jdong

What's there to back up the legitimacy of the information released by these guys?

It just looks like they're tweeting out random IPs from zeustracker.

>Yet what does every single news outlet do?

What they're supposed to? This is after all, news. You don't drop a story because you think someone is a cunt.

>but on the other hand it's likely most or all of them will be arrested in the not-so-distant future

People have been saying this for 3-4 months now.

Thing is, you have to draw a line somewhere.

Essentially he was exploiting a vulnerability in JSTOR to mass download court documents, what if he was downloading credit cards instead? Or some sort of corporate secrets?

(Sure, credit cards and court documents are very very different. But the act here is the crime, not what he gains from it)

Thing is, I'm not his shrink. I don't know everything that was going on inside his head, that's my best guess based on my daily chats with him on IRC.

Aaron did what he did knowing the consequences, my best guess is that at some point after he started regretting his decision.

This is how the world works, if you make a bad decision you'll have to live with it... Or not.

I don't think technological illiteracy plays a large part here, Aaron exploited a flaw in JSTORs ratelimiting system and continued doing so after being blocked several times by JSTOR administration. After that didn't work out he broke into a server cabinet at MIT.

Does that sound 100% OK to you?

a) Sure, he was facing a possible "5 years" (most likely much less) and was well aware of that.

b) Debatable, a prison sentence of a few years definitely wouldn't be anything out of the ordinary

c) You make it sound like there's something wrong with deals by prosecution, I don't think so. The deals don't hurt anybody and offer an easy way out.

Aaron knew what he was doing, he made a conscious decision to do it. I believe Aaron also knew that he'd get in trouble for doing this, what he was doing was civil disobedience. Orin Kerr describes this fairly well in his article http://www.volokh.com/2013/01/16/the-criminal-charges-agains...

You probably mean 6 months or less, because that was the prosecution offer. And yeah, I think that was actually a pretty good deal. Although I would agree that in a perfect world the material he took would already have been public.

You're ignoring the other charges he had, the prosecution offered him an AMAZING deal. You can't just not prosecute people because they're depressed.

Aaron was a good friend of mine, I know quite a bit about this case.

a) No he wasn't, this is a common misconception by people who don't understand how the US court system works.

b) Aaron had a good deal, the indisputable breaking-and-entering charge would probably have gotten him more than 6 months. (Clarification: Aarons state charges were dropped to make way for the more serious federal charges, so in the end he didn't even get charged for the breaking-and-entering.)

c) Again, read up on the US court system.

You're disrespecting his memory by using him as a weapon for your misguided crusade.

Here's a good article written by Orin Kerr regarding Aarons charges http://www.volokh.com/2013/01/14/aaron-swartz-charges/

Sure, but there really doesn't seem to be anything wrong with the law here. Aaron wasn't even convicted of anything.

What makes this case such a big deal? Swartz did something that was obviously illegal and got caught.

Not sure about that either, but trying to blame Home Depot for fundamental flaws of the system isn't productive either. You should blame the card design for allowing this, not the people that accept cards.

Sure, but the only real solution would be not accepting cards. Does that sound like a good solution to you?

It's a step in the right direction, but the current implementations of EMV cards wouldn't have been of any help here.

Except that information can be used online...

You'd have a really hard time arguing those as damages in court. And then you'd have an even harder time arguing that it was in fact Home Depot that was responsible.

Card processors might have a case, but the customers really mostly wouldn't.

The PAN that belongs to your credit card company that was assigned to you by your credit card company was compromised and someone tried to defraud your credit card company using it. Yet it's you complaining, why?

No, you really don't need the printed CVV for that. And several cards have actually had the CVV on the chip.

Also, in many cases the chips actually contain enough information to replicate the magnetic stripe. (Which is well, bad.)

A lawsuit which you would lose. Especially considering you most likely suffered no damages.

Chip&PIN is a red herring here, your data is just as compromised as it'd be with a magstripe card. EMV does not protect your card information.

Love the EMV plug, as if it'd actually have helped. EMV transmits the card information in the clear, it only makes physical copying of the cards harder (Which really doesn't matter since credit cards can be used online).

The only thing EMV would achieve is making this data slightly less valuable, but still worth it for the attacker. Replacing the EMV cards would also be more expensive by an order of magnitude.

tl;dr: if you use your EMV card on a compromised POS, you'll be as fucked as you'd be with a magstripe card. Your bank will be ten times as fucked.

Fact: Recording user behavior is extremely common...

My opinion: ...and users shouldn't act surprised by it.

Couldn't find too good articles, but basically he did everything he could to annoy the judge. http://www.vice.com/read/lulz-and-leg-irons-in-the-courtroom... http://www.nbcnews.com/id/51232207/ns/technology_and_science...

You're assuming that weev actually ended up in prison for CFAA violations instead of acting like a dick in court.

Sure, but you can use anything a currency. And being able to avoid the laws just by using something that isn't officially recognized would be rather dumb.

You might as well be using cows as a currency, it'd be no different from bitcoins.

Why should courts and IRS share the same definition of "currency"?

What's the problem? Using "The Man" seems just fine (and pretty common): https://books.google.com/ngrams/graph?content=the+man%2C+the...

The activity reported by namecheap hardly lines up with these reports, mass amounts of user/password combinations leaking is hardly anything unique.