How to cause moral outrage from the entire Internet in ten lines of code
community.livejournal.com
community.livejournal.com
It boggles the mind that anyone would do this, but they evidently do, and you may well have to defend against it.
Many of those same books got lots of extra attention from elsewhere, as examples of affected titles.
So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles).
If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.
It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself.
(Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)
At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.
Is having that system in place a mistake? What if the alternative system, that never has a 2-day-screwup, also means fewer lehappy customers and less-profitable operations the other 363 days?
While I admire the guile and technical reasoning required to pull this off, it's high time the community at large stop admiring this type of crap.
Authors of the books in question lost real money. It doesn't matter how much. Amazon lost credibility from all sides.
There is a difference between screaming that the Emperor has no clothes and stealing his wallet.
The intent is the same whether or not you walk through the open door or break the window.
As for me, I'm considering looking for a new default myself. Powells, here I come?
Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?
Someone breaks your car window with a brick, but doesn't steal anything.
You thank them for showing that car windows aren't brick-proof.
http://valleywag.gawker.com/5032989/journalists-do-it-for-th...
If this story turns out to be true (seems perfectly likely) maybe they'll finally start taking them seriously and fixing them.
What a whackjob. Quotes:
"I contend that trolling is the chief moral arbiter of the Internet. I see little difference between the methods performed by trolls on the Internet when they ruin the lives of furries and pedophiles and the methods used by Moses when he ordered the idol worshippers killed. Martin Luther contended in his tract "On the Jews and Their Lies" that if Moses were alive today he'd be busy burning synagogues. I'm inclined to agree; the only thing keeping us deriding furries on the Internet instead of going to their furry conventions and rapidly exterminating them is the Jewish influence upon society."
"I used to be for the mass extermination of the physically disabled, but my business associate Claudia reminded me of how the ancient greeks made an effort to find means of living for their disabled; Homer was blind but still managed to become a defining influence upon Western civlization. I believe that without the narcotic of state welfare these people would find a positive means of living."
"Upon some timeline Protestants are going to have to stand up and admit that it is their belief system that made their nations so great, and that without their persistent influence they will degrade into the third world shitholes from which they began."
I guess it is easy to be a prick when you are only looking at pixels.
I've got NO doubt that this is going to have a noticable negative impact on Amazon's profits. Not world shaking, but more than enough to make the lawyers angry.
As another commenter mentioned, he's been in a NYT article, with his face and full name displayed. Amazon won't have any trouble finding him.
He's like the kid dropping rocks off the overpass for shits and giggles - pathetic.
Yeah man. Except for the overpass, and the kid, and the rocks, that is a very good analogy.
While he's certainly mischievous and possibly malicious, he didn't actually do anything that I think should be illegal. He merely used Amazon's flawed system against them, at considerably personal expense. He hacked them, in other words.
I can't agree with his aims in this case but you've got to hand it to him really - you don't have to like trolling in general to admit that was an amazing troll. It shouldn't be illegal and he shouldn't be able to be sued. Society would be worse for it, counterintutive as it may seem.
The quality of the troll is also irrelevant. The fact that you commit a crime really well doesn't make it any less illegal.
That said, I'm not certain what he did should have been illegal. But I can't think of a single reason he shouldn't be sued. There's no way he didn't forsee loss of revenue for Amazon. If you deliberately cause harm to another person, even if you work out how to do it without technically breaking the law, they should absolutely be able to get their loss back from you.
How the hell should anyone be able to drag someone through the courts on the grounds that they might have lied about about feeling sick or not? And what could you possibly do when he just says "I did feel sick" - "no you didn't"? Yes I did, no you didn't?
I don't think you've given much thought to the complexities here. Laws have to be workable and practical and err on the side of freedom of speech and action. Trying to legislate niceness and truthfulness is pure folly, especially considering the imbalance of power between a corporation (or restaurant!) and a person.
I would suggest that a reasonable demonstration of evidence supporting the claim should be required before the other party is even notified and such a requirement have no impact on the actual case. Also a public defendant should be provided to defend you etc. Basically, a presumption of innocence until demonstrated otherwise.
Consider the small startup eating an established business's lunch; surely the startup isn't liable for the losses of the larger company.
There were ways Weev could've made his hacking skill known without such negative impacts. He cared more about the notoriety than preventing harm to bystanders. (Though to be fair, he probably has rationalizations for why these weren't "real" negative impacts.)
I never said what he did was ethical, but I'm trying to say that just because an event reduces revenue doesn't mean its something that can be sued over. IANAL but it would have to be on the grounds of libel. (Which is likely, but parent never brought that up)
Registering multiple false user names?
Giving false feedback?
Restraint of trade?
I'm not a fan of government prosecuting someone for registering on Facebook with the user name "Joe Schmoe" in order to blog anonymously about their crappy job at Microsoft.
...but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?
> He merely used Amazon's flawed system against them
I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me.
"Oh, all I did was hang a sign in the window saying 'A child molester lives here' - what LOLZ!"
Yeah, OK, great, that's a wonderful "hack".
This guy is a jerk, and he's making society slightly less good. As a society, we should try and avoid the tragedy of the commons, or else we won't have a society for much longer. Someone needs to remind this guy, in an official capacity, that his actions are not appreciated or tolerated.
Amazon shouldn't just blindly accept data and trust it is legitimate.
Same with creating false accounts.
You can't really compare it with breaking and entering a house.
At the end of the day, IMHO this shouldn't be illegal, and no action should be taken. Amazon was extremely silly to accept user flagging from a GET request in an iframe.
How is what your're saying different from, "I didn't send those DDOS packets, the lusers executing my trojan program did!"
How about: "IMHO, that shouldn't be illegal. Mrs. Smith was extremely silly to believe that a consumer door lock and sticking her life savings under her mattress was a good way to secure money."
The correct response IMHO is for Amazon to realize they were stupid, and fix it. If you sue etc you put out the signal that being stupid is fine - you'll be able to sue someone if they take advantage of your stupidity.
But then we live in an age where if someone doesn't tell you explicitly that your coffee is hot, and you spill it, you can sue them...
Also, you can argue that not suing is sending out the wrong message -- that manipulating the flagging mechanism is cool, so long as you're a cool, clever hacker.
If I was running a business, and my employee left a storage shed unlocked, I shouldn't prosecute the thieves because I did something "stupid?" Uh, no. Most people would suggest that you make sure locking the shed is on the checklist and you prosecute.
Someone else being stupid doesn't give you a "Get away with being an asshat" card.
It's like those people who buy those terrible cheap car alarms that go off at anything at all and then don't stop for an hour. Their car is sitting there, ruining everyone's quality of life with its incessant blaring. Can they just excuse themselves by saying "well it's not me, it's the car alarm"? Of course not. If you own something, and that something is capable of harm, it's your responsibility to ensure its integrity. Blithe ignorance is no excuse at all.
The door lock/money under the mattress analogy doesn't hold up. Mrs Smith did not invite millions of visitors from around the world into her house to walk around her bedroom, relying solely on the mattress to hide her treasure, and if she had no-one would have much sympathy when one of them eventually looked there. Amazon did invite such behaviour and should have taken appropriate safeguards. This is no-one's fault but their own.
If Mrs. Smith was running a bric-a-brac store and didn't know how to secure her display cases, then it's alright to shoplift from her?
If Mrs. Smith was holding a big party at her house, then it's alright for a party goer to steal her life savings?
If I hand a firearm disguised as a jelly donut to a random bystander, then they shoot someone with it, it's their fault and not mine?
Amazon messed up. It doesn't justify Weev's action. He could've just told them. Deception and malicious intent are markings of crime or antisocial behavior. That's just common sense!
The fact is, nothing was stolen and no-one died. You're all about "intent" so intend this: this whole story is one guy exploiting Amazon's flawed security to annoy gay people.
I do not even like Weev. This is nothing but principle, namely - should the government be papering, with the full force of the law, over the cracks in Amazon's security?
I say, "no". You say "yes". We are each convinced of our righteousness. Let's leave it there.
Someone absconding with that bag is stealing. Period. They didn't pay for that bag, why are they leaving the store with it? The thief is wrong. Nothing grey about that.
The problem here is that Weev's intent was to deceive and have a particular group's books effectively censored. This fits in with Amazon's Terms of Use? I don't think so. There is no grey area. If Weev wanted to improve the world with his hacking, there are tons of ways he could've done this without hurting anyone (reduced income), deceiving anyone, or running afoul of the TOS.
Prediction: if you go any further, your analogy generator is just going to illuminate how far you have to grasp for straws. (And I'll also note that I have been careful to construct relevant analogies, usually 2 or 3 at a time, picking the best fit. Also, your feedback in the discussion has resulted in iteratively more damning analogies.)
Let's see it!
Giving false feedback?"
Well then, unless your actual name is "tjic" then we are both criminals right off the bat. And since when is the government in the business of checking whether feedback is "false" or not? That's the company's job. It's not illegal to lie unless you are under oath, and nobody was.
"Restraint of trade?"
I don't see how Amazon's trade has been restrained in any way, shape or form. Unless you consider criticism or bad reputation to be restraint of trade, in which case any criticism is fair game. Very dangerous ground.
"but I have no problem at all with the government enforcing laws against using aliases to log into a system and inject bad data in order to create a public relations firestorm?"
Who says it's bad data? What's wrong with aliases? You're trying to legislate against intent.
And your example of how Joe Schmoe should be protected even though he's slagging off Microsoft - MS will say that's bad data bringing a PR firestorm. It just doesn't work.
"I'd be somewhat pissed if someone used my flawed front door lock (pickable by anyone with a set of picks, 60 seconds to spare, and decent picking skills) against me."
Dear god, not this argument again. Look, physical security is NOT the same as network security. It is impossible to totally guarantee physical security. It is possible, even easy, to create perfect network security. The two are totally at odds. Creating a few fake accounts and submitting some votes (which Amazon encourages) is not even remotely similar to breaking into your house and placing signs advertising your partiality to child molestation.
You are giving Amazon a free pass for their lax security practises, and placing all the blame on some random guy who had the balls to admit he did it. And if it was illegal, the only thing that would change is that he wouldn't have admitted it. You can't have laws like that. You may as well try to make a law that everyone has to be nice.
Under US law, there is no such thing as a sole "actual" name. Any name that you use for non-fraudulent purposes is a legitimate name.
TJIC is my initials: Travis James Ignatius Corcoran.
I have been using it as a legitimate name for 15 years. My mom addresses emails and letters to me using that name.
So, no, I'm not a criminal.
...but if someone signed up for an account at Amazon using 500 different names, and one of them was "TJIC", and the intent was to inject bad data ... yes, that person would be a criminal.
"but if someone signed up for an account at Amazon using 500 different names, and one of them was "TJIC", and the intent was to inject bad data ... yes, that person would be a criminal."
No way. Guaranteeing the integrity of Amazon's Customer Review data is not the job of the state. Guaranteeing the legitimacy of the name(s) used to sign up for accounts is not the job of the state. Assessing the state of mind of someone filling in Amazon's complaints form is not the job of the state.
I am kind of amazed you think the government or the law should be even tangentially involved in any of this.
According to many theories, much of the point of the state is to lower transaction costs.
That's why states get involved in things like creating default rental agreements, setting up standards of weight and measure, inspecting pumps at gas stations, stamping out ponzi schemes, running courts to enforce slander laws (even when the target is a corporation), etc.
I'm a pretty extreme libertarian. I'd like 99% of the government to go away. Maybe more.
...but I'm going to assume that we're holding this debate in the real world, not in a science-fictional Heinlein-esque anarcho-capitalist moon colony. ...and if that's the case, then 99.9% of people think the job of the state DOES include stopping people from intentionally gumming up third party transactions.
Sometimes that's a sign that your point of view is out of whack. (And being able to realize this is a mark of true learning. And yeah, it is painful sometimes.)
What happened here is more like Whole Foods setting out free samples. If someone concocted a scheme to walk out the front door with all of the free samples, I would not be at all surprised if the perpetrator were taken off to jail. "But Whole Foods encourages you to take them!" yeah, right. Something smacks of rationalization here.
Same goes for you, of course ; )
Unfortunately, regardless of who is ethically right or wrong, my view will retain the upper hand, for the simple fact that the network is global, and whatever laws you pass in any country will not, nor ever, apply to all. For this simple reason you must continue to consider security the sole responsible of the proprietor, and assume the complete legal immunity of the customer/attacker (same thing).
"If someone concocted a scheme to walk out the front door with all of the free samples"
I do not particularly care for the idea of the judiciary being involved in rationing out Whole Foods' free samples. I do see your point - theft is theft, after all - but do you really want to make an obvious prank illegal? Outright shoplifting is one thing. Pranks are another, and they were free samples. You're so enthusiastic to consider intent in your other examples, why forget all about it in this one?
It's not the intent as a prank that's the problem. It's the intent to have the particular effect that he did. I'm sure Amazon's Terms of Use would preclude what he did.
If his hack involved writing an innocuous demo script and presenting it to Amazon or at a conference, this would be one thing, and society is better off for the freedom to make such discoveries and talk and write about them. Society is certainly better off when it accords freedom of speech. But academic freedom ends where you start to impact other's freedom of speech. (Like effective censorship of Amazon listings.)
All my life, I've had this background occurrence of strangers have coming out of nowhere to try and haze me with some racial epithet. Almost all of these idiots carry this air of striking some sort of blow for truth and beauty, as if they're defending motherhood and the American way through their yelling and insults. To me, Weev and his ilk have the exact same sort of misguided self-righteousness.
I'm sure the one who hazed that young girl into committing suicide on MySpace felt just as clever and justified.
(Many of those Weev targets may have the same self-righteous chip on their shoulder as well, and may be just as bad in their way. It's just not a productive way to expend mental energy.)
But ultimately, it was Amazon who took the action to remove the listings.
(Unnecessary disclaimer: I'm a huge fan of Amazon, and hardly a week goes by that I don't buy something or other from them.)
But he didn't repaint the signs. At worst, he convinced a few other people to call up the DOT and say "That stop sign shouldn't be there, please change it to a 55 MPH speed limit sign." If the DOT then goes and changes the signs without appropriately verifying, then it's on them...
I realize as programmers that we might think Weev's (purported) actions are directly responsible for the de-listing, but they aren't. It's ultimately Amazon's code that did the de-listing.
If I was an author of those books, who would compensate me for my lost income? You?
Rather funny no?
There are pundit rating sites out there now.
I think my first hack was figuring out how to cover my tracks by making a backup of Netscapes's cache and cookies before going on my adventure then restoring the browser's history back to it's original state as soon as I saw those headlights pour through our dining room windows.
Ah those were the days. . .this was even back before E/N hit the scene.
Amazon has generally followed the tradition of booksellers and libraries in the free world, erring on the side of inclusion, with regard to controversial topics. Given that most of the 'excluded' books were hardly controversial at all -- even anti-gay activists rarely expect major retail chains to drop gay-themed works -- a 'glitch' or hack/prank was always more likely than an intentional Amazon decision.
http://bryant.livejournal.com/672165.html
While the method is plausible, the rebuttal is plausible as well. Who to believe?
Let's face it, Amazon's system probably doesn't require large numbers of users flagging something before it takes automated action, because the average book just isn't going to get that much attention. So combine a likely low barrier to removal with a CSRF hole that lets you trick people into flagging whatever you want them to, and... you get exactly the result people are raging about all over the internets.
And getting so highly rated on HN is that time-honored tradition known as _feeding the trolls_. Please don't feed the /b/ trolls.
Deleted comment
If it indeed points to an unsecured GET statement, that supports the claim. If it doesn't, that opposes. If it did and has been fixed in the past day, that's nearly proof.
Either way, I think this is a cash cow and fertile conditions for any startup whose primary function is a sort of opt-in form of censorship, more or less the startup would act as a proxy for each IP. For the most part, I think their rage is fairly valid since this demographic is probably just old, confused, and sick of scouring the internet for web-sites to block.