Hacker News Reader

> As far as unauthorized use of campus resources, I think the university would be better served by suing AT&T for failing to adequately protect its network.

It is not the responsibility of a network service provider to protect the assets of a customer. If you're given a network link and an allocation of IP addresses, it is your responsibility to use them wisely and securely.

> Or maybe universities and organizations could teach their employees to handle network security better.

This is more sane thinking.

> I'd like to draw attention to the "white only" sign on a bathroom door in SUNY. Because it was a black female who did it, it was called art. Had it been a white male, it would have been called hate crime. We can clearly do better than this.

It was called art because that was its intention.

Context matters. Pretending that all words should always mean the same thing regardless of context is a woefully inadequate approach toward understanding human speech. And yes, the person speaking and their intention is part of context.

Surely you don't take people literally when they speak to you in an ironic or satirical tone?!

Context is removed when something like that is placed in a public area. I have no doubt in my mind the art defense would not pass if the person was a white male.

I don't think that's true. If the male artist had the vocabulary to express the intended sentiment, in the same way that the female artist in question was able to, I don't think there would have been the issue you raise. There may indeed have been a different issue, of appropriateness of voice, but I don't think it would have been the hate crime you claim.

I did not claim anything about hate crimes. Only that a black female will get treated much differently than a white male in a situation like this given the art defense. Art should be consumed independently of its creator imo.

> Context is removed when something like that is placed in a public area

And then re-inserted again when the author and his/her intent is identified...

> I have no doubt in my mind the art defense would not pass if the person was a white male.

That would almost certainly depend on the underlying intent and message.

I think you're completely wrong about how improtant identity is in this case, especially if we're trying to determine whether most people would view something as hate speech. The only thing special about a black female is that her underlying intent and message is obivous in context... which, yeah, context matters. Fact Of Human Communication.

If the message were the same as the black female's, it would maybe be identified as "problematic" by some people, but I doubt anyone would call it hate speech. NOTE: This was EXACTLY the response when the black female posted the signs! There was plenty of criticism about tactics even though she was a black female. See https://www.insidehighered.com/news/2015/09/18/suny-buffalo-...

If the message were something like "free speech is important", I doubt most people would be sympathetic. Especially mature and thoughtful free-speech activists (even as they defended his right to express those opinions in non-graffiti settings). There are just much better ways of communicating that message. But in any case this almost certainly would not -- de jure -- be considered hate speech.

If it were a professed white nationalist -- as it is in this case -- then it might be considered hate speech and maybe even a hate crime b/c it was graffiti (or, in the case of the article, possibly unauthorized access)

(edit: holy shit a -2 mod on a comment pointing out that context is important to interpreting a message... LOL)

> And then re-inserted again when the author and his/her intent is identified...

People are extremely quick to judge and I am more than certain that if revealed, a white male would be doxxed to infinity and would not be taken at face value with the art defense. We live in an internet outrage society; something like that is red meat.

> stuff on messaging

Messaging only matters if people want to hear the message. Free speech is being shouted down on campuses across the nation. People do not want to hear opposing views, they want to silence them.

> Free speech is being shouted down on campuses across the nation.

The threats to free speech on college campuses come from a lot of directions, but angry undergrads aren't one of them. In fact, politicizing higher education by insisting that campuses are too liberal is far more likely to lead to socially meaningful self-censorship.

Even supposing you're not being paranoid -- which I think you are -- white men not painting racially charged messages on bathroom doors isn't exactly a big loss to society. However, public intellectuals shying away from studying politically charged topics (gun control policy, abortions and contraceptives, stem cells, fundamentalist religions, climate change, etc.) because of political meddling in university hiring and firing decisions is definitely a big loss.

People who complain about free speech on college campuses should carefully consider the actual agendas of the politicians that are manufacturing and harnessing their outrage...

I'm all for free speech. People should be able to offer their thoughts as odious as they might be, so long as they are not threatening, or harming anyone in doing so.

So I'm a bit baffled how people could find it offensive for urban Congo to perform in loincloths. It's a university. I know I saw really strange behavior, and loincloths seem mild. What makes students so sensitive? It's incredible.

Probably the same thing that makes you so sensitive about students at a place you have very little stake in being too sensitive? I mean tink about it. The things that a very miniscule portion of Princeton students choose to complain about can't possibly have any impact on your life unless you choose to care about it.

Clearly, people get offended at all sorts of things for all sorts of reasons all the time. Students aren't a special exception and this is hardly a new phenomenon (even if the Internet makes it more observable). If you don't believe me go read the 1 star reviews on Yelp and co. or the comments on your local newspaper's website. Or read your own comment.

The only difference between the inanity of every-day outrage/argument and students at universities complaining about something like cultural appropriate is that it's young liberals at universities complaining. People love complaining about each of those things individually, so their confluence is click-bait heaven.

To flip the table: what makes people who complain about young liberals at universities being too sensitive so sensitive? It's incredible.

It's not so much that I disagree with the concrete free-speech-promoting policies associated with your position on this issue. But complaining about over-sensitivity is just so silly; it's as if the irony of complaining about complaining is completely lost on everyone who talks about this topic.

Our actions have consequences. I like to ask people what they think about people blocking highways to protest against Donald Trump. People doing dumb things like blocking highways in protest of Trump or pulling his leg in a really makes it easy for his campaign to lump everyone who says he is not fit for office into one group.

Similarly, people who are sensitive about stupid stuff makes it easy for people to lump everyone who has a grievance together into "them" and dismiss their grievances at once. Think the boy who cried wolf but rather than just that one boy getting mauled, it is every single shepherd boy who gets mauled.

This doesn't actually excuse the lumping of people together, and doesn't make the generalized observations about those groups of people any more or less true...

Anyways, this bit of real politic is completely immaterial to my original point, which is that it's stupid and inconsistent to complain about other people's complaining. In particular because your observation about perception works the other way as well.

I think the main difference is that my complaint is against suffocating free speech while their example is about stifling it. I prefer people to be free to express themselves in cacophony over speaking in stifling unison.

>> Mr. Auernheimer said he did not hack into the printers, but activated them using remote access.

> Or maybe universities and organizations could teach their employees to handle network security better. I don't think this is grounds for a criminal case.

Actually it is. If you try my car/house door and it's unlocked it doesn't mean you can enter it.

That being said, a fine would be appropriate in this case since minimal harm was done.

> If you try my car/house door and it's unlocked it doesn't mean you can enter it.

I'd say breaking into a computer is more like breaking into someone's mind (something like inception if it exists) rather than breaking into their home. I know it sounds counterproductive to the case in hand but that's because I have no intention of defending weev. I just want us to get out of this idea that we have to somehow tie everything in computers with an analogy like breaking and entering a house.

Here's what I consider a balanced response- prosecute him for some kind of hacking crime, and at the same time fire the system administrators for gross incompetence.

Apparently this happened many times in many places. You can't fire that many people. Who would replace them?

Start firing people for screwing up and their peers will learn not to screw up.

Even the most careful, thoughtful, and professional person will screw up at their job sometimes. It's only if the same screwup is made twice that jobs should be on the line.

The first time is a learning experience, the second time is a demonstration of incompetence.

If you can all your competent people the first time they make a mistake, suddenly you won't have competent people anymore in your misguided quest for perfection.

Their peers will learn that 'screw ups' on whatever arbitrary scale, which are as common as human, will be punished by loss of employment, plus all of the negatives that status carries. This will teach them to become militantly risk averse and, by proxy, utterly afraid of and resistant to change. Meanwhile, the folks you let go, the ones who truly learned the lesson, end up using their newfound experience to improve processes elsewhere.

OK. Sure.

Downvote away. And this will keep happening. Grats on that.

Keep fighting with reality, let's see how that goes.

It's not like people just stop working after they're fired. You can just hire replacements from the people who were fired at other schools. Everybody wins!

  > If you try my car/house door and it's unlocked it doesn't
  > mean you can enter it.

If you have a publicly available web server and I make a "GET /" request on it, am I hacking? If you have a publicly available print server and I make a "PRINT flyer.pdf" request to it, am I hacking?

Interestingly enough the person the article about was convinced and jailed for making GET requests on publicly available websites, because he knew he did not have permission to access them.

I think a print server at a university is pretty obviously not fair game. If you forget to lock up your business overnight and someone walks in and prints off a couple thousand pages using your printer it's definitely illegal.

Yeah, I made an analogy 3 years ago when the Weev case came up: https://news.ycombinator.com/item?id=6435092 contrasting a publicly accessible web server with a librarian at a public library.

Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access.

Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"?

To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.

I think a better analogy would be if a library accidentally placed a paper copy of their members' records in the library alongside the books, you found it, and instead of informing the library of the horrible mistake you took it over to the library photocopy machine and made a copy for yourself and showed it to everyone to humiliate the library for their mistake.

Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it.

It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.

A publicly accessible, internet-connected printer is almost directly analogous to a fax machine that you can phone, transmit a document, and have it print out on the other side. Maybe you intend the phone number to only be called by certain people, but the default behavior will be for the fax machine to accept calls from anybody in the world. So it is for a printer with a public IP address. Sending faxes in this manner (without prior business relationship; not respecting opt-out, etc.) is an FCC violation; it's not hacking. Why would printing be any different?

I agree with you on the ethics/morality of it all.

Can you honestly say that you might come across an unsecured printer on the public internet and truly believe that it was set up that way intentionally and you have the owner's permission to print stuff?

That literally never happens. It's possible in theory, but in practice, if you encounter such a thing and send it a print job, you know you're accessing it without permission.

If you don't have permission and you know you don't have permission and you still do it, that's illegal. Analogies about librarians don't help.

... and that conviction was overturned on appeal. Sometimes the judges get it wrong the first time.

Under US law, it depends on whether you have permission to use the server or not.

The lack of technical enforcement of the permission is irrelevant.

Yes, you probably are. There may not be much technical difference between your hypothetical GET and PRINT requests, but the law generally isn't written or interpreted by technically minded people.

Think of it this way. It is reasonable to assume that a server which responds to http requests on the internet is intended for public browsing. However, a printer that responds to un-authenticated job requests over the internet much more likely to be a configuration error, then intended for public use.

> Actually it is.

Specifically what law did he break?

If someone leaves you a voicemail with a message you don't agree with, is that a crime?

If someone sends you a fax with the same message, is that a crime? [1]

If someone sends you an email with the same message, is that a crime?

If you connect a printer to the internet and someone sends the printer a document with the same message, is that a crime?

I'm sure someone can find a way to apply the CFAA to this, but at the end of the day a printer is not a house. A printer connected to the internet is a server that turns files into paper documents. If you don't want people using your printer, don't place it on the internet with zero authentication or access controls.

[1] advertisements are illegal, not sure about arbitrary messages.

Yeah the fax analogy is spot-on. Nowadays the fax and printer are often the same machine.

The fax analogy is terrible. It's normal to set up a fax machine that anybody can send stuff to without authentication. Nobody ever does that with internet connected printers. If you find one accessible and unsecured, you know it was done by accident.

TFA seems to contradict at least your "nobody ever does that". ISTM that while many of the unsecured printers were mistakenly so, many others were intentionally so.

But we don't need to speculate about motivations. There is very little functional difference between a fax machine and an unsecured printer. The addressing scheme and transmission protocol are different, and the fax is limited to B&W, but those are the only differences of form or function. The differences are in the expectations that some people have. They'd shred obnoxious faxes without comment, but at least for now they won't do that for obnoxious printouts.

Where does it say that many of the unsecured printers were that way intentionally? If you're referring to "Many university printers allow printing from outside their computer networks," that to me is pretty clearly just a way to say, in a nontechnical way, "many university printers are not secured."