Hacker News Reader

Comment by jmward01 | Hacker News Reader

What is missing in our society to actually deal with this? I see stories like this and get the impression that it is a forgone conclusion that it is OK for this to be normal. I realize the author isn't saying that, and I appreciate their warning and think it is great they posted this, but where is the call to action to deal with this? And I don't mean we should all just get stronger safeguards. The people doing this type of thing are causing harm on a large scale so how do we get society to recognize and start really caring about this to the point that it wouldn't be a joke to call some law enforcement agency to tell them you are being hacked?

View on HN

There's nothing missing from society. This is the natural state of humanity, and one always must be vigilant. The only thing keeping thousands of people from trying every home's physical front door every 5 seconds to see if it's unlocked is that it's not scalable. If it were possible, it would be happening. AND, if it did start happening, it would not be a law enforcement problem unless law enforcement became equally scalable.

This is not a popular opinion and it often gets dunked on reflexively, but I truly believe the default is low-trust. We are one evolutionary step away from chimpanzees, with barely enough "society" grafted on to our world, which mostly doesn't function. You need to assume you are under potential attack at all times and be prepared to defend against it. Whether it be a physical attack, social engineering, scams, advertisements... in cyber-space and in meat-space. Any other security posture, long term will eventually open you up to a breach by an adversary.

I VERY strongly disagree with everything you wrote.

I think it's a tiny minority of people doing this, with the Internet amplifying their reach.

This world runs on trust. For example it's extremely easy to shoplift, yet the vast majority of people don't. Because people are not like that. It's easy to forge things, yet most people don't, it's easy to snatch and grab random objects from people or places, yet, people don't.

The next time you are out, think like a criminal and see just how much stuff you would be able to do, yet you don't, and neither does anyone else.

It's a tiny minority who do abuse that trust.

(And we are not "one evolutionary step", we are several orders of magnitude steps away from chimps. In intelligence chimps are more similar to dogs than they are to humans, chips are smart - for animals. In comparison to humans they just aren't.)

This world runs on trust.

And IMHO it's better that way, because the alternative --- which some seem to be slowly encouraging us towards --- is dystopia.

Unfortunately, the intrinsic distrust due to globally connected computers is seeping its way into the real world.

Kind of makes me wonder how far away tiny, cheap, automated doorknocker drones are.

How would you propose we deal with within this exactly? Is there a clear way to define a law that would make this activity illegal? Or something you'd propose other than legal recourse?

Personally I don't really know how to draw a clear line between acceptable and unacceptable here. Sure we can assume intent when requesting a users API from a standard WordPress install or plugin, but can we really say what the person's intent is? There are white hat hackers after all, and a law blocking this would almost certainly stop anyone interested in discovering these vulnerabilities and making them known before someone with bad intent finds them.

I think there are multiple levels here. I agree the law side is a challenge, right now, but as we see new harm arise from new technologies we need to start figuring out those lines and figuring out how as a society we discourage this behavior. Basically, I think this is an example of technology moving faster than society's ability to assimilate it and we need to think of smart ways to catch up. That isn't a call to stop technology, but I do think we need to start growing social antibodies to this type of thing. Consider a comparison to kids vandalizing things. As a society we frown on vandalism even without laws in place forbidding it. At many turns in society kids are discouraged from doing it and most, but not all, grow up knowing they shouldn't do it. Social pressure is there to help keep it in check and that also leads to a better understanding of 'the line' which helps inform more formal things like laws and punishments. Laws, and law enforcement, should come after society has taken notice and started acting so how do we get society noticing and acting? What should society do? I think it is, possibly, partly things like emphasizing the idea that it isn't 'cool' to hack things, which every movie in existence does. I admit that isn't a strong start to the idea thread, but there may be things along those lines that could help.

You and I definitely have the same moral view of hacking, or "offensive hacking" if blackhat hacking isn't a term today?

I'm always very hesitant to see any top-down changes trying to change public sentiment though, whether by some kind of intervention to change norms or through law. Norms and laws should reflect, rather than coerce, public opinion. If a majority of people would, of their own accord, agree that hitting common API endpoints on servers publicly connected to the internet is too dangerous to be allowed, I guess we could try to draw a line between that and hacking or penetration testing with good intent.

Short of that though, is it really our place to convince people that this is wrong? Sure we can absolutely do a better job of raising awareness of what's going on, but at least to me awareness of the facts should be the extent of it. People can make up their own decisions on whether or not something is okay, or if its bad enough that we need to further empower the government to enforce more laws.

The challenge with federal law enforcement is they respond to pressure from elected officials, who are beholden to the lobbyists who pay for reelection campaigns.

The FBI is responsible for super serious and intrastate crimes like terrorism, kidnappings and trafficking. Those resources get redirected to policing copyright violations at the behest of the MPAA and other IP orgs.

ICE resources are redirected from border safety to protecting profit margins impacted by knockoff goods.

Whatever entity gets setup to address your concerns will eventually be captured by major corporate interests.

Corruption and the cultural acceptance of being a bad actor against groups different than yourself in certain societies.

When I said something like this a few weeks ago, some people replied "well they didn't actually break in, so they didn't do anything against the law". Even when they do, and get shells for miners, ransomware or fraud they say "it's the victim's fault". If there is no moral consideration, that may be true.

I suspect this is one of the overall effects that have come about on account of individuals judging the inequity across the world.

Crime happens because it is profitable. As far as there is a good chance of winning from hacking, people will hack. So, I'm on the side of good security defaults and practices so that one should invest in crime more than they are likely to earn from it. Harsher punishments won't help because the ability to enforce those punishments is what matters.

>What is missing in our society to actually deal with this?

an authoritarian global government and cameras you aren't allowed to turn off in every room of your home

I understood that you weren’t advocating for this.

same for DDoS. running a service on the Internet means you'll randomly be subject to DDoS attack. unfortunate, but that's just the state of the world these days.

Dude, let's fix spam callers first that are calling my USA number from a USA number.

This shouldn't be hard. If we can't fix that then good luck tracking down bad actors on the interwebs

I've nearly given up on my phone as a device for making calls because of this.

It costs time and money to run those scans, and people wouldn’t be doing it if it wasn’t profitable. I don’t want to blame the victims, but the root is that people put insecure setups online frequently enough to keep the criminals interested. We could require a license or certification to launch a server but that’d be even worse.

I don’t have an answer. This normal isn’t OK. I don’t know what to do about it though.

Reply on news.ycombinator.com