Hacker News Reader

Comment by BeefWellington | Hacker News Reader

This is not actually related to what's going on in this case.

They're basically suing because he didn't retract or update and clarify his (really false) initial story. Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage.

Should they have handled the situation better? Sure.

Will they win their lawsuit? Unclear; they've got a big hill to climb to it seems unlikely.

Is this in any way "silencing" discussion about it? No, it is doing the opposite, and it's not as though Ubiquiti is unfamiliar with this, given their history.

View on HN

Krebs was taken for a ride by his "source" who it appears was a disgruntled employee, causing the damage.

To clarify the phrasing, the disgruntled employee caused the damage to Ubiquiti. He was the one who "hacked" Ubiquiti (actually he misused his credentials), was the "whistleblower" that fed Krebs information of his own "hack", and tried to blackmail Ubiquiti. All while he was a Ubiquiti employee... assigned to investigate the "hack."

Ref:

https://thenextweb.com/news/ubiquiti-ex-employee-hacker-whis...

https://www.securityweek.com/former-employee-accused-being-b...

"Really false" according to Ubiquiti - it seems KREBS disagrees.

Does bringing this suit open up Ubiquiti to discovery?

Yes, if it gets that far without being settled or dismissed in some other way. One defense to defamation is to claim that the statements are actually true (or substantially true). If the case ends up turning on a factual disagreement over whether the statements are true, both parties can ask for discovery of evidence that would help shed light on that.

Of course it does.

Krebs disagrees a lot. Sometimes he's wrong though.

Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy? [1] (Spamhaus just blacklists all TCP SYNs, which can be easily spoofed since it's not the complete handshake)

I don't know. I believe that Krebs has usually good intentions, but sometimes he is just presenting his findings in a very malicious way.

[1] https://twitter.com/_mg_/status/1121316639637528576

[2] https://www.youtube.com/watch?v=h8WCVwyZyg0

> Anyone remembers when Krebs doxxed the admin of cock.li because they disagreed with Krebs on spamhaus' black listing policy?

I don't shed a tear for that person though, as someone who has gotten about three dozens of murder threats that were sent through their service.

cock.li is an awful service that serves no legitimate purpose other than enabling people to cause harm. The admin should have been arrested at 36c3 by the police instead of simply been booted out for his neo-Nazi domain names, but unfortunately our police is incredibly incompetent.

Sorry, but just no. Just because someone abuses a service, it doesn't mean that it "serves no legitimate purpose".

You see, people are using Tor to buy drugs and to share child porn. Does that make tor a tool "that serves no legitimate purpose other than enabling people to cause harm"?

I am a happy user of cock.li, because it's one of the only few email providers, which don't require my phone number (unlike gmail, outlook etc). I don't mind that they also offer domains joke domains such as "hitler.rocks", since I know what a joke is.

> since I know what a joke is.

https://en.wikipedia.org/wiki/Poe%27s_law

Not judging one way or the other, just saying that it's incredibly risky to make jokes like this, especially in the current climate, where the narrative and emotional response matters more than facts and rationality.

Saying "Hitler rocks" is literally a crime in Germany and many other European countries (per §86a StGB / DE, for example).

Not complying with court orders for information disclosure is also either a crime or a serious infraction (Ordnungswidrigkeit), too.

As said, the guy got lucky he didn't get arrested like he should have been.

Can you point to the specific subsection of §86a StGB that would apply here?

I feel like the law would be especially difficult to apply in this context given that the domain names offered by cock.li are obviously picked for the sole purpose of causing offense, not to promote an unconstitutional organization.

Last year, the government director Dr. Trips-Hebert explained the facts and the law to prevent misunderstandings like yours in the future. [1]

Let me translate the key section of his letter: "Section 86a of the Criminal Code is located in the third title of the first section of the Special Part of the Criminal Code. The offenses of this title criminalize acts that constitute a 'threat to the democratic constitutional state.'" The protected interests of the provision are political peace, the free democratic basic order democratic basic order, the idea of international understanding, and Germany's reputation abroad. The ban serves [...] to prevent the revival of the banned organizations or the aspirations they pursue [...]."

"Hitler.rocks" is not falling under this, since it is not a "threat to the democratic constitutional state". That's also why satire magazines like "Titanic" are allowed to publicly show Swastikas on their front page. [2]

A domain about hitler minerals [3] which does not aspire the revival of banned organizations such as the NSDAP, (there isn't any nazi glorifying content on the website), does not reflect a threat to Germany's democratic state. At least I hope so :)

[1] https://www.bundestag.de/resource/blob/869290/c8bd5f14ef172e...

[2] https://www.titanic-magazin.de/heft/2017/april/

[3] https://www.youtube.com/watch?v=yDVIrp8XaWI

You were sent murder threats but you're pro-doxing?

You want this guy to be put in jail over his childish joke domain name, and he’s supposed to be the bad guy? Look in the mirror.

"False" in this case means different things to different parties.

To Krebs, false means he did not accurately report the information as presented to him. In that way he is correct.

To Ubiquiti, false means the information was willfully inaccurate, should not have been deceptively presented to a notable authority in the tech field, and this should not have been published.

Ubiquiti has to sue Krebs to show that the damage to their reputation was related his reporting which they can tie back to Sharp. Krebs has to defend his standpoint to show he was not complicit in Sharp's planned sabotage. I expect they'll settle once the sides are fully aired.

Krebs has an easy win here, I'll be very surprised if he settles.

The bar to show defamation in a case like this is very high. Ubiquiti isn't going to meet it.

The FBI also seems to disagree seeing as they arrested Krebs source indicating that there never was any third party hacker, just that individual insider.

Reply on news.ycombinator.com