Hacker News Reader

Door locks on physical houses are just a small part of a much greater security picture involving your community, observant neighbors, other monitoring systems, the police, even dogs. And yes, houses do get broken into causing a massive amount of aggregate economic loss every year.

But on the internet everyone's front door is accessible from even the most remote and hostile places in the world and you're pretty much on your own for securing it. Internet-facing systems also tend hold far more valuable things than your typical home.

For these reasons, I don't think the household lock analogy works very well.

EDIT 2: Hmm, maybe I shouldn't have removed my original response, I just didn't want to derail the conversation upon second thought. For posterity's sake, my original response was something along the lines of this:

---

I think you may be overestimating the effects of "the greater security picture" involving community, observant neighbors, other monitoring systems for the average community. For example, my first startup was RateMyStudentRental.com, and as I recall adding automated motion-activated sensors and lighting actually had a negative effect on break-in protection. As in, adding such a system actually increased your chances of having a break-in. According to the study, neighbors don't actually pay much attention to someone standing at a well-lit door (mileage varying based on the specific community obviously).

---

ORIGINAL EDIT: I won't comment on the technicality of the differences between the analogous situation and the actual situation at hand; the differences have nothing to do with the point being made. Don't get caught up in the analogy, because it's just an analogy.

In case it wasn't clear the first time around, the entire point of the analogy was that, breaking into and vandalizing someone's business just to show them that it can be done is generally a bad idea. Though I don't think anyone would argue it isn't effective.

> [...] automated lighting systems actually have a negative effect on break-in protection [...]

Do you have a source for this? I've always been under the commonly held impression that this has a preventative effect, and it would be very interesting if the opposite really is true.

Good question. It was a long time ago, and I'm having trouble googling for it, because all I get in search results are articles and how-tos by motion-sensor companies selling their products. I'll search though and update if I find it.

UPDATE: Hey, awesome, turns out we blogged about it back in the day: http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-i...

Here is the original article: http://www.schneier.com/blog/archives/2007/09/light_and_crim...

Much so-called security lighting is designed with little thought for how eyes -- or criminals -- operate. Marcus Felson, a professor at the School of Criminal Justice at Rutgers University, has concluded that lighting is effective in preventing crime mainly if it enables people to notice criminal activity as it's taking place, and if it doesn't help criminals to see what they're doing. Bright, unshielded floodlights -- one of the most common types of outdoor security lighting in the country -- often fail on both counts, as do all-night lights installed on isolated structures or on parts of buildings that can't be observed by passersby (such as back doors). A burglar who is forced to use a flashlight, or whose movement triggers a security light controlled by an infrared motion sensor, is much more likely to be spotted than one whose presence is masked by the blinding glare of a poorly placed metal halide "wall pack." In the early seventies, the public-school system in San Antonio, Texas, began leaving many of its school buildings, parking lots, and other property dark at night and found that the no-lights policy not only reduced energy costs but also dramatically cut vandalism.

I remembered it incorrectly, as apparently motion-activated lighting helps, but on-all-night floodlighting makes the situation worse.

Peter Gutmann reported some interesting studies in his keynote talk at Shmoocon this year. It's probably available on Ustream or the Shmoocon site.

In short, sometimes darkness helps. Consider a tall glass office building. If all the lights are out, nothing stands out to a security guard more than a flashlight waving around in the darkness.

Hey Steve! Good to see another Kettering grad on here :)

This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did.

You have to assume every exploit will be abused. The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way.

I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.

I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them.

I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.

You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.

Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).

Has he been arrested yet? If not, I wonder why not. Github should press charges.

There's a big difference between acknowledging that a crime can be committed, and condoning that crime when it happens.

> If it's a concern, get a hold of the company and let them know.

Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something).

In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.

In Germany we have the CCC, they provide legal advice for these cases and have a ton of experience.

Do you have something similar in the states?

EFF has a network of people they can put people in touch with, even if for a variety of reasons they can't offer legal help in a particular instance.

But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.

That's a very good point about there not necessarily being a right answer. Though of all the companies in the world, Github is one of the easiest to get in touch with their developers.

And yet Egor made several attempts to illustrate the depth of a single problem, and nobody was able to understand that this was serious badness.

Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.

Maybe I missed something, but from looking through his posts, it seems that Egor felt the defaults in Rails were insecure (let's face it, they are), and then when he didn't get the immediate feedback from the rails team that he had hoped for, he decided to illustrate his point by hacking Github, which happens to be built on Rails. Nowhere did I read, on his own blog or within any of the rails issue tickets, that he actually tried reaching out to Github (i.e. contacting security@github.com) before exploiting the vulnerability.

Maybe he did try to contact Github first, but I didn't see anything mentioning that in any of the linked posts.

The immediate feedback was multiple issues closed as if they were not serious.

Maybe you do need to sometimes pull down someone else's pants to expose a problem. I think that's a moot point because nobody should really be able to disagree with that on pure logic. I think the important question is when someone feels they have no other choice, so they pull down the person's pants, should this be considered an immoral or criminal act? The guy can always say, "Look, I never intended to do any harm, I just wanted to get people's attention to fix this before someone who was intending to do harm came along." The problem is then how do you prove that they really were so benign? I think it'd be easy for a lot of blackhats to hide behind that if they ever got caught, or no? Even if there was complete immunity for people who immediately came out in the open and claimed responsibility for the sake of clearing the air, it'd still be easy for blackhats to hide their rationales in there, while they did something else more malicious (and then if that malicious thing was ever found, the blackhat can easily say, "Hey, I told you guys to fix it!! Now look what happened!! Wasn't me though!".

Breaking some poor dude's window probably causes a whole bunch more economic damage than a spurious commit into a github repos.

Do you have any idea how much it costs to clean up after an "intrusion" or "data breach"?

Of course, it's unfair to blame all those costs on the guy who had to go as far as actually escalating his privileges in order to unmask the Rails developers for being such knuckleheads.

As I understand it, for all you know, there were other intrusions anyway and you'd have to go looking for them and clean up after them anyway as soon as you learned that there was an exploit. Whether one dude actually posted something under someone else's name doesn't affect that there has been a huge hole in github for (apparently?) years.

Right. As if this guy who reported it was the only one at the time who could have pwned Github with it.

For all we know, this bug has been abused for a long time to commit backdoors to other projects (perhaps those too big and active to notice).

Cleaning up after the breach constitutes of two parts: 1. Changing passwords, removing unauthorized changes/fraudulent transactions, etc. dealing with evil people accessing info that shouldn't be accessed. 2. Notifying clients of vulnerability existence, securing the system properly and changing procedures so that such kind of breach would have less chance of happening again.

In the white hat scenario, the first part does not exist and the white hat does not actually do anything harmful. The second part still exists and can cost tons of money, but this part is not the fault of the person who found the problem.

So while the costs _after_ a benign "intrusion" like was done to Github can be substantial - both in money and reputation, the costs _because_ of it are much less, since most of the costs weren't caused by it, it only exposed the pre-existing need of bear those costs. Like a doctor diagnosing somebody with serious illness - he's not at fault that the person now has to spend tons of money on drugs and medical procedures.

There's an old debate over what constitutes "gray hat" hacking, and whether it's moral.

I haven't looked at Egor's actions too closely, but he seems fairly close to a "white hat". He's been a bit immature, and so has Github, but there's been no real lasting damage.

Anyone who's written a web app knows that mistakes can happen, and they take time to fix. I'm sure Github will handle the PR crisis with an informative and unbiased mea culpa (even if they secretly think Egor was a bit brash). People will keep using them, because their interface rocks.

This will stay on the front page for about 24 hours, then there will be a few link bait articles that also cash in on it, but that's about it.

Terrible analogy. More like someone's automatic door lock is opening by itself at random times of the day, and the owner doesn't believe it, so you leave a note on the inside. It's creepy, but not wrong.

but the owner doesn't know that. he has to assume you left a bomb under the passenger's seat, left illicit substances in hard to get spots and put a potato in the exhaust.

So...? The owner has to assume that anyway because they relied on faulty security. Assuming they even care--and honestly why would you think they care now when the evidence is they have not cared about this for at least months.

If he used a known vulnerability to break into github, then he didn't break in, he walked in.

Admittedly he did then do the online equivalent of pissing on the wall, so minus several million points for artistic endeavor.

It's more of a legal grey area I think. If I climb through an unlocked window of a company to enter a restricted area for which I don't have access, and then write (or piss) on the wall, I think it still counts as breaking and entering. Or trespassing and vandalism at least.

I don't think I'm going to take this analogy any further though; things get dangerous when you base an argument entirely on analogy.

I wonder what the Young's modulus of an analogy is ;)

It's obviously not "breaking". In fact "breaking" is the difference between burglary and theft, and theft insurance is way more expensive than burglary insurance (which I experienced today reading an insurance offer) , because theft is nearly impossible to prove and usually due to the victim's negligence.

In the legal sense, you don't need to literally break something for it to be breaking in entering.

From the legal-dictionary [1]:

breaking and entering v., n. entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary. If there is no such intent, the breaking and entering alone is probably at least illegal trespass, which is a misdemeanor crime.

[1] http://legal-dictionary.thefreedictionary.com/breaking+and+e...

Ah, sorry. Insurance underwriter takes a different view than criminal law, I guess.