FBI arrests LulzSec member "recursion" for Sony Pictures hack

it is a terrible analogy, I agree. I didn't choose it.

anyway, lets keep beating on it.

If I were to agree to keep the possessions of thousands of people safe under my roof, I would expect to have someone working around the clock to find a way into my home.

I am not condemning Sony's engineers at all, I dont know any of them, but even so it is my absolute belief that they knew damn well how broken the system was, and that they told their management repeatedly that it needed to be fixed or customer data could be at risk.

I am condemning Sony, if they agree to take my possessions and to keep them secure, they had better damn well expect to have a continuous stream of people deliberately attempting to break in.

He's, allegedly, the one who made the leak public. Yes. But that data was leaking for a long time and we have no way of knowing who else collected it.

If I had thought Sony was secure I'd actually be better off now, with my card visibly leaked, than before where only the bad guys had access to it. If my card was fraudulently used I'd have been in a bad position before the leak was known - I'd be assumed to be a criminal until I proved that I didn't make the purchases. After the leak became public I'd be more likely to get reasonable treatment from my credit card company.

I never once declared there wasn't a crime. Nor did defend it. I didn't even declare it should be downplayed. I said it should not be overhyped. There is a difference. Please stop putting words in my mouth (erm.. fingers).

You know what I don't want?: to be hacked or robbed. I think it is fine that we hold people accountable for it and punish their actions (provided it is appropriate for the crime).

You know what else I don't want?: I don't want my supposedly secured info made available to the first guy with an sql-injection. I think the asshats who let this hacking-101 trick past should also be accountable and punished.

It's kind of funny: you seem to think that Sony not be the only people with security flaws is somehow mitigating, but if someone said "Recursion isn't the only hacker your know" you would probably jump down their throat. I think that responsibility should go two ways and you are getting all sorts of worked up over it.

True, but a home is not even remotely similar to a bank or Sony in this case. A home is a place where a single person or family is responsible for securing their own stuff. A bank (and sony) is a place where money was paid with the understanding of safekeeping. Not just by one person but by many. Since many people are concentrating stuff worth safekeeping in a single place, it stands to reason that that single place now needs to be as secure as many homes -- the payout is bigger therefore the burglar investment is bigger. A place that doesn't account for this but claims security should be held accountable, as that makes perfect sense.

Further I never claimed that the bank robber shouldn't be held accountable, in fact, if you read closely you see I explicitly claimed the opposite. I only added to it by stating that the bank should also be held accountable for not doing what they said they would (securing stuff without properly analyzing what securing means).

Tangent: it is questionable that a glass window offers less security than a piece of cardboard. At least a glass window, upon breaking, makes quite a bit of noise drawing attention (usually a security asset). The cardboard can be removed in a much quieter fashion. Neither withstands a minimal effort at getting past them. I would say both offer the same level of security.

Fair enough.

My original comment was intended to be very sarcastic. I don't respond well to platitudes and slogans, they usually just annoy me by ignoring that most things in life cannot be properly summed up in 6 words. I think that like many issues, both sides in this one seem to resort to shouting matches in which sides need to be taken, and people forget the issue in the desire to "win" and like I said, my response is usually sarcasm towards both... perhaps a bit of childishness on my part too there :)

Anyway, I appreciate your response here, thanks for that.

HN user rtm is a YC partner and the infamous Robert Morris, of the Morris worm which had a nice impact on the internet back before it was the internet.

I guess we're lucky that rtm had a few years left after he was released.

Sony bears the greater part of responsibility for whatever losses it incurred due to its negligent security practices. Digital security is not like physical security -- it's so "easy" to secure systems (in comparison to securing a physical location against e.g. looting or vandalism) that it's better to preemptively close all known classes security holes than it is to be lax with security and expect the law to sort things out.