Hacker News new | ask | show | jobs
by thawab 2020 days ago
Have you been tempted to build a worm and click send? not to brake anything, just a text popup with an optimistic optimistic quote.
3 comments

only as a thought exercise. the ability to 'switch off the internet' (115 million daily active big corp users) is tempting, but no, not really :)
That's one way to force them to not make bug like that "important, spoofing" and "out of scope".
Google Robert Morris to find out how that goes.
Wikipedia:

In 1989, Morris was indicted for violating United States Code Title 18 (18 U.S.C. ยง 1030), the Computer Fraud and Abuse Act (CFAA).[2] He was the first person to be indicted under this act. In December 1990, he was sentenced to three years of probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. He appealed, but the motion was rejected the following March.[4] Morris' stated motive during the trial was "to demonstrate the inadequacies of current security measures on computer networks by exploiting the security defects [he] had discovered."[2] He completed his sentence as of 1994.

In case people don't know already, he's one of the YC founders: https://www.ycombinator.com/people/
From his wikipedia:

He is a longtime friend and collaborator of Paul Graham. Graham dedicated his book ANSI Common Lisp to Morris. Graham lists Morris as one of his personal heroes, saying "he's never wrong."

to be friends with Paul Graham, i should make a worm. Got it.

Ehh in 1988 that worm was like an alien artifact from the cyberpunk future.

First "real" worm code, multi-platform, multiple payloads, "staging", first practical buffer overflow exploit and it does credential brute-forcing.

Heck it was not until nearly a decade later that people were really doing buffer overflows, and there were a LOT of easy overflows to be found.

I'd make the case rtm didn't just "make a worm" he foreshadowed the next few decades of computer exploitation.

Took a whole bunch of research and ideas, synthesised them, built an actual working "product" a decade or two ahead of its time and released it in a transgressive way.

If you are the kind of person who can do that I'm sure lots of people would like to be friends with you.

or Samy Kamkar.
Samy is my hero
It's one thing to find a security issue, it's another thing to exploit it and easily leads to jail time even if it's harmless.