Hacker News Reader

I'm just fine with Aleynikov's conviction being overturned. Again, the charges against him seemed ambitious.

"Ambitious" is a bit charitable, in this context.

"Patently vacuous" -- to an extent that suggested, at the very least, a breakdown in the internal controls and safeguards (on the part of both the FBI and the prosecutor's office) designed to present precisely this kind of a fiasco from happening -- might be a better description.

You are being ridiculous. Aleynikov definitely violated New York trade secret law. He got off the federal charge because the trading software wasn't a product for sale, it was a product for internal use. The law was poorly drafted and once that came to light it was immediately fixed.

Like Rayiner said, in layman's terms, he got off on a technicality.

The FBI and DOJ being on the wrong side of a close call in statutory interpretation isn't "patently vacuous."

Aleynikov definitely violated New York trade secret law.

That's not what the court found. Otherwise the charges wouldn't have been dropped.

It sounds like you're conflating the issue of whether he violated the "spirit" of the law (or whether he was, in your view, just plain morally culpable somehow) -- versus what the law actually had to say about his actions.

Like Rayiner said, in layman's terms, he got off on a technicality.

If you want to minimize any sense of exoneration or vindication the accused might want to derive from the court's decision, by saying he "got off on a technicality", that's fine.

But to claim that he "definitely violated" the law when the courts found that he definitely did not -- I'm just not sure I see the point in that.

>I have a passing understanding of the policies and procedures binding on developers at trading firms.

I've never set foot in one, but one thing I have learned watching this incident and others is that some of theses firms have varying degrees of carelessness and cluelessness within their businesses; especially with respect to IT (Knight Capital comes to mind). In that respect, they are like any other company, some careful and fastidious, some, flying on a wing and a prayer.

>This is the code we, as security testers, were never allowed to see, even after owning up the machines hosting it. These firms are not kidding around about this stuff.

I may often disagree with some of your opinions here, but I can't say that I have the impression that you're not competent within your profession or that you lack integrity. It occurs to me that the firms that would hire your firm to audit them as opposed to some lesser outfit, are the same firms that run a pretty tight ship in their own businesses. Has it occurred to you that not all trading firms or even divisions within the same company are cut from the same cloth?

>These are firms where you can be fired for plugging a thumb drive into your computer

Yeah, I've seen some companies with ridiculously conservative IT policies. I can see it being applied at a bank or a trading firm. The policies are often meaningless though, when the policies basically state that you can be fired for doing anything, but in reality that doesn't happen. I've worked at one of those companies where a too-large portion of engineering's time was spent circumventing IT systems, activities for which one could've been fired. Those companies always have plenty of ways to fire people.

>I also dispute the idea that because developers commonly use ssh, gzip, and svn, that it is common practice to

I remember about ten years ago working with an engineer whose idea of a source code revision control system was to zip up and password protect source code archives. It may not be common, and Aleynikov wasn't doing it for the same reasons, but by itself, it isn't proof of anything nefarious.

>There was more than sufficient evidence presented at trial, however, for a rational juror to

Interestingly, none of the jurors were employed in tech, and none had a college degree. Not that it would always be necessary, but it is worth considering the possibility that none of them understood what they were being told. It's hard for me to agree that situation was rational unless those were some exceptional high school graduates.

>But this is a forum full of software developers. Rayiner is a lawyer and a compiler developer. It's somewhat insulting to everyone's intelligence to pretend that people here are unfamiliar with ssh and svn.

If you or Rayiner don't like my tone, I'll tell you that I think it is a bit of an embarrassment to have to point some of these things out here. Maybe Rayiner will have enough respect in the future not to parrot statements from the FBI's and the prosecutor's press releases. We've all been spectators here of a number of high profile prosecutions of software developers, and if there is anything to be learned from those experiences, it is that prosecutors and FBI agents will characterize the suspect/defendant in the most damning light possible. Anything that one of them says has to be taken with a grain of salt.

>We understand how software development works. What happened here was extremely sketchy.

Probably so, but not necessarily so, and not on the basis of some of the things ITT.

>You can't play the "well in the world of software development, this is totally normal" card on HN.

It is laughable. I'm probably one of the least qualified people to lecture to this audience, but here it is.

Pretty sure my local git repository contains thousands of lines of valuable proprietary code (granted on a hardened dedicated work laptop), mixed with open source libraries etc.

And I also delete my bash history all the time if I do something stupid like manually enter a password into the command line.

One thing to keep in mind is that Aleynikov is clearly one of those rare types for whom the technology is an end in itself rather than a means toward anything. That leads to a type of naiveté about following IT security policies. I don't know quite what the proper name is for this disposition, but we've all encountered them.

>I also dispute the idea that because developers commonly use ssh, gzip, and svn, that it is common practice to (1) gzip a tarball of source code, (2) encrypt that source code, (3) commit that compressed encrypted blob to svn, (4) remove all traces of the encryption key from their work computer. That's something happens zero times on normal dev machines.

Agreed, but it was established that he did this fairly consistently throughout the course of his employment. It's idiosyncratic, but not unexplainable. Sure, it was poor development practice, but I'm not convinced it was malicious.

Again, if the intent was trade secret theft, why not take the valuable part, the trading strategies?

The court found that he took large amounts of "the valuable part". He did more to cover his tracks than delete his bash history --- which my comment didn't mention. I feel like you're repeating talking points rather than addressing what I wrote.

I directly quoted you in addressing your point.

With regard to the "valuable part," financial experts will tell you that lives in the trading strategies, which he didn't take. You must admit that's very odd behavior for a malicious thief.

You keep trying to shift the focus to the trial, when what disturbs me and so many others is not the trial or its findings.

Whether or not he actually stole the code is immaterial to whether the FBI did a proper investigation prior to arrest, or whether Goldman Sachs received special treatment because of their size, wealth, and power.

Your comment and mine are right there for people to see. I stand by what I just said.

Agreed, and as do I. Perhaps our tone has gotten too rancorous.

Civil people can disagree without being disagreeable, and I know from your comments around the site that you're a civil person, so if my tone has been less than appropriate I apologize.

As for the conversation itself, as you said, it stands as is, and we can let the other readers judge the facts for themselves.