Hacker News Reader

Comment by _yb2s | Hacker News Reader

Am I missing something? It seems Maia didn't share the data at all, and only offers to if someone can demonstrate they will use it responsibly.

Moreover, depending on the contents of the list, this likely offers proof of what is generally suspected, that the no fly list is a form of discrimination and authoritarian overreach, targeting people that haven't been convicted of a crime but are "suspected" due to race, religion, etc. The whole thing is probably unconstitutional/illegal, but it's hard to prove that since it's been secret.

This seems like a clear case of hacktivism- trying to expose an unethical government program for what it is, so that it can be stopped.

View on HN

> Maia didn't share the data at all

You literally immediately falsified that assertion:

> and only offers to if someone can demonstrate they will use it responsibly.

And nobody ever lies of course.

Offering to share it privately, if specific conditions are met is very different from having already shared it, or publicly releasing it.

She had only shared it with known journalists that she had a relationship at time of writing, and seems pretty bright.

Hypothetically she might get scammed by someone and irresponsibly disclose but let's not condemn her for it yet.

You have an incredibly naive understanding of the propensity for people to divulge secrets.

"Three can keep a secret if two of them are dead"

We're talking about a no fly list which every airline in the world has a copy of. There's at the very least hundreds, if not 10s of thousands, of employees of airlines alone that have access to this list.

If people had such an innate propensity to divulge secrets, surely the employees who setup that faulty jenkins server would have already sent you a copy of the no fly list, right?

And I would agree that it has been leaked, probably a lot, and that any halfway competent government intelligence agency in the world has copies if they feel they need them.

That isn't really a counter-example to my point which is just that it is stupidly naive to suggest that Maia is somehow exempt from these concerns.

If you want to argue that its all pointless secrecy theater, then I'd agree with that entirely.

> Three can keep a secret if two of them are dead

Probably thousands of airline and US government employees have had access to this list over the years. Yet neither you nor me can see anything on it, here in January 2023.

This is why such a list should be public. You don't trust random grey hat hacker at .gay TLD to distribute the list to people who won't do harm with it. I don't trust the government to not distribute it, accidentally or otherwise, to people who want to do harm with it.

In fact, the government does do harm with it, by putting people on it without telling them (they might send a letter, that's not guaranteed), and you only get to find out a few hours before your flight when you get rejected at security.

Furthermore, this particular government fails to properly secure info all the time. Seems the last two presidents have been just leaving classified papers strewn all over the place.

No, I'll trust the gay hackers over the government, thank you very much.

Sure. But that isn't the naive position that just because someone is Good(tm) that they will be careful with secrets. That's just the position that keeping secrets and having Kafkaesque bullshit is itself bad, so it doesn't matter, and the right thing to do is just post it on a pastebin hosted in Russia and call it a day.

Depends what exactly they mean with "demonstrate". It can mean email from J. Random Person with "pinky promise I will use this list for good", or it can mean "well-known journalist with a clear public track record".

> including sharing stolen sensitive data of normal people with whoever can plead a case

Wait, I thought Maia was offering to share who was on the no-fly list, not this stolen sensitive data this comment is claiming

>>demonstrate they will use it responsibly.

The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...

Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this.

Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum...

[EDIT: pronouns]

>>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...

...and it has a Wikipedia article (https://en.wikipedia.org/wiki/maia_arson_crimew), and has demonstrated in other cases (cf. https://www.dailydot.com/debug/feelyou-mental-health-app-dat...) that it has at least a reasonable grasp on what to leak and what not to leak.

Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...

In the aforementioned Daily Dot article:

> CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.

As a side note, maia uses it/its pronouns.

If TFA (may not be accessible right now) is to be believed, “the” server is a very generous understatement of the size of the exposed infrastructure, and customer information was very much accessible if not accessed per maia’s words. So seeing a statement like this from the CommuteAir PR people actually makes me feel less reassured, not more. (The attacking side looks better so far—maia itself is not a “watch the world burn” type, judging from its breach history, even if its writing makes you wonder whether the absurdist parody is deliberate or the author is in fact slightly manic. Kind of like Justine Tunney.)

According to wikipedia maia has used both it/its and she/her at various times, so it seems either is appropriate.

Sure but "he" isn't, which is what OP used.

I think the point here is to expose the nofly list as an unethical and/or illegal government program by leaking it to journalists that can evaluate and summarize it's contents, not to help them secure it better.

White hat hacking assumes that the hacked party is doing normal or ethical business, and that helping them secure it would be generally beneficial.

Also, I'm pretty confident that Maia, as a famous hacker and cybersecurity expert, isn't going to be easily duped by someone impersonating a journalist, and knows how to verify such things.

Please give maia the respect she deserves and use the correct pronouns.

She goes by it, so go look in the mirror. We're all trying our best here.

Maia uses both she and it pronouns. The poster before me misgendered it though, which absolutely isn't okay.

I try and use a person's preferred pronoun. Sometimes I fail, and that absolutely OK.

after your comment, I looked at her main page more closely and found that she mentioned "it/she" in a superscript the middle of a paragraph, so that's what I corrected it to.

I do have to say that, while it's polite to use people's preferences, when just reading an article and posting a quick comment, it's pretty casual, and (almost always) no offense is meant, so none should be taken. Note that the bulk of the comments here are all over the map, and I'm sure no one means to be offensive.

https://en.m.wikipedia.org/wiki/Maia_arson_crimew#cite_note-...

Apparently the pronouns to use are it/its? According to other people which makes your comment even better.

she uses both pronoun sets: it/its and she/her[1].

[1]: https://maia.crimew.gay/

I get the impression that she's/it's doing this from a place of pain and desire to lash out, and "the system" is an easy target for her to fix onto. Not out of any sense of morality.

That's an odd take but I'm getting old. Once you cross 30 its incredibly to spot when someone is an NPC laundering hate in the guise of reading minds. They're clearly young or angry, so you let it go.

The adjective is missing from your comment so I mean not sure whether you meant to write that it's incredibly easy or hard. I certainly do not presume to be a mind-reader, but I do have experience with gender dysphoria. Self-hatred is a hell of a drug.

She appears to have talent in connecting these data sources, but she's also in way over her head when it comes to motivation. On the world chessboard, she's a pawn. I can easily imagine that she's being egged on to do harm to the quasi-neutral but not isolated society that is now her life raft.

As I understand it, self hatred arises not from gender dysphoria but rather how others treat the person experiencing that.

Reply on news.ycombinator.com