Hacker News Reader

> Regarding Daniel - like others here I'm sure it's because cURL has been used extensively for bad purposes he was kicked off the ESTA program. Yes it sucks that they didn't let him know in advance, and they didn't have the smarts to figure that he had nothing to do with the bad actors.

Very strange paragraph right there. I could easily generalize this to Windows powershell is increasingly being used in cyber offensives by non-state actors, let us eject Microsoft from the United States

Yes you can generalize this to Windows powershell.

And no that does not have anything to do with ejecting Microsoft from the US. Microsoft isn't a private foreign individual using a privileged entry mechanism in the US that given any reason whatsoever can be revoked in favour of a perfectly functional visa process that most countries have to use.

ESTA is only available to a few countries, and not all people in those countries.

I don't think Microsoft will be ejected from the US because of an ESTA invalidation.

Great. So what does this rejection accomplish based on your premise of having written software that has been repurposed by evil actors? Dan's GPS coordinates at any time t does not affect whether he writes code that will be used for good or evil, so what gives? :\

No one should be held responsible for a fact that causes damage without direct involvement. The legal system uses `iuris personae` and limited liability precisely for this. Distinguishing a natural person from a legal person in this case is contrary to the purpose of the laws in force.

Each tool can be used for good and for evil: risk management is primarily used to hedge against the risk of a contingent, uncertain loss, and is embedded by the law for companies, and people too.

He wasn't denied entry into the US. He was denied access to a fast track system for entry into the US, so he has to use the slow, annoying, more methodical way.

It certainly sucks, but your summary of the US legal system is irrelevant.

He apparently had his paperwork in order and was rejected when he tried to travel.

Spin it however you like, but the fact is that he was denied entry into the US?

Whether or not he can pay (time, money) to go in the future is irrelevant to being denied today?

Regarding the entire esta vs visas... I'm lucky enough to have passed painlessly through VISA and I don't understand the difference between them? You have to apply for both? You have to provide your identity documents, information about yourself, payment? The only difference I can see is that you don't need to visit an embassy? Why do we draw a distinction, other than marketing?

My purpose was not to criticise your comment, but to offer a starting point for reflection. It is not a secret that (in recent years) the number of people subject to more stringent authorisation procedures are constantly increasing, and this without counting the no-fly.

Having been a great admirer of the US, I can say that what I admire are some principles, principles that seem forgotten. They are probably forgotten because when you teach a CBP employee to look for only the worst of people, this will eventually find something suspicious in anyone.

The recent run into exploiting software vulnerabilities could explain why there’s a focus on developers/hackers. But just putting a critique is not constructive, remembering where we come from, what are our principles, why we have them, and their purpose, is much better to motivate why it's wrong to "discriminate" someone.

It's not just slow and annoying, it's wrong because he’s not responsible.

The nuance you're trying to invent is meaningless if you miss your flight and the conference.

> If you were calmly asked the same questions by a sweet guy or girl on a chaise longue while being offered champagne and strawberries, people would have almost no problem even though it's really the same thing without the elevated stress level.

Cute girl offers glass of champagne and complimentary strawberry 'so.. I'm gonna need you to unlock your phone, give me the password to your work-related e-mail, your personal e-mail and all your social media accounts.'

A popular tactic of intelligence agencies, Mata Hari passim.

I travel into the US constantly, as do many people I know, and I have never in person come across a single person this has happened to.

Not saying it doesn't happen, just that it's easy to blow this stuff out of proportion.

That's what I'm trying to do here - offer the view of someone who does this every few months for nearly two decades.

I don't think it has anything to do with what software he works on.

I'd be willing to bet significant money that it was either a clerical error, or something mundane from his ESTA form that got double-checked and came up "no". I am willing to bet this because I have been in that situation:

https://news.ycombinator.com/item?id=14643861

> cURL has been used extensively for bad purposes

What?! Sources please.

I once used it to change the user-agent and get an alternative response from an API.

badass...

I presume the author of the comment is refferring to incidents such as https://daniel.haxx.se/blog/2010/12/23/hacking-me/

If you write a general-purpose utility and it gets included in some kind of bad software, the people writing the 'bad' parts aren't likely to include their details, but if your 'good' code has your details....

I mean, I've personally used it to access APIs from shell scripts that would have been far more maintainable in a proper Python script.

That's three counts of conspiracy to degrade system maintainability, manufacturing tooling with intent to degrade system maintainability, possession of tooling to degrade system maintainability, one count of international travel with intent to degrade system maintainability, two counts of manufacture of false documents[0][1] in support of a conspiracy. Bail denied. And... that's life.

[0] Exhibit A: man curl

[1] CURL website

You monster!

If an attackers rouge process lands itself on a target, using something trusted like cURL is better than opening a socket directly, no? Less likely to attract attention?

Same goes for wget, links, etc.

Sorry no sources, it won't take you long to verify this yourself using google. I'm sure there are competent infosec guys and gals here who can provide a better explanation.

rogue, not rouge.

curl -i -X POST http://SOME_TERRIBLE_WEBSITE/api/people/SSN/kill

> For me getting a visa was a pretty easy process

Just because it went well for you doesn't mean you have to turn a blind eye for other people. As soon as you don't come from a list of "nice" countries crossing borders is a living hell.

> but when it comes down to it I think CBP are far more reasonable than they are given credit for because of the crappy environment it happens in

I don't think this is true. The circumstances/environment are the same but compare entering America to entering any other country.

No country but America has ever fingerprinted me, searched my luggage, detained me in a small room with no explanation for 3 hours, forced the departing airport to search me again after security (on 3 separate but consecutive flights to the US, months apart) or made me spend more than ~10 minutes in a line waiting to get through security or immigration. America has done all of these things.