Hacker News Reader

Comment by jmspring | Hacker News Reader

The problem I have with the justice system in cases like this is that there are curious people, they will have, probe, poke, tickle, whatever systems are available. The justice system, as mentioned, only sees those making these "intrusions" in black and white terms -- criminals.

In the case linked, "NASA had to shut it's systems down for 3 weeks at the cost of $41000 to check and fix it's systems"...This is bullshit. First off, you should have sufficient redundancy in your internal systems, especially for life critical code, that an intrusion affects the front line, not things like your source repository. Further, you should have regular backups and checkpoints -- checksums, etc. to be able to compare and identify anything compromised.

Laws to guard against lazy employees should not be allowed.

A bogus case.

View on HN

It's not really a bogus case at all. The message that these submissions are supposed to be sending is not that any of these people did not in fact commit crimes but that the ruthless pursuit of these individuals is immoral given the intent. Besides, there's no way for you to know how much it would cost NASA in time or money to double and triple check the integrity of their systems. $41k doesn't even sound like a whole lot of money for such a chore.

She shouldn't have been walking down that dark alley at that time anyway.

I sincerely hope that you didn't post this analogy sincerely believing it, as the two are diametrically opposed.

It absolutely was sincere. I'm not sure why you think they are "diametrically opposed". In both cases it is victim blaming.

Except that what grandparent was pointing out what not a case of victim blaming at all; rather, that the response was completely disproportionate to the act.

If you have a really nice sports car and I open the hood to see what engine it has and how it works, yes, I am in the wrong for not asking your permission first. However, if you then try to sue me for $100k because you claim that you had to have expensive maintenance done, you had to get the entire car diagnosed and $20k of repair done, etc. then you are clearly responding in an inappropriate manner.

That's what the whole "NASA had to shut it's systems down for 3 weeks at the cost of $41000 to check and fix it's systems" is about.

I hope you see now how that is very much different from the "she was asking for it" kind of BS.

Securing top-secret facility after a beak-in (where we know keyloggers and such were installed) is a bit more expensive than popping the hood of the car. At minimum, whole OS and all software packages have to be reinstalled from known clean media, and whole software stack needs to be recreated from scratch, without using backups (which could be compromised too). If you're properly paranoid, add new hardware too (most of the current hardware is programmable at some level, i.e. needs to be replaced after a breakin). And then you need to invalidate all passwords on all the systems and have everybody to reset their passwords. And not only user login passwords - all router passwords, domain passwords, service logins, everything.

I can easily see how such work can take, for multiple systems, several weeks and 41K is not an outrageous sum for completely recreating the system. Especially when something controlling life-preserving equipment is involved - which means additional testing, etc. - it's not a website that you can just push into production and if some page glitches the user would tell you.

The difference is that having to avoid certain public places for fear of being assaulted infringes on your personal freedoms. Locking down a server does not.

Reply on news.ycombinator.com