Hacker News Reader

Comment by zalzane | Hacker News Reader

Every time I see a ruling like this, I can't help but think that future historians will view this time period in the same way that present day historians view the crusades/religious persecution/witchhunts of the past millennium.

It's amazing how much point of view can change perspective.

View on HN

I don't think this particular case is black and white. Judging by my Twitter feed, a number of security researchers and white hats feel the same way I do: the law as it stands is not good, but what Weev did was also really, really unhelpful and borderline stupid.

Rather than disclosing to AT&T, he leaked it directly to Gawker, and discussed how to potentially abuse the data he had (by shorting the stock, selling the e-mail addresses he had collected to spammers, etc).

The sentence is absolutely disproportionate. But there are so many ways in which the guy could have handled himself better. I think a lot of people in the infosec industry are simultaneously angry at the sentence but not massively empathetic with the defendant.

What I'm trying to say is that as a test case or campaign to change the law it's far from ideal.

Sounds like a bunch of victim blaming to me. So the guy is an idiot, is that enough to go to prison now?

...you did read the bit where I said "the sentence is absolutely disproportionate"? I think you can be a victim and a bit of an idiot at the same time. I'm trying to point out that in terms of changing the law so this sort of thing doesn't happen again he's hardly a fantastic poster child.

>Sounds like a bunch of victim blaming

Ironic that you should say that, considering that Weev's defense is essentially "her parameters were all hanging out and it was just so easy."

No weev's defense is that... it was a public URL... Do you really want to set a precedent that companies get to decide after the fact that some public URL you surfed wasn't meant to be public so now you go to jail?

He didn't expose some flaw or weakness. ATT knew that information was there, they were the ones that put it there. Weev was pointing out a negligent mishandling of data. ATT already has shown that they suck at vendor response. I think he has a duty to inform the public when there is an issue like that. If he had gone to ATT first, they likely would have lawyered him into oblivion, and kept their shitty service online.

This argument is very commonly made, and that's unfortunate because it is fundamentally flawed. Just because AT&T left the information exposed is not sufficient justification for some random person to take it, especially when that person takes it with the explicit intent to cause harm AND profit from it.

First off, what profit? Weev can be described by many negative terms, but greedy has never been one of them.

Secondly, if a company posts something publicly, people in the public are going to see it. My mind is incapable of comprehending the logic of anyone who would say "Just because we posted it on our website doesn't mean we wanted anyone to see it."

The first amendment makes no distinction between someone who says "Hey your shitty website is broken. And I'm telling everybody." and someone who sends a private email, hat in hand, saying; "Excuse me kind sirs, but I can't help but notice that your security procedures are somewhat lacking."

And oddly, if one of those is a crime, so is the other.

Does the First Amendment make a distinction between a person in a crowded room shouting "I love U2" and the same person shouting "Fire"?

I'm going to go ahead and suggest that the answer is "No, but we as a society make a distinction." Same princple here. I believe the general principle is that you have freedom of speech, but you do not have indemnity from the harmful consequences of your speech.

The judge who said that the 1st amendment doesn't cover shouting fire in a crowded theater used it as an argument to jail people for handing out anti-war fliers.

So it's not even appropriate for me to say that it's a slippery slope, because it started at the bottom.

Although the application is questionable, I think most people agree with the principle — you are free to speak your mind, but when your speech ventures into the realm of action, that action is not necessarily protected. For example, ordering a hit on someone is not protected even though it is technically just speech.

The point is one should not be punished because he is unhelpful or stupid.

Yes, because putting a very small number of people in prison for a couple of years is the same as a series of wars that lasted three centuries in which millions of people died.

That will depend entirely on who ends up writing the history books.

Reply on news.ycombinator.com