Hacker News Reader

Comment by noonespecial | Hacker News Reader

AT&T leaves the door open with your stuff inside. Its a little different. They should have some responsibility to protect all that personal goodness they seem oh so willing to demand of you.

View on HN

You are all making the mistake of conflating data copying with theft. The real reason this is fucking ridiculous is that he was using the internet to lookup an address and got information without any trespass, but was charged anyway.

It's nothing like stealing, it's more like being arrested for taking and distributing photos of a home taken from a public road.

If someone steals my laptop from your apartment, the person stealing is still guilty of a crime. Depending on our arrangement you may also be liable for the loss of my laptop, but that doesn't excuse the thief's action.

What if you leave a laptop sitting in the middle of the street with no identifying information on it and no password required to login. I would argue that picking that laptop up and keeping it isn't theft but rather simply FINDING it.

In this case AT&T put the laptop in a brown paper bag (in the middle of the street) and then were shocked, SHOCKED that someone would open it up to see what's inside.

EDIT: Security through obscurity is no security at all.

It is actually theft to take a laptop in a brown paper bag in the middle of the street unless there is an indiction the owner intended to abandon it. Finders are supposed to make efforts to locate the owner or otherwise turn in what was found.

Which is kind of what weev did by reporting it.

The words "kind of" are doing a lot of work in that sentence.

In the sense that he made the owner aware of it.

Agree with tptacek - by "kind of" you mean "not at all" what he did.

When it's a laptop full of customer information left around in the street - as this analogously was, do you tell the company so they can cover it up or the news so people know to watch for fraudulent charges?

Weev joked about a lot. Stuff that would have been fitting to have happen to AT&T considering their negligent practices and disgraceful follow-up, but if we're guilty of what we joke about ...

Somebody cannot steal things from my apartment without being in a jurisdiction that I presumably have decided is sane.

Meanwhile when AT&T forgets to lock the door to the stuff I have entrusted them with, anyone in the world can get at that. AT&T relying on the law being able to eventually get baddies after the fact is not sufficient.

I believe that the person doing the stealing needs to be held responsible. I also think that the entity holding the data needs to be held responsible for a lack of security. If your kid is kidnapped from a daycare because they didnt lock doors or have any security measures they can be held accountable for that as well as the kidnapper.

To be fair, there is a difference between actually stealing your stuff, and just walking into your house to prove your security sucks.

It would be like if I just opened up a bank vault and walked inside and shouted "Hey, this bank sucks, no one put your money here!" without actually stealing anything.

Yes, there is a difference. And Weev could have downloaded one e-mail address just to prove his point.

That's just concern troll nonsense, or what someone who'd never heard of software would say. It's easier to download a range of IDs than to guess which ones are valid.

And "three email addresses leaked - hacker claims more could be at risk" is pathetic and you know it would be ignored. By the company, by the news, and ultimately, by users.

Also, there's a fallacy here. You admit it's reasonable to download, leak, etc, but then make it seem unreasonable because he did too much of it.

The joke of it though, is that ultimately you-all can piss and moan about your convenient morals, but what Weev should have done - by your "anything legal is A-OK" standards - is to emigrate to Russia (or elsewhere) and sell the data to a local "security firm". Then he'd have been rich, and safe, and AT&T would either be secure or out of business.

But instead he did the honest thing (and inconvenienced a wealthy corporation in doing so) and suffers greatly.

Next time, zero-day through Tor. Just saying.

Customers should be the ones punishing AT&T. The government could do a better job advertising the security failures to potential customers, rather than pursuing legal action for mediocre fines.

True but customers MUST be willing to vote with their dollars and so very few are. I have countless friends or acquaintances who constantly complain about a service/product/provider/etc and I simply tell them to switch or stop using said service. Rarely will people stop because it's simply too "inconvenient".

If you and large numbers of others don't vote with your wallet, do not expect change.

Or maybe we should accept that security ultimately doesn't matter.

Unless I'm remembering this incorrectly, didn't he get given the data? I don't think it was him who discovered the flaw. Sort of like handling stolen goods, as they were duplicated without permission, he then tries to profit from this (iirc he admitted this). If he had followed responsible disclosure principles, he could have even created a nice media circus for all. As is, I can't understand why he should have sympathy for him. Sure AT&T messed up, if it was under UK law I would hope the Information Commissioner would fine them. He showed contempt for the law, and got a sentence that matches.

Given his previous history of not telling the truth, I'm not inclined to believe this is anything but business as usual for the US prison system. Not that business as usual isn't a bad thing.

Sure, but that doesn't excuse the thief. In a 'just' world the thief would go to jail and AT&T would suffer fines, private lawsuits. The people responsible for the lack of security would also be fired.

Reply on news.ycombinator.com