Hacker News Reader

Comment by nbpoole | Hacker News Reader

I think you're missing the point of the analogy. Check out http://en.wikipedia.org/w/index.php?title=Victim_blaming&...

I'm well aware of victim blaming, but sometimes it's justified. If someone hacked into your bank account and stole your money because of a security flaw your bank decided to put off until later, surely you would lay blame on your bank as well, no?

Let me be perfectly clear, lots of the blame lies with that attacker. But it is also the responsibility of the a web host to fortify their systems sufficiently, which clearly wasn't done in this case.

Let's not forget that the victim here is PHPFog's (potential) customers and not PHPFog itself.

I can agree with you that PHP Fog's customers were affected and are thus victims. I don't understand how PHP Fog isn't a victim here though.

I promised myself I'd avoid another analogy but...

If I give the bank my money and the next day I get an email saying "Sorry, we didn't feel like locking up last night and some kids looted the vault." I'd have a hard time calling the bank the victim.

And something concrete: PHPFog knew the holes existed and were negligent. I would say they even have some contributory negligence (IANAL). Especially after admitting they knew they were vulnerable.

You know what we call kids who loot bank vaults? Bank robbers.

No, we call them juvenile delinquents and treat them like children.

And we certainly don't call the bank the victim.

1. We don't treat them like adult criminals (necessarily), but we certainly treat them like criminals. Here are some examples (some harsher than others):

Bank robber, 13, could get 21 years in US jail (http://www.breitbart.com/article.php?id=CNG.cb17379375828ffc...)

Teen bank robber to be held for two years (http://www.morningjournal.com/articles/2011/02/18/news/doc4d...)

Boy, 15, Charged in Armed Bank Robbery in Lancaster (http://articles.latimes.com/2002/aug/09/local/me-bankrob9)

2. Why do you think banks aren't considered victims in cases of robbery? Because they could have done more to prevent the robbery from happening?

You're conflating armed robbery, a violent crime, with hacking a web site? That's the end of this thread.

Dude, you started the metaphor with tour comment. Can't exactly blame someone for calling you out on it.

Banks are absolutely considered victims, but if the victim didn't do their due diligence with respect to keeping their vault secure, then they absolutely share in the blame.

You know what we call banks who leave their vaults unsecured? Neither do I, but it's certainly not 'blameless'.

Reply on news.ycombinator.com