Comment by jfoutz | Hacker News Reader

Comment by jfoutz | Hacker News Reader

How does that work? I'm not a lawyer. I'm a lazy programmer.

So, does the defense get to subpoena the logs, and depose a programmer to explain why some random request returned a 502?

Does the defense get, like, red team access?

Although I'm a lazy programmer, I do think a lot about failure modes. If my freedom is on the line, I can probably think up a few (orders of magnitude) test cases. Happy to provide a shell script or python or golang binary to check. Heck, if it comes down to it I'll provide a stack of fortran cards. Do I get to see the source? That "few" is probably going to move a decimal place or 5.

I get volume is not reasonable in the eyes of the court. Scale is how you(I) find problems, but whatever. Gimmie source, gimme access, I doubt I could beat Knuth, but with my freedom on the line I could give him a run for his money.

How do CVE's count? If I find evidence of log4j do I auto win?

This makes me think of the Jepsen tire fire talk. The system probably mostly right. But there's no way it's correct. What's a "fair" level of access to prove that?

The real problem is this isn't a "right" that the postmasters could exercise. You're accused of stealing money. You're not paid very much in the first place and have only limited legal aid, and may even be in prison (on remand) already. There's no "defense team", you only have a solicitor assigned to you at the police station. You're also not a programmer. How are you going to argue that the database which shows you stole money wasn't working correctly?

And the only evidence the prosecution needs to show is some log messages from the system saying the math doesn't add up? Nothing else?

Yes. Try reading the article?

In the US at least it is hard to bring source code into the trial, even though you technically have a right.

I remember one case where the FBI installed malware via a browser exploit on thousands of computers to get their IPs and one defendant tried to get the source code but the government managed to keep it secret.

That sounds like one of the "Playpen" cases, for which the EFF has a writeup on the hacking tool. [0]

Perhaps also relevant would be United States v. Lafon Ellis [1], where the defendant sought access to the source-code of a DNA fuzzy-matching service.

[0] https://www.eff.org/pages/playpen-cases-frequently-asked-que...

[1] https://www.eff.org/deeplinks/2021/02/federal-court-agrees-p...

>Perhaps also relevant would be United States v. Lafon Ellis [1], where the defendant sought access to the source-code of a DNA fuzzy-matching service.

I'm glad at least in this instance the defendant got access to the source code. He was being helped in pursuing this by EFF so I assume there were volunteers that helped with the analysis. But what if your case is lower profile? What if you can't afford to hire 10 programmers for 3 months to write test cases?

Also I wonder how such a request would go down in a UK court.

its divide and conquer and abuse of power.

The post office found that money was "missing". It went after the sub-postmasters. The sub-postmasters didn't know that it was a systemic issue, they were told to plead guilty to reduce their sentence.

Unless you have a credible lawyer, and have a clue that something in the system might be wrong, then you're not going to know.

> So, does the defense get to subpoena the logs, and depose a programmer to explain why some random request returned a 502?

In theory yes, but you can get some idea of how it worked in practice from the transcript of the trial of Seema Misra [1]. This was one of the few cases where the postmaster pleaded not guilty and expert evidence was presented to the jury. The defence complained throughout the trial that their expert did not have adequate access to the underlying computer records. New documents were identified during the course of the trial, and the defence applied unsuccessfully for the trial to be stayed at the close of the prosecution case.

[1]: https://journals.sas.ac.uk/deeslr/article/view/2217/2151

There already exists rules for certainty in law. After all just because you were seen by fourteen witnesses found with the murder weapon and admitted to the crime doesn't mean you are 100% guilty.

It could have been your identical twin doing those things as a silly example.

That doesn't mean the prosecution loses.

The goal is to meet that certainty which is by definition below 100% but high enough that society accepts it.

Reply on news.ycombinator.com