4 hours? Cripes! I hope they're kidding about how long that took them. I knew security was bad out there, but that's ridiculous.
Seriously though, unsalted MD5? Again? Like they say in the release, anonymous can't be any more explicit. Their slogan is "expect us." That should be a clue.
Oh, and it's probably not good to encourage this kind of thing either.
What I disagree with is the "giving them a job" bit. I don't think that rewarding these kinds of people with employment is right - part of working in computer security is having a certain code of ethics. Whereas I'd much prefer that this kind of stuff be made public, giving them a job is similar to rewarding a thief with a job as a cop.
People are free to disagree, of course :P
It does seem clear, though, that we all have a lot to learn about protecting information...
These aren't kids.
Who says they haven't been offered some?
Somewhat akin to having a day job installing security systems, and by night, breaking into houses secured by your competitors.
Releasing the emails was just one outcome. The other was that any dangerous knowledge (or digital weaponry) lying around there were ready for the taking.
I don't know if it's because I'm inside the industry, if software is inherently easier to create and duplicate, or if the damage is somewhat smaller, but I really can't see any software as a weapon.
A tool used in war? Sure. But a weapon? Hardly.
Malware that specifically targeted (inadequately protected) control systems for critical infrastructure (think power/water/transport) would not be unlike an EMP bomb in my opinion.
A weapon is just a type of tool used with intent to harm.
And yes, software can fit into the dictionary description of "weapon", but the scales are completely different.
Throwing it into the same regulatory basket as firearms just seems misleading and asking for trouble.
But maybe you are right, software can be a weapon, and I'm just afraid of the implications of classifying it as such.
While that is correct, it can be extended to pretty much everything. In the end, weapons don't kill people, people kill people.
And while this will probably will get me labeled as conspiracy theorist, I still think that a lot about stuxnet was way too fishy, and it was way too conveniently timed for all the security facists that are raving about "Cyber War".
Rifles and bombs don't kill people by themselves either, but are a damn good indication of intent and their simple presence facilitates dangerous situations.
The line gets a little blurry around things like guns and knives, but I think it still holds. For example, an AK-47 is a weapon, while a bird shotgun can be used as a weapon.