[davidw]

> tried to cause trouble for HTP.

Here's hoping the FBI "causes trouble" for the lot of them. Breaking into other people's stuff is not cool. If I leave my door open by mistake, yes, that makes me a bit absent minded, or foolish, but it does not give anyone the right to wander into my house.

[crisnoble]

Everyone bitching about HTP or AnonOps or any other hacking group that likes bragging should at least be thankful that they talk about their hacks. I would bet that the crime syndicates have better hacks and keep their mouths shut about them. Those vulnerabilities don't get patched, those customers never get notified. I am not defending HTP or the like, just saying, at least they boast.

[jrockway]

I worry more about governments than organized crime these days.

[jrochkind1]

Yep, them too, don't tell anyone about their hacks.

(I mean, "More about governments than organized crime? There's a difference?")

[davidw]

You should pay a visit to Sicily or Naples if you don't think there's a difference.

[jrochkind1]

And I hope none of us ever pay a visit to Guantanamo.

But seriously, yeah, of course there's a difference, but government is also often in league with organized crime, from local levels of corrupt cops and drug leaders, to international levels of the CIA and arms traders and 'our' 'freedom fighers' -- I bet this is also true in Sicily and Naples, that many parts of the government act in league with organized crime.

But yeah, to go back to the actual topic/thread, mainly, I think the guy is right that the government is the other main actor which is going to keep it's security exploits to itself, and just use them to monitor you silently. (And that's probably more likely in the US than any other country on the planet, at the moment).

[rdl]

I'd generally prefer government to organized crime, but would probably take the Yakuza over NK or Belarus or wherever.

[davidw]

So you're comparing what might be the "best" of something in one category with some of the dregs in another.

Italy is not known for having particularly good politicians or government, but I'd take the government here any day over the Mafia or Camorra. Despite any romanticized movies you may have seen, those guys are pretty cold-blooded SOB's. Recently, a man was shot dead waiting to pick his son up from pre-school in Naples.

[reeses]

You mean, how much did the 'mole' see/hear/do before getting booted from HTP?

[jrockway]

No, that's not what I mean. What I mean are things like the Chinese government hacking Google and the New York Times, not HTP hacking some IRC provider for revenge.

[reeses]

Let me be more clear. You mean, like employees or contractors under the direction of the FBI hacking sites, at least Linode, while 'investigating' HTP?

[sbank]

Honestly, the two are very often synonymous.

[plaguuuuuu]

Yep. Knowing various people who have done security work for banks and similar organisations, I've heard a few hair-raising stories.

They never ever disclose when they get hacked. And they do get hacked.

[CleanedStar]

I'm afraid your analogy is stretched a little too far for me - that your open door leading to someone physically wandering into your personal living space is the same as some corporation with tens of millions of revenue a year that has some script kiddie sitting in his mom's basement seeing some Linode stuff come onto his screen. I guess when I think of some kid snooping around some corporation's computers, I'm supposed to compose a mental image of some thug physically invading my own home. Yes, I can see why corporations want people to think this way, but it's a rather silly metaphor as far as I'm concerned.

[davidw]

Actually, these guys cost people a whole hell of a lot more time and money than someone breaking into a home probably ever did. Just for starters:

http://blog.phusion.nl/2013/05/07/phusion-server-security-re...

[conductor]

Well then you are not a hacker. And I hope FBI can not cause trouble for them, they did not do anything unethical in my POV. The server is not a house. Black hat hacking is a mixture of art and politics (I never support hackers who hack for stealing money), and if you want the analogy, they just spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doors. This may be illegal, but this is the way they can confront the forces they don't like and outline their position. They did not brake or delete anything (no vandalism).

[canttestthis]

Please give me the password to your regular email account so I can read your emails. I won't delete any of them, but your email server is not a house, and I should have the right to read your emails.

[conductor]

A right? I didn't say they have a right. They hacked into. Did the US/Israel have a _right_ to use Stuxnet against Iran? No. They hacked into. When did you accuse the US secret service or hope that they will be punished? Double standards?

I won't give my email or its password to you, but if you can find it, hack it and decrypt my emails, then it would be only my fault, and you will have my respect.

[bradleyland]

You're not getting it. No one is saying that Stuxnet was "right". That conversation is set in an entirely different context than the Linode hack. Iran is seeking to produce a nuclear weapon with the openly stated goal of launching it against another country. There is no segue from Stuxnet to this Linode hack.

"Fault" is not in question here either. Let's say I leave my front door unlocked. If you enter my home without my permission, you have trespassed and can be charged with a crime. The only thing I would be "at fault" for is making a lackluster attempt at securing my home. I don't forfeit protection from trespass under the law for that act though.

You see, locks are not what govern access; laws are. HTP is clearly in the wrong here. They forced entry in to Linode's systems, then attempted to extort Linode in an effort to achieve their goals. Swap out Linode's servers for Linode's offices, and there's no question that HTP are operating outside the boundaries of ethical behavior.

[conductor]

I admit Stuxnet was a bad analogy to black hat hacking. But either is the analogy of hacking into a server and physically trespassing into a private property.

The main goal of my comments is to object to the opinion that hacking is somewhat comparable to physical break and enter actions. This is an age where one can find himself in prison for tens of years for hacking and getting access to information (the prospects of Aaron) or even for IP violations, as it were a murder or rape.

Being in an underground hackers crew is much fun and possibilities to learn things for young men who are smart and different than their friends. Those guys and gals are the future top-class engineers at Google and other IT giants and I want them to continue hacking and growing personally and professionally, not rotting in the prison.

[bradleyland]

You keep getting buried because you've hitched your wagon to the wrong horse. Your core argument seems to be that punishment for hacking is often disproportionate to the crime committed.

For example, poorly written laws make even simple port scanning a risky activity. I agree that this is ridiculous, but you needn't defend HTP here in order to take that position. If anything, HTP are to blame for the overreaction from policy makers. They are having a very difficult time distinguishing between mischief and mayhem.

The law should take context in to account. If you were caught exploring an old, abandoned warehouse, you might end up with a misdemeanor trespass charge (hopefully), but if you're caught probing a corporate server, the current climate seems to dictate that you'll land a felony in short order. You've got groups like HTP to thank for that because of their extortion activities and willingness to leverage the well being of innocent people in their trivial games.

[jonknee]

> Being in an underground hackers crew is much fun and possibilities to learn things for young men who are smart and different than their friends. Those guys and gals are the future top-class engineers at Google and other IT giants and I want them to continue hacking and growing personally and professionally, not rotting in the prison.

Or the next members of the many criminal syndicates on the internet who steal/harass/blackmail with little regard of the consequences.

[analog]

Offtopic, but have you got a source for "Iran is seeking to produce a nuclear weapon with the openly stated goal of launching it against another country."

I had a quick look on the Wikipedia page but couldn't see anything there.

http://en.wikipedia.org/wiki/Nuclear_program_of_Iran

[bradleyland]

This is the world stage, so objectivity is hard to find, but there is a substantial amount of posturing from Mahmoud Ahmadinejad that shows a pretty aggressive stance toward Israel, if not open contempt [1].

That's really besides the point though. Anyone who seeks to boil "right and wrong" down to a simple principle that applies in all cases is holding simplicity above practicality. "Simple principles" are no more sustainable than utopian ideologies. The reality is that right and wrong are subtle and contextual. Bringing Stuxnet in to the Linode discussion is just an effort to sidetrack the topic.

Any way you slice it, HTP has dragged "innocents" in to the fight. It's not right when governments do it on the world stage. It's not right when thugs and gangsters do it by terrorizing neighborhoods with gang violence. It's not right when crackers do it during their internet turf battles.

1: http://en.wikipedia.org/wiki/Mahmoud_Ahmadinejad_and_Israel

[gruseom]

That statement is untrue. Among journalists I know of, the one who has studied this the most and reported on it in the most detail is Gareth Porter.

[mpyne]

> I won't give my email or its password to you, but if you can find it, hack it and decrypt my emails, then it would be only my fault, and you will have my respect.

Ah yes, the "might makes right" philosophy that we all know and admire from primary school.

[mtowle]

Not everybody believes in rights, per se. He did put scare underscores around the word. Just saying, if you believe your position to be the moral high ground, you shouldn't need to mischaracterize the positions of others.

[criley]

Did you honestly just use militarized cyberwarfare as an example of legitimate black hat?

The US/Israel are involved in a proxy war with Iran that involves cyberwarfare, clandestine operations and conventional military strikes (in the case of Israel striking Iranian-sourced Syrian weaponry).

It's an extremely poor example to use open cyberwarfare between nations engaged in everything but overt warfare to attempt to legitimize black hat hacking.

[err_badprocrast]

I'm curious how you would classify China's crack teams engaging in industrial espionage. Is that black hat activity, or legitimate cyberwarfare by a nation-state?

[chc]

I think criley's point is that if your activities closely resemble international warfare, they probably aren't "legitimate" by any reasonable standards.

[jstanley]

"spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doors."

And then collected private information of everybody who works for or is a customer of the institution, and then threatened the owners of the institution if they spoke out about what had happened.

[Dylan16807]

If they spoke out within two weeks. That's not very long. Hell, you can take down sites for two weeks just by filing a DMCA notice.

[alan_cx]

I kinda get where you are coming from. I'm guessing you like the idea of sticking it to the man, as it were. Well, yeah, I like that too, I tend to lean to wards what these guys do, when it suits, but as ever, the problem is with intention and trust. Do you really trust them 100% to only look? The same people who do that could raid my current account, and none of us can be sure they wont. Or, sell on details to raise funds for their "great" works, or cynically line their pockets. We just don't know.

I think quite a number of people tread this fine line between approving of sort of Robin Hood types and criminals. And that can change given the target. So, "fantastic" if they embarrass the FBI, not so comfortable if its our bank.

[qw]

If they only "looked" it would not be too bad, but they did much more here. They threatened to release credit card numbers, user names, emails and passwords of customers. Do you think it's fair that someone's personal information is released just because they are customers of Linode?