Hacker News Reader

I have to imagine a full time IT person was running the Exchange server, not a lawyer.

This was a highly publicized vulnerability, with a patch readily available.

There are degrees to negligence, and this one is only slightly better than literally leaving the door to their office open at night.

Then a class-action lawsuit may be able to get a lot of money out of them in addition to this fine.

And as you see here it is not easy to even patch Exchange nevermind migrating/upgrading to a newer version or migrating to Office 365. It can be done of course but maybe management did not sign off on it due to risks or downtime. Sometimes IT cannot make decisions like that especially if there is a licence cost involved that the company does not want to pay!

https://web.archive.org/web/20220930183225/https://threadrea...

They could very well have ran on-prem Exchange and standalone/boxed copies of Office 2013, paid for once long ago. Now come and say

>"oh you have to pay again for newer versions or pay for per-user Office 365"

>"why? what we have works fine, we dont need the new features"

>"for security"

>"thats your job"

etc ect

You have only worked with certain clients I hear.

I can absolutely confirm that blog describes a pretty typical experience for patching exchange.

The parent comment was saying that they thought the IT systems for a law firm were managed by a lawyer in their spare time, which is different from this case you describe.

Maybe the IT folks properly and accurately described the risk, and were stopped by non-IT management. Alternatively, maybe IT didn't push as hard, describe the risk properly, or want to deal with an annoying patching process. Microsoft also deserves blame for the difficult of patching, as your link describes.

Either way, the real victims are the 114,979 folks who had their information stolen. If a bank gets robbed because they didn't do basic things like locking the doors or hiring a security guard, they don't get to raise their hands and say "BuT cRiMInAlS". This is literally the same as what IT does whenever they get hit by a highly publicized exploit that's had a patch for months.

> I'd find it worse if a person non-violently stole $100 worth of goods from the homes of 50,000 people than stealing a Van Gogh from the home of one person.

A $5 million Van Gogh would be a very bad one. You can keep it.

I purposefully didn't price the Van Gogh, and assumed its value was much more than $5 million.

If your bank lost your money due to getting hacked would you just shrug and accept that they do money, not IT security and therefore it's outside scope for a negligence claim?

If the negligence directly led to provable harm to me (such as getting evicted because I couldn't make rent), then I would want a negligence suit. If it didn't cause provable harm to me, merely some annoyance, and I got all of my money back from FDIC insurance, then I believe any negligence claim should be greatly limited, or even outside of scope, yes.

If probable harm happens to people because of these record leaks I believe the law firm should be part of the joint liability to make that harm as financially whole as possible. But that's what a civil suit is for, not a DA enforcement.

Negligence doesn't work the way you describe with potential to be out of scope. It is a finding of fact: there was negligence or there was not. The law has a separate mechanism for situations that you might call 'out of scope' which is to award zero damages.

I understand that. You were the one who chose "scope" as the word to use to describe this and I was just using your word in order to facilitate conversation between us.

Ofc, you should be punished for both. The number of crimes and the amount stolen in each. Just add everything up and come to some nice number. Like with 50000 homes something like 50000-150000 months and then 50000 days as 1 day per 100$. And for Van Gogh the 1-3 month and then price divided by 100$ for extra days.

Microsoft does not ensure the operation or patch levels of on-prem Exchange or Windows Server. Where did you get this from? That is up to the IT of the server/company.

I didn't realize "Redmond" was slang for MS.