Please Stop Attacking MIT's Network
blog.achernya.com
blog.achernya.com
A cool thing about Aaron's activism was that it involved building things, circumventing censorship, and spreading information, rather than sabotage and denial-of-service.
Every bully wants to 'discomfort' their opponents into changing. Those who use DDoS are more like the federal prosecutors -- making 'destructive' threats, expecting change through punishment -- than Aaron.
Also, if DDoS is "destructive" then copying a file is stealing.
I wish he'd stuck it out; had there been a trial (and possibly sentencing), the public would have learned many of the same lessons about overzealous prosecution, the JSTOR project, the CFAA, the obsolescence of copyright, and importance of open access. Plus, he'd still be with us.
I also believe Aaron's causes with regard to copyright and censorship will succeed in coming decades, easily within his natural lifespan, and he would have helped them succeed faster, so I'm sad he'll miss it.
DDoS is destructive (unlike any amount of copying) because it disables access and functionality and effectively censors content by blocking individual learning and communication. It causes more resources to be be wasted on paranoia and layers-of-defense. It causes a hardening of positions and growth of suspicion. It is much easier to portray Aaron's supporters as 'vandals' if they help by actually committing vandalism. (I'd guess that as an 'applied sociologist', Aaron understood this well.)
That these DoS effects are often temporary is no defense: it's destroying people's freedom-to-communicate for a time... and the early death of a young person should remind you that ultimately all we have is time.
His suicide, tragically, appears to have helped the cause - the media loves the wild speculation and gossip that it brought about. So while his end goal may now stand a chance of coming to fruition, he won't be around to witness it.
The number of things that went wrong in order to generate this outcome is just astonishing. While I knew nothing of Aaron or his cause prior to this happening (see? media effects sigh), I at least hope the public outcry brings about what appears to be some much-needed change.
But within the tech community that is already familiar with open access, copyright reform, and anti-SOPA efforts, a trial, ending in either acquittal or conviction, would have focused a lot of attention. The same defenses of Aaron's actions, and attacks on prosecutorial overreach, would have been aired. And any sentence beyond community service or perhaps a few weeks' jail time would have triggered enduring protests and similar petitions for pardon/redress.
How does that follow?
The reason we don't refer to copying as stealing is not because it's "not physical" but more because only the second part of the definition holds.
I would rather see anonymous discover who at MIT is responsible for this matter and dox them than deny students access to their network. Doxing is like a sniper attack. DDoSing is like dropping napalm on villages.
I don't think anyone will know, actually, who is responsible without the investigation that MIT is already doing. We can speculate, but we'll probably get it wrong.
Yeah.. but not really. The non-public domain documents would still be copyrighted so nobody without a license to them would be creating a JSTOR competitor anytime soon.
Furthermore, torrent of PDFs would never replace a subscription to JSTOR for any university. Universities that currently subscribe to JSTOR would still be subscribing to JSTOR, the only difference is that unaffiliated individuals would have other options. How much of JSTOR's operating budget is coming from selling individual articles to people not in universities?
"The figure of $145k for individual articles is definitely interesting – only 0.35% of JSTOR’s revenue came from pay-per-view cases? This is vastly lower than I expected; quite possibly the prices are so high (and JSTOR access so common, academically) that very few people are willing to pay and unable to circumvent it via a friend. The estimate quoted is $19/article as an average – so perhaps only seven and a half thousand articles over the year?"
Well, destroying someone's business model isn't, of itself evil. A business model doesn't have a right to exist for its own sake. For example, I'd love to see someone destroy the business model of patent trolls.
Not saying that JSTOR has an immoral or unnecessary business model. I don't know actually, but I'm just reacting to the idea that sometimes comes up that if there is a business model for something no one has a right to destroy it.
If there's a bug in your system, fix the bug. Don't delete a file in another directory and call it change.
In the Boston Globe, Aaron's lawyer says that a suggested plea deal with probation and no actual jail sentence was rejected by MIT, and that played a part in the prosecutor pushing for harsher judgement. If there is any truth in that, then there is evidence that MIT did indeed play enough of a role to have some of the responsibility here.
We won't have a full picture of what their role might have been until Abelson's report comes out. Which likely will take a good deal of time.
It is my belief that MIT as an institution should have a policy on the appropriate severity of response to actions such as Aaron's. They need to for the simple reason that they have made a conscious decision to choose to make themselves a natural lightning rod for this type of incident. Therefore they help set the bar for what an appropriate reaction should be.
My further belief is that if this policy is set in accord with the bulk of opinion of MIT students and alums, then we'd have had a different result in this case.
This does not mean that they should be held to be at legal fault for the suicide. However if you have even a passing familiarity with root cause analysis you'll know the value of habitually fixing systemic issues you identify which are several layers removed from the ultimate failure.
I am cautiously optimistic that Abelson's report will address this issue.
They brought in the feds. There is evidence that they asked the prosecutor to go hard on Aaron. But the prosecutor is not directly affiliated with MIT.
See http://www.bostonglobe.com/metro/2013/01/15/humanity-deficit... for the article.
AS, for all of whatever it was good that he brought the world, was mentally ill. For whatever reason, he did not receive the help that is freely available in our society. (There was a lot more available before Reagan cut it to shreds, so he could pass on big bucks to his rich cronies, but I digress...)
THAT is the true tragedy here. Depression is a totally, totally fucked up brain function anomaly. People who have not experienced it are simply clueless and should STFU. The REST of you: get help. Get Help - Now!
I am absolutely looking forward to Abelson's report.
If you assume that ddos from a collective is similar to blocking a road by a collective during a strike or manifestation then I must say that some people won't be able to get to work that day and in general nobody would get hurt.
This sort of pacific interruption raises awareness, which by itself is very important for a functioning democracy.
Regardless of what one may think of computer laws, there is no proven link between his suicide and the criminal charges he faced, and any claims to the contrary have so far been entirely speculative and coming from people who never met the guy--one can't help but wonder if they had even heard of him before last week.
In addition, many of Swartz's accomplishments have been exaggerated specifically to fuel a frenzied mob. E.g., "co-creator of Reddit" which contradicts the public statements of other Reddit founders, and "creator of RSS" when he was one member of a group that took over Netscape's technology.
Of course, my saying this will be used as a reason to attack me for discounting contributions that he actually made, which isn't the case. I am simply pointing out that the knee-jerk righteous indignation and mad desire to blame is getting out of hand. It's becoming an angry mob, directing its violence at convenient targets to feed a primal hunger for revenge.
Again, if some people can't go to work because of a strike, even if it seemingly hurting teachers, student or general population it is in fact benefiting them and the right price for democracy. Democracy can only be with awareness and without it is just a different kind of manipulated monarchy.
And the rest of your 'additions' seems very ugly. He was part of a joint-venture or similar between companies where they all called each other cofunder, not co creator. And check at what age he did work on RSS, if that's not an accomplishment I don't know what is. Not an angry mob, nobody is being physically hurt, just slightly interrupted from what they were doing just as it happens when there's a strike or a big manifestation.
Please stop spreading lies and disinformation.
'killed by the government,' father tells mourners [1]
'depressed about his case/upcoming trial, but we had no idea what he was going through was this painful.' from his mother [2]
[1] http://www.latimes.com/news/nation/nationnow/la-na-nn-aaron-...
They clearly show that the statement from vor_ which I quoted is incorrect.
Unfortunately this is part of deeper systemic problems and bringing up his accomplishments is rather irrelevant and distasteful. If exaggerating his accomplishments helps to spread the story, I have absolutely no problem with that because it has nothing to do with the real issues.
People are just using his suicide to turn him into a martyr for a cause they believe in, and its disturbing.
You mean Taren Stinebrickner-Kauffman? She was the one who found his body.
Any other speculations you'd like to share?
Blockading a key port that is shipping war supplies or preforming a DDOS attack against government websites can be legitimate form of protest, but those actions are very hard to plan and pull off.
This attack (if it is an attack) just seems like someone is going after the low-hanging fruit of MIT's network.
You're doing X, but Y would be more effective, therefore X is pointless.
In reality what happens is that someone does X and someone else does Y, and it's not uncommon for the same group to do both.
Fwiw, I don't have any view on whether this attack (if it is one) is justified. I haven't read enough on what MIT have/haven't done so I can't comment.
You state that like it is the only reason he did it. It contributed, yes, but it wasn't the sole cause.
That said, MIT has some smart people, surely they can put their noggins together to figure out a way to stem the attack. Maybe once and for all, and for the good of the internet, they can contribute this tool for unilaterally turning off DDOSes to the public.
It's an issue of raw volume, once the attacker(s) exceed your capacity you're saturated and dead in the water. At this point, the techniques that will help must be applied at a point where the pipe has greater capacity than the attack, and depend on the exact nature of the attack and so vary in effectiveness.
That isn't to say the situation couldn't be improved, but I think widespread infrastructural changes would be needed and isn't the kind of thing MIT folks could just work out and apply to their current situation.
I was using understatement to mock both MIT's reputation for innovation and intelligence and their role in the events that appear to have spurred the attack, so maybe they could put their vaunted brainpower to work solving that problem instead of killing downloaders, so to speak.
(I do know some disturbingly brilliant people from MIT... I also have had occasion to meet some people who are disturbingly not brilliant, but no worries, they had ample levels of the Dunning-Kruger effect to make up for it.)
The whole point of a protest is to put pressure on the system your trying to change. Start a walkout/go on strike if you dont want to deal with the problems the organization you're working for caused.
The school only gets power from its students. Without the students there is no school. You have more power then you think. Take a stand, make a difference.
Are black people notorious for eating or something? That kind of came out of left field, there.
The same is not true of DDoS attacks.
It should be pretty clear in this case, though.
'Affiliation with MIT right now, even as a student, looks to me like affiliation with the Nazi youth.'
Not unreasonable?
I suspect if 5-10 people who got MIT "yes" did this, MIT admissions and the MIT President would go batshit.
(You can do this even if you were on the fence about MIT, or even if you intended to go somewhere else anyway.)
Anon should promote this plan to HS seniors on the admissions boards and other forums likely to be frequented by top school applying seniors.
Imagine if a thousand members of Anonymous staged a non-violent protest at MIT, marching across campus. This would inconvenience some students, possibly even prevent them from attending class. Should this protest be condemned as an unconscionable attack on students? Of course not. It's a perfectly acceptable form of civil disobedience. Why shouldn't this extend to online protests via DDoS?
Marching down a street and merely disrupting traffic is thus quite legal, however, if your marching causes dangerous disruptions to traffic (i.e., accidents), then it is not.
Deleted comment
But they're not sending a message to MIT, because the systems they are attacking don't matter to the faculty or administration. They're just creating a mess for the student volunteers.
Maybe we are giving the attackers too much credit. They may not be sophisticated enough to understand the relationship between the system they're attacking and the rest of MIT's infrastructure. More likely this was low-hanging fruit, an easy to attack, ergo it was attacked.
Especially if the message of the attackers is "people who break into the network shouldn't have the cops called on them." (Although we should wait for Hal Abelson's report to find out what happened behind the scenes.)
That was my general reaction to protests on campus when I was a student there. I often saw the same general pattern I see here: protests would be highly visible and inconvenient to the people who couldn't do anything to address the issue, and would have no impact at all on the people who could.
They are fully capable to look at the issues and take moral responsibility for the University they are part of.
How can an intelligent person support a organisation by being part in it, then take no responsibility for what it does.
Yes I know the commoners do this all the time for their entire lives, but being better educated (However you do it) is about moving on from this simplistic me me me mentality and looking at the total issue.
Being a student at MIT (or an alum) does not automatically imply support for everything MIT does. That said, I expect many MIT students and alumni to be paying very close attention (as I am) to the investigation that Prof. Abelson is conducting, and what follows from it. And I expect that MIT's administration knows that. But I seriously doubt that this DDoS attack will make any students pay attention who weren't paying attention already.
If MIT did something wrong and you go to MIT you are responsible for being part of that organisation. No one is forced to go to MIT.
Take responsibility for who you support, be it a university, club or a job.
If you think MIT did nothing wrong, then say they did nothing wrong. Don't say I'm a member of MIT but nothing bad(= short internet issues) should happen to me cause I'm just one of the many in this organisation.
If you're trying to get the student body on your side, you're doing the exact opposite. If I pay $X/year to attend an institution, and someone wants to fuck with my ability to learn to further their own political goals (no matter how noble) you're not winning me over.
If your parents or government have not already paid for your tuition I urge you to think of something else to do with that money.
People who are sympathetic to political action tend to become significantly less sympathetic when they are personally inconvenienced by said political action. And their ire tends to be directed at whoever they see as being most directly responsible for their inconvenience.
I am someone who broadly agrees with Aaron's goals. I agree with the principle of the protests. And it is for exactly THAT reason that I am squarely against this DDoS attack.
It's not like MIT has apologized for this, either.
As for MIT's response, see http://web.mit.edu/newsoffice/2013/letter-on-death-of-aaron-... for something that suggests that something much more useful than a formal apology is coming. If you're inclined to be cynical about the inquiry that we've been promised, I highly recommend researching Abelson first.
Of course this is too little, too late for Aaron Swartz. But I couldn't have asked for an MIT president who presumably does not have the full picture to have made a more meaningful gesture.
Why don't they go and physically remove administration from the MIT and never let it back?
It seems impossibly unlawful when I write this but you know, there were times when students had a political agendas and they used to run over campuses, barricade them and battle the police. And now it's like "we're gonna hate them for life and not do a thing".
I understand I'm telling other people what to do but then again, the OP tells other people what to do[n't].
It's not their property, and no amount of "cause celebre" or "protest du jour" should make it such.
And when you come to think about it, how can an university be someone's property? Surely you can own buildings, but how do you own education and knowledge?
Putting up the messages on those department sites won't inconvenience a bunch of people, but this might.
Would you accept a Word.doc that required scripting to display itself? Shouldn't the response to a non-visible blog post be WTF?
(Strangely enough, I am able to read the page w/o js, but responding in general to this type of comment I see on HN frequently.)
Hostile images may exist but they are an order of mag. or two less common of a threat. Of course, where to draw the line is subjective, but the idea that blocking js by default is silly is misguided, imho.
http://www.mozilla.org/security/known-vulnerabilities/firefo...
http://googlechromereleases.blogspot.com/2009/08/stable-upda...
The internet is way better when you don't allow all of the annoying to dangerous JS to run.
At least it is my experience, that without NoScript any given site will either take half an hour to load, or have some annoying ads, as an overlay over the content. ( Not to mention videos which start to play automatically, flash banners and sound effects.) Seriously I have no problem with an advertisement which just displays a picture or text. But any possible use of JS in a ad is a use I do not want.
Deleted comment
If you're worried about security, run Linux or OSX as your operating system.
You do know that Java7 (also part of the web) has a cross-platform 0day exploit. Your OS will not save you here (layered defense might help though).
Something as inelegant as click-jacking will not be prevented by your silver-bullet OS of choice, either.
> Javascript is as much a part of web content as html.
Why is javascript required to see content for a simple blog page?
In particular, note this part: "Scripts is MIT's largest web host but it's run entirely by student volunteers. Any and all attacks that are supposed to get the attention of the administration are instead being handled by SIPB members."
Presumably, the author would feel differently if the ones actually affected were those responsible for Aaron's death, even if the author was personally inconvenienced.
Lumping everything connected to 'MIT' together as the same evil thing is shortsighted and counterproductive.
Taken to the extreme, this line of reasoning is what makes certain terrorist groups think killing random civilians is acceptable. After all, if you're a citizen of a country then you should be held personally accountable for all the perceived crimes perpetrated by your government, right?
Or is that the goal? To make MIT stop being so open?
Also, this is MIT, the biggest threats to their network live on campus and are poking around on that network every day.
There's an uncaught TypeError in common.js:40 (looks like jQuery.browser isn't getting defined?) which seems to cause the blogger object to not be created, breaking classic.js and gadgets.js nearly immediately.
Ridiculous
http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.jsNext question - why doesn't everyone get the blank page?
EDIT: By your profile, i'm guessing you're also in NZ - Looks like they might have just pushed the update out to only parts of their CDN.
I respect those that take chances to risk their freedom for the good of humanity. For example, if a government were lying to its people about something that was negatively impacting them or their future, and only bad was coming from that information being restricted, then I could not argue with those that took on risk to release that information. I could not support doing anything illegal, but I would at least respect it. But, busting on MIT has no value I can see, and in-general attack-oriented hacking is just as bad as the Cobra Kai.
Indeed it does raises eyebrows, the timing of this, but lets not jump to conclusions without solid facts.
-1 for this article. Sorry Sweettea, No offence meant.
"A few class websites are inaccessible, a few friends' blogs are down, and web development is a bit annoying"
That's the most selfish thing I've seen today.
No argument why this form of protest won't work just it interrupts your current lifestyle.
And IMO it will help, it keep momentum and adds publicity to the other means also going on.
Many MIT professors make their academic articles freely available on their lab websites. As Anonymous continues to attack the MIT network, they are making it more difficult for members of the general public to access academic articles. This isn't about open access. It's about exacting revenge for Aaron Swartz's death. Unfortunately, it's targeting the wrong people.
> No argument why this form of protest won't work just it interrupts your current lifestyle.
MIT students would support an effective protest that interrupts their lifestyles, but attacking student-run websites won't work because the only people who suffer are students who have to clean up after you. The people responsible for Aaron Swartz's prosecution couldn't care less.
Given what may happen if change can be made is this really anything? This is how most of the mostly 3rd world student/academics live 100% of the time for most articles.
They are not attacking students sites AFAIK they are attacking the MIT network I really doubt the Faculty are not seeing this and thinking.
This is an attack for unproportionately persecuting someone for trying to free up scientific information. I don't see it as revenge for his death.
DoJ won't change, but academics might.
Deleted comment
Back to the content of an article: Aaron suffered for nothing, but the student thinks that he should be extempt from suffering for nothing. What makes him think so? Life is pain.
He should be feeling shame right now, excruciating one, but instead he tells other people what to do and don't.
so, i do apologize if i upset you, and didn't intend to speak to _everyone_ associated with the organization.
in other cases, i would admit that beautiful and wonderful things have come from _individuals_ at MIT...but that is not the context within which my eloquent pair of sentences were made.
however, in this case, it seems that academic snobbery and/or greed was a contributing factor to the suicide of a great individual, and that is enough for me to make my comment.
:)
Quit whining.
I imagine the point of this attack is to effect/inconvenience students so they complain to the MIT administration. The school bureaucracy won't listen to random strangers on the internet, but they will listen to students.
If that's the objective, it's not a very well chosen one IMO. As I and others have posted elsewhere in this thread, MIT is already conducting an investigation, and I expect that students who are at all likely to complain to the administration already know about this and are already watching what happens, and will make their displeasure known if the appropriate action isn't taken once the investigation is complete. I doubt that this DDoS attack will have a significant effect on that.
Plus, as has also been posted elsewhere in this thread, investigations take time. Is this DDoS attack going to continue until it's finished? How does that help? Or is the objective to get students to demand heads before all the facts are known? How does that help?
If you belonged to the Westboro Baptist Church or some other group it'd be legit to claim you're responsible for their actions to a certain degree.
Why do MIT students get a special exemption from the chain of responsibility that applies to everyone else?
If you are a member of a collectivist institution it's also your responsibility to take what action you can to shape its moral aspect. And to be silent is to abet.
I fear you're cutting off the nose to spite the face.
And these frequent DDoS attacks are partly to blame for Aaron's death, it's the reason why prosecutors are so hardcore about "hacking" or anything vaguely similar to it.
I am not associated with MIT. However I consider Abelson's forthcoming report as being more representative of the organization, than whatever random administrator was dealing with the prosecutor. Abelson was undoubtably there before the administrator in question, will be there after, and is far more widely known than the currently faceless administrator.
Look at http://en.wikipedia.org/wiki/Hal_Abelson then get back to me on whether that is a reputation that a student should be proud of or rejecting.
Imagine you're a student, halfway through your 4 year program at MIT... You don't know Aaron, or anything about his situation. Yes, you get an exemption from blame, because it has nothing to do with you and it's not your business. You cannot just exit and go elsewhere without seriously hurting yourself.
When you're enrolled at a University, you are not part of a collectivist institution, you are a customer at a business. If you choose to go elsewhere, that's on you, but who is anyone else to tell you what you should do? You're starting to sound like the WBC...
Likewise, customers have social responsibility in their purchasing decisions, and transferring credits to another school isn't all that huge of a deal, either, so I'm kind of finding your take a little overblown. Obviously every student at MIT volunteered to come there, too.
What an excellent way to win the hearts and minds of the MIT student body. Congratulations you've managed to belittle and alienate the same people you'd want on your side!
You know what it represents now. You choose to continue to be associated with them. That is not an innocent decision.
Any cause would do well to distance itself from people who compare MIT to the Nazi Youth[1]. Extremes don't help.
You do not help the cause you claim to support by screaming, spittle-flecked, at passers-by.
[1] - http://boston.com/metrodesk/2013/01/14/mit-hacking-case-lawy...
The fact that people find it impossible to keep their hands clean is a fact of life and of human nature, but that shouldn't just excuse everyone. It should be a reason to try for better.