walk, and if the property owner did not draw a line around his
property, then I'd let him go. Otherwise, if he's made an effort to climb a
tree, use a ladder, use a helicopter... etc, it's clear what he intended to
break the law, clear and simple.
> > Consider for a moment the results of allowing people to hack first, and
> > then report the results of their hacking. People who are hacking for
> > criminal reasons will, if caught, claim that as a defense.
> Not necessary, the guy in question apparently had no criminal intentions
What do you call breaking the law?
> I can understand your position, but I also know that there is a large
> group of systems that is not adequately protected. If the system will be
> hacked mostly third persons will suffer the consequences. Protecting the
> sysops with a law that prohibits hacking will increase the problem.
False dichotomy again. Why do you assume that the system will be hacked by a
third person? It's a matter of opportunity, means and motive, and not all
are present for anyone on the street. Clairvoyance defenses like that don't
work, and with good reason. If you see someone speeding down the street, are
you given a free pass to ram him? After all, he's going to get into an
accident, right? And it's better that at least the other side anticipates
the accident...
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
