Hacker News Reader

Comment by ericpauley | Hacker News Reader

It's funny (kind of cute, honestly) that these site operators pretended that the outbound (booting) side of the service was the only legal risk, and that they could address this with click-through terms. Clearly, compromising third-party devices and services, or misusing services for amplification, is just as legally fraught as the attack itself.

That being said, I wonder if these services are actually the limiting factor here. There is probably some zero-sum game here, with a fixed quantity of exploitable booter hosts available and all the providers vying for control of these. Shutting down a set of providers would then just make others more powerful.

View on HN

TBF these sites have been up for years, I recognize some from >decade ago, so it took quite some time for the law to catch up to them. They've probably taken in quite a bit of cash since their inception.

> ... and that they could address this with click-through terms

Honestly, this part is pretty funny on its own. Approximately nobody actually uses these services to test their own networks, and I'm sure the site operators are perfectly aware of that.

For sure. If they were legitimately owners of the domain, they'd have no issue placing a TXT record attesting to that fact.

For the record, a company I worked for absolutely used one of the listed sits to test our own network. We used it regularly enough and requested so many new features that the operator (one of the men arrested here) set up <ourcompanyname>.php on there for our specific testing.

You funded a criminal operation? That runs DDoS attacks? On behalf of owners of domains and websites everywhere, thanks a lot.

Nope. I worked for a company who paid another company to send large amounts of attack traffic to our network. We were a DDoS mitigation provider. It's very hard to test without real world traffic.

Those payments funded criminals and crimes. 'It's hard to do it otherwise' is not a defense.

I'm not defending anything, although you clearly seem on the attack.

I worked for the company, I was not the decision maker. Many of us have worked at companies where decisions are made that are questionable or unethical, sometimes even illegal (although I don't believe this would have been illegal in my country at the time).

I've never worked someplace that paid criminals to do anything, and I'd resign before I did it. For one thing, who knows what my personal liability is. Much more importantly, it's plainly the wrong thing to do, and my society and community are in my hands as much as anyone else's.

Well thn, congratulations for being a better human than me. Some of us live in a world of moral greys, glad to hear life is black and white for you.

I'm responsible for the consequences of my actions and the complexity of the world is not an excuse. Regardles, this question doesn't seem to fall in a grey area; they are obviously criminals who harm others; the company that paid them was not trying to fend off starvation, but simply wanted to test some software.

I reminded me of those warez sites in the 90s that asked "Are you a cop?", with "Yes" pointing to some other site (disney, nytimes, you name it) and "No" going to the actual content, because "cops mustn't lie about their position."

That worked approximately as well as you would imagine.

I'm having flash backs to talking to some guy on a BBS and him informing me that cops can't say they are not cops, or it's entrapment.

25 years later some guy at a party was telling me this last month. It's amazing how this silly myth persisted.

You can see people making similar post-truth legal arguments on HN (and doing the same in other domains). It elides from a rhetorical or philosophical game into people thinking it's reality or advocating the post-truth culture like it's a cause. When it doesn't map to reality it's going to hurt, like Wiley E Coyote running too far off that cliff.

What a bunch of super-geniuses.

Reply on news.ycombinator.com