Hacker News Reader

Comment by jmclnx | Hacker News Reader

Well like everything else, do not blame shoddy security, blame the people who discovered it.

I am sure the people who did this will get hefty prison sentences and hefty fines. While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government and "lets go after the small guy".

I almost think we should make cracking of Large Companies Legal, that will force these companies to use good security practices.

FWIW, I doubt this is a ma&pa gas station. In the US, in most cases, ma&pa stations charge more for gas and make their money from Auto Services. Most Stations in the US are owned by the large Oil Companies or other large corporations.

View on HN

>do not blame shoddy security, blame the people who discovered it

Discovering shoddy security is one thing, abusing a lax security to cause damages, is a completely different thing. If you leave your house door unlocked, that does not mean I'm now legally entitled to walk in and steal your shit.

Also in regards to discovering weak security, there are rules around that. Intentional pen-testing without explicit consent is still a crime in most jurisdictions, as it should be.

I don't have the right to pen-test all the IT systems I like, and start lock-picking at the doors in my neighborhood, just for the noble goal of testing their security, without the explicit permission of the owners of those systems/properties.

If I accidentally enter my password in the birthday field and that crashes your system due to special characters, that's an accidental security finding I can report without repercussions, but that doesn't mean I can now start hammering your live system with port scanners and SQL-injections, just to be "thorough".

> Most Stations in the US are owned by the large Oil Companies or other large corporations.

Quite often the oil company name is licensed and the gas station is independently owned. The gas station owner doesn't even need to buy gas exclusively from that company. I remember learning this when a BP gas station in Louisiana was having a tough time during the Deepwater Horizon leak. But I got curious as to how much is one way or the other

As of April 2023 there are 150,174 convenience stores in the USA, of which 118,678 stores (79%) sell fuel. Overall, convenience stores sell approximately 80% of the motor fuels purchased in the United States. 54.6% of convenience stores are owned by a single store operator (so a single owner or family that owns just that one store).

The top oil companies together own 15,400 gas stations as franchises:

> Major oil companies have begun to reemerge on the retail landscape, reversing a decade-plus trend that reduced their share of the market to less than 0.5% by 2017. Shell Oil Co./Motiva Enterprises LLC, Chevron Corp., Exxon Mobil Corp., BP North America and ConocoPhillips/Phillips 66 collectively have approximately 15,400 stores that all are franchise operations. Shell Oil Co./Motiva Enterprises LLC and Chevron own and operate stores.

https://www.convenience.org/Topics/Fuels/Who-Sells-Americas-...

Gasoline comes from a refinery, is shipped by truck for the last mile, and is carefully regulated on the state level. The big chains might have a specific additive mixture they want put in the gasoline, but all stations in an area are forced to buy from the same refinery as between shipping costs, and state regulations the cost to get from anyplace else would make you noncompetitive. Sometimes there is more than one refinery, or a second pipeline to your city - but it is still safe to assume that all the gasoline you buy in any one area all came from the same refinery.

Do you also think that Large Companies should be able to hire their own armies and make their own laws?

The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people.

If the government can't enforce its own laws, what the fuck do we pay taxes for?

The entire point of police was to socialize the costs of securing business properties and assets onto the taxpayer while calling it public safety. That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism and why the #1 type of theft is actually wage theft, by orders of magnitude, yet you never see cops raiding business owners' homes like they do for 2 ounces of meth.

I'm not even saying pro or against here, that's just the facts of it. Police aren't here to protect you, they've established in court, in fact, that they do not need to intervene in a situation where you're in danger. That they also occasionally do some good for the community (or kill people in cold blood for trivial offenses) is a knock on effect, not the purpose.

> That's why just about the only thing cops are consistently decent at is intervening in property theft or vandalism

Property theft seems like the most-ignored type of crime these days. Police often do little more than fill out a report unless the thief is still there and stole a huge dollar amount. They obviously prioritize violent crime much higher than vandalism.

> the #1 type of theft is actually wage theft

This is a myth. Retail theft is much higher than wage theft.

> Property theft seems like the most-ignored type of crime these days. Police often do little more than fill out a report unless the thief is still there and stole a huge dollar amount. They obviously prioritize violent crime much higher than vandalism.

I'm not talking about what they prioritize, I'm talking about what actually gets solved. How many times have we seen someone chased down and shots fired at them for stealing a couple sodas or something?

Meanwhile, murders, sexual assaults, nothing. Nada. And that's assuming that the perpetrator wasn't themselves a police officer.

> This is a myth. Retail theft is much higher than wage theft.

Not according to everything I've read on the subject: https://www.epi.org/publication/wage-theft-bigger-problem-fo...

There is a world of difference between poor enforcement and completely legalizing theft, which is what OP was advocating for.

Even if the police were perfectly moral and upstanding, relying on them to respond to an incident in real time is just a bad idea. But, if someone broke into my house and I got high res video of their face and license plate, that person would eventually be jailed and I would be able to collect damages from them. Maybe not in LA or NYC, but definitely where I live.

> There is a world of difference between poor enforcement and completely legalizing theft, which is what OP was advocating for.

I wasn't really weighing in on the OP, I was weighing in on the person I replied to:

> The entire point of living in a society is that the government maintains a monopoly on force, and therefore can provide security to it's people.

Which is not to say that that NEVER happens but it seems clear the monopoly on force is used as much if not moreso to maintain a status quo that benefits the power structure that wields it. "The sounds of children screaming have been removed" comes to mind, where police are in a place they are needed and resourced appropriately to respond and simply don't, because they don't have to. And the flip-side of that is, you have clear cut cases of people being harassed by cops because they're homeless, or outright killed by them for stealing food because they literally cannot pay for it.

There is absolutely a need in society for a police force, but our current one has demonstrated it's inability to meet that need over and over.

> do not blame shoddy security, blame the people who discovered it.

They didn't just discover it but went on to exploit it on a semi-industrial scale. It is very hard for me to sympathise with them.

> I am sure the people who did this will get hefty prison sentences and hefty fines.

As they should, yes.

> While the large companies that do all they can to avoid paying for expert security get a "I and disappointed in you" from the Government

Why would the government be disappointed in the company operating the pumps? The pump company is out of fuel and money. That should be enough incentive for them to step up their game.

Trying to equate theft with writing software bugs seems like a bad road to go down.

Yeah lock me right up then

if you are using those bugs to steal property from a company/person, you should be.

What a terrible take. We should also make it legal to throw rocks in people's windows to ensure all glass is tempered. We should also make it legal to steal so that all stores have sufficient security presence. What kind of silly logic is that?

Stealing from a big company isn't any more moral than stealing from a small one.

The thief is to blame .

Reply on news.ycombinator.com