Slashdot Mirror
Hacking the Governator
mytrip writes, "The Democratic rival to California Gov. Arnold Schwarzenegger acknowledged that his aides were responsible for obtaining a controversial audio file, in which the Governator was heard disparaging members of other races, in a move that has led to allegations of Web site hacking. A source close to Angelides told CNET News.com that it was possible to 'chop' off the Web links and visit the higher-level 'http://speeches.gov.ca.gov/dir/' directory, which had the controversial audio recording publicly viewable. No password was needed, the source said." And jchernia notes, "As an aside, the California Highway Patrol is running the investigation — maybe the Internet is a truck after all."
then my grandma is a copyright violator. Oh, wait ...
Chopping off URLs.... oh my, these h4x0rz are scary as shit! Hide your megabytes, kids!
Gee, content freely accessible via URLs on the WWW? What a novel concept.
This is simply a matter of deep linking. Just because there's no page with a link to a URL doesn't magically make the accessible URL off-limits. Security through obscurity isn't. If the governator didn't want people to get it they shouldn't have posted it on their web site. Or at least put some form of authentication on it.
You're thinking too objectively about it. Just relax and let it be played enough times on the media and it will try to become true.
It is a miracle that curiosity survives formal education. - Einstein
I'm sorry, this is not "Hacking," it's the way the web works. They sent the web server a URL, requesting a document, and the web server gave it to them. They didn't do anything nefarious, underhanded, or tricky. The didn't claim to be anybody they weren't, there was no phishing or pretexting or anything like that involved.
Imagine they had called the governor's office and said "Hi, got anything incriminating about the guv on file?" and when told "Sure, would you like a copy?" they said "Yes please!" What would people think then? It's the same darned situation here.
--MarkusQ
Disparaging? hardly. This is just a sensationalist way to report the news. Here is the actual comment (from the Washington Post http://www.washingtonpost.com/wp-dyn/content/artic le/2006/09/08/AR2006090800599.html):
"I mean Cuban, Puerto Rican, they are all very hot," the governor says on the recording. "They have the, you know, part of the black blood in them and part of the Latino blood in them that together makes it."
the article continues...
'Garcia, who is Puerto Rican and the only Latina Republican in the assembly, appeared with Schwarzenegger yesterday and said she was not offended by the governor's comments. Garcia earlier told the Times that she refers to herself a "hot-blooded Latina."
"I love the governor because he is a straight talker just like I am," she said.'
Nice spin there. All he did was call one lady hot. BFD! As much as I think the governator is a joke, this is just getting ridiculous.
___
If you think big enough, you'll never have to do it.
I never hear about them complaining about the large penis stereotype though...
The CHP merged with the California State Police in 1995. They are the law enforcement authority on CA state property.
http://www.chp.ca.gov/html/history.html
Matt
So, someone didn't hack a web site, and someone didn't make racists comments. Right then, all caught up on the news.
No, that's the way normal human beings interact. Only people who have never really spent much time in a diverse, multiethnic environment get offended by such things... the rest of us tease each other constantly and have a grand old time.
Beauty is just a light switch away.
That said, it's not a question of whether the adjectives used are 'complimentary' or not, but rather the generalization across an entire race that offends (some) people. They feel that racial generalizations (aka stereotypes) are unhelpful and inaccurate, and have a major history of abuse.
So what? This was an off-hand remark made in private. Have we come to the point where every word one says must be parsed and examined for any trace of anything that might offend the most hypersensative among us lest he or she be branded a racist?
-Grym
Seriously, if not being racist means pretending like there are no racial division, then everyone is a racist and you make the term meaningless. Clearly different races are different physically, if nothing else. That's why the whole concept exists in the first place. If we all looked the same, there'd be no concept of race like there is today.
Well, something else we know is that humans like to use generalities. We like to generalize traits, trends, whatever. Helps us deal with understanding overall patterns in data. Thus it should be no surprise that traits get generalized to races. Happens to other things too, you can see all the traits that get generalized to geeks (like not having girlfriends) here on Slashdot.
So if you are going to get all bent every time someone makes a race related observation, ask yourself why. Is it because you think they are a bad person, with a malfunctioning brain? Or maybe is it because you yourself find that you generalize based on things like race, but don't want to admit or verbalize it?
Look the answer to racial division in this country isn't to hide it, to try and pretend like we are all the same and make it taboo to talk about. The answer is to talk about it, to laugh about it, and to understand and accept it. We are all different, physically, mentally, socially, etc. We need to celebrate our differences and understand that they aren't a reason to hate. Trying to hide away from them and make them taboo won't do any good.
Generalizations or stereo-types exist for a reason. If I look at an electric range and one of the burners is red, I am going to try to avoid touching it. It is possible however that the burners are simply painted or dyed red and not currently dangerous. Now when I get closer to the range and I'm able to tell no heat is being emmitted and it's not really glowing, I probably wont be as cautious. Generalizations and stereo-types are useful in filling in some gaps of unknown information until better data is availabe; but ultimately should be treated as unreliable. People shouldn't take serious action just based on a stereo-type. Forget offensive. That's just dumb.
Taking offense at someone voicing or defining their own stereo-type. Bah! Sounds kinda silly to me. How bout I get really pissed the next time someone offers me sunblock? "OMG, they assume because I have white skin that I'm prone to sunburns! How dare them!" Hehe, yeah that would be pretty silly.
So, I think I get what your saying about history of abuse and all; but it's the abusers that should be punished not the concept of stereo-types.
My two cents.
I suppose all the anime fans that keep telling me how hot Japanese women are are racists too, then. If this is considered racism, I don't have any problem with racists. I guess we'll need a new word for the serious sort.
I mean, if the word "murder" could mean accidentally stepping on a cricket, I wouldn't care if I lived next door to someone described as a "murderer".
1. Republican (barely) makes SLIGHTLY off color remark that bothers no one, especially the woman the remark was about, who thought it was funny.
2. L. A. Times prints the story from an "anonymous" source without bothering to do any verification.
3. Despite no one with a functioning brain thinking the comment was anything to even care about, extensive media coverage is given to the blubbering hand wringing and panty soiling histrionics of various key Democrats, including Arnold's opponent, who act as if he was caught eating babies on video.
4. It is revealed that the file was taken from a computer by members of the Phil Angelides staff, possibly illegally, and that the L. A. Times probably knew more about the source than they originally let on, suggesting political dirty tricks collusion.
5. Not one mainstream reporter asks the Phil Angelides campaign what happpened to their pledge of "sticking to the issues".
The leftists on Slashdot and elsewhere torture logic to the point that the UN considers issuing a stern finger wagging.
For those to whom the parent is not clear, the California Highway Patrol has, for quite some time, subsumed the function of the formerly-separate California State Police, and also has a function with regard to the Governor (and, IIRC, certain other state officers) parallel to the protective role of the federal Secret Service.
So its not all that odd that the CHP is running the investigation, other than the fact that there is obviously nothing illegal about accessing publicly-served pages from someone's webserver, so there shouldn't be an "investigation" at all.
Shouldn't the RIAA be suing over this?
I don't really see what the problem is here, either. His earlier comments about, "crushing your enemies; seeing them driven before you; and hearing the lamentations of the women," didn't seem to hurt him to bad,... ;-)
You do realize that he is up for re-election in November, and that his major opponent is none other than the person who passed the information on to the LA Times? And that the LA Times went on to quote Phil Angeledies as being very outraged, in the same article that they broke the story. Those of us in California, with more than half a brain (which does eliminate a large portion of the state's population), realized it for what it was: election year mud-slinging. The LA Times is generally expected to be a left slanted newspaper, and they do what they can to attack Schwarzenegger at any possible time. So, running a story, on the front page, about an off-color comment, made in a closed door meeting, (which didn't even offend the person who was being talked about. She actually took it as a point of pride, being called "hot blooded.") is absolutly no suprise.
Necessity is the mother of invention.
Laziness is the father.
I've seen big corporation programming consultants for which changing a URL was an unheard of concept, so I'm less surprised that a layperson considers it elite hacking.
Seriously. Being as generic as I can for NDA reasons, let's just say that the corporation I work for paid good bucks to a BIG corporation's consultants to write a web application for them. Well, not even the whole app, but think more or less just the part where you register and set your data and preferences, with a bit of a hierarchy thrown in. (Some users could be, basically, managing others and giving or revoking rights to them.)
The thing ended up years overdue, and needing a whole server farm just to support a modest number of users. (The joys of clueless Buzzword Driven Architecture at its finest, really.) They had to be started and shutdown in a given sequence too, as the modules on one machine depended on those on a second, which depended on those on a third, and so on. As a result, shutting down and restarting the whole system (e.g., for maintenance) took almost a whole day. But that's not the important part. The important part were the endless security issues, such as:
1. yes, failure to account for URL editing. Rights were checked when generating the URLs on a page (e.g., which products, messages, whatever, you can click on), but not when actually accessing the linked page. So you could literally access any data in the database by just typing in its ID in one of those URLs.
2. rights escalation. Did I mention editing URLs? The same went for the "change your password" page. You could just type in another user's id, change their password, and log in as that user. The "super-user" had id 0. 'Nuff said.
3. wide open to cross-site scripting exploits. They hadn't figured out how to quote strings when displaying them on a web page. (Then when they "fixed" that, it encoded them twice and displayed them broken. So they disabled the fix again and tried to downplay the risks of anyone injecting JavaScript.)
4. had obviously never heard of non-repudiation. (Security isn't just about who you let in, but also making reasonably sure who signed that contract or generally did what.) While in the old system a deleted user was just, basically, flagged as disabled, their clever system just deleted the user and his data. And because of foreign key constraints, it cascaded through the tables and erased any data connected to that user. Messages they posted or sent, contracts they signed, everything. Users could delete themselves too. (If anyone has trouble understanding why this is dangerous, think what you could do if your bank had something like that. Take a big loan, move the money somewhere else, delete your user.)
And so on, and so forth.
So, well, if "experts" hadn't heard of such elementary stuff, I can't be that surprised that the governor or a couple of journalists consider them advanced hacking.
A polar bear is a cartesian bear after a coordinate transform.