Hacker News Reader

Comment by sho | Hacker News Reader

Wow. Anyone who owns, or hopes to own, an internet-based community of any type should read this, just to get a sense of the sophisticated methods and the lengths trolls will go to. While I have to hand it to this guy for deviousness and persistence, he is, after all, the "enemy" as far as the Web Site Owner is concerned.

It boggles the mind that anyone would do this, but they evidently do, and you may well have to defend against it.

View on HN

History is littered with the blood of people fighting over social issues... We shouldn't be too surprised by the lengths, but the appeals for security concerns rings loud and true.

He could also be seen as a free security consultant. What he did basically amounted to a victimless crime, but could have possibly been used for something worse. If Amazon has one CSRF vulnerability via an improper use of GET, there may well be more. This incident may help them tighten their systems against more malicious attacks.

How is it a victimless crime? The authors and publishers of all the books that lost sales rank were directly harmed by it. By not showing up in searches or bestseller lists, their sales were affected.

For 48-72 hours, some books appeared fewer places on Amazon's site.

Many of those same books got lots of extra attention from elsewhere, as examples of affected titles.

So some authors probably lost a little, others gained a little (by either being examples, or simply filling the slots emptied by affected titles).

If the loss to specific titles was significant, Amazon could easily restore the previous balance with a few days' enhanced promotion. So the amount of 'victimization' here is pretty small.

Perhaps we are forgetting that Amazon is a victim as well. If Amazon is unable to seek punishment against malicious users of its site, it is forced to spend its time and money patching security holes and preventing future attacks, in addition to repairing lost good will from customers and authors.

It always surprises me how quick people are to jump to the conclusion that the website operator is at fault for these sorts of malicious uses. It flies in the face of simple economics. The burden on Amazon to protect its site probably ranges in the thousands or millions of dollars; the benefit to the malicious user is a couple of laughs and a funny blog post. It would seem economically inefficient to say that the burden lies on Amazon, in this situation, to protect itself.

(Indeed, I don't believe anyone would analogously say that a thief is not responsible for acts of theft, because they provide a "free lesson in home security" to the victim. Why the difference when we move to the online realm?)

Even if one could accept that Amazon cannot possibly plug all vulnerabilities and should not be expected to do so against all attacks, we're still left with the obvious mistake of implicitly entrusting their users with the ability to -- automatically and without proper vetting -- alter whether or not certain items display on certain areas of their site. This fact, given automation via a bug or not, means that the tactic could have been used more maliciously and more covertly to bring additional damage (say, by getting an author's book delisted).

At the end of the day, do I think Amazon really deserved to be "taught a lesson"? No; he could have just contacted them with the exploit and been done with it. Could it have been worse? Most likely, yes. Plus, I found the resulting e-uproar to be quite hilarious. To think, people actually believed Amazon would intentionally and openly discriminate against those groups out of no where... it's very laughable, you must admit.

But what if trusting users works 363 days a year -- it helps users find and buy more books, it makes authors and Amazon more money. Every once in a while, it causes an embarassing screwup that can be reversed in 1-3 days.

Is having that system in place a mistake? What if the alternative system, that never has a 2-day-screwup, also means fewer lehappy customers and less-profitable operations the other 363 days?

I see your point, but also that of the parent post. Is losing salesrank of a novel over the weekend (a holiday weekend no less), really a boom-or-bust kind of thing? If he'd been more malicious with this then this would be a crime with actual victims, but in this case I just can't reason through it enough to believe that.

How many customers did Amazon lose this weekend that will likely never hear that this was a hack? He directly and irreparably harmed the reputation of a company, how is this victimless at all?

He may have hurt the reputation of Amazon, but not through his crime. Publicizing vulnerabilities in Amazon's ranking system is what may hurt Amazon's reputation. The "crime" of messing with Amazon's system didn't hurt Amazon's reputation let alone their website much at all.

You could also go out in the street with a sign that says "Amazon sucks" and it would probably deter as many people as this did.

Well, that's simply not true. If it was he wouldn't have done it.

While I admire the guile and technical reasoning required to pull this off, it's high time the community at large stop admiring this type of crap.

Authors of the books in question lost real money. It doesn't matter how much. Amazon lost credibility from all sides.

There is a difference between screaming that the Emperor has no clothes and stealing his wallet.

If you walk into a bookstore and steal a bunch of books, even on a slow business day and it causes the store/publisher/author to lose sales, but not that much, is it a victimless crime?

What? He didn't steal anything. It's more like standing outside of the bookstore yelling about the owner.

It's more like breaking into the store at night and changing all the signage to read "I molest little children".

Through a door that was left wide open, and in erasable marker.

Valid analogy - but flimsy security is still not justification for breaking and entering, nor defamation.

And?

The intent is the same whether or not you walk through the open door or break the window.

You're right. Replace "steal" with "deface"

Amazon is losing a lot of business in the GLBT community, historically a reliable demographic group in both online spending and books. (This actually wouldn't be so bad if they had been more forthcoming, and quickly made a statement apologizing profusely. However, just saying that there's a "glitch" after customer support had suggested that much of the material was indeed adult in various posts hovering around, this has resulted in a significant loss of goodwill.)

As for me, I'm considering looking for a new default myself. Powells, here I come?

> As for me, I'm considering looking for a new default myself. Powells, here I come?

Why? You know it was nothing more than a CSRF by a troll. That's like saying you're not going back to a store because it got tagged by some punk kids one night. As long as they clean up, what's the problem?

As an aside, if you ever go anywhere near Portland, Oregon, go to Powell's, and don't forget to visit Powell's technical too. I really miss those stores (I miss less all the rain that makes sitting inside and reading a compelling alternative so much of the time...)

Oh come on. They'd lose way more money if it were widely trumpeted that they're making a buck off what I'm assuming is literary homo smut.

Analogous:

Someone breaks your car window with a brick, but doesn't steal anything.

You thank them for showing that car windows aren't brick-proof.

And also, less people want to ride in your car. How nice!

Apparently, this guy seems to be a long time troll:

http://valleywag.gawker.com/5032989/journalists-do-it-for-th...

http://www.nytimes.com/2008/08/03/magazine/03trolls-t.html

Reply on news.ycombinator.com