Hacker News Reader

Comment by leoqa | Hacker News Reader

I’m pretty sure this is a felony. I’m not against the spirit but want to warn others that you could get slapped.

If you use a password field can’t you reasonably argue that you want to actually have a really secure password? ;-)

I’m sick and tired of these 12b character limits on password complexity!

I'm sure it is, but a scammer or hacker committing a crime is most likely not going to report this. They would certainly get in trouble too.

Their ISP/host may report it.

How would the ISP know what data was sent over a https connection? The host may, but I doubt they care since the customer pays for the bandwidth.

Huge ingress traffic to a website which normally just serves stuff stands out from a pattern. Also, bad actors are often profitable customers of hosting companies and can ask/demand action without revealing themselves to a 3rd party.

To quote Nacho Varga: "I like ripping of thieves. They can't go to the cops. They have no recourse."

What exactly would the scammer/hacker say to the police/their lawyer? "Could you please help? I'm trying to scam innocent people out of their money, but some greyhat has filled up my server's logs with junk!"

It’s now a felony to send api calls? Give me a break

The US unfortunately has intentionally vaguely written laws about misusing computer systems which can be interpreted to punish hackers and pentesters pretty harshly.

It's a crime to intentionally drive a car over someone. Legal systems vary across the world but I would imagine most of them account for mens rea.

So, crafting API calls to intentionally bring down a system most definitely can be a criminal offence.

Now if you're objection was to the use of felony as opposed to misdemeanor, then ignore whatever I said above.

It’s a felony to mail people things? Not usually, but if you send them a pipe bomb it sure is.

This is an absurd analogy from where this began... I'm at most slowing down a server in Russia that is trying to defraud people, no one is getting hurt, and It's unlikely I'm costing them any money. Come back to reality.

The CFAA is controversial because of how vague the statue is. It has no carveouts for vigilantes or "hack back", last I heard -- even though some in Congress were trying to push for "hack back" rights.

The DoJ is unlikely to prosecute a vigilante of scammers, but they have prosecuted others (eg. Aaron Swartz) who were doing a debatably morally upright actions while violating the letter of the law.

Reply on news.ycombinator.com