Sorry but you missed the main issue in what he did. After being denied net access because he was downloading too much he physically entered a server room and installed hardware on someone else's network to download the files we was unable to get over the network. If you want to use your household analogy he was invited in to have some food. He was then told to leave as he had consumed too much. He later broke in the back door and took the food anyway.
California has taken money from out-of-state people that it had no right to take.
You really should really understand the issue before posting. The State gave the tax break to in-state people who invested in in-state companies. The problem is that it is unconstitutional to treat in-state and out-of-state companies differently. They did not tax out-of-state people.
California having a "temporary cash flow issue" could mean things like hospitals closing. When "temporary" could mean almost a year that could be a big problem.
The car analogy is not accurate in that the State did nothing illegal. They created a law that was unconstitutional and therefore was deemed not to exist. Without that law some people who claimed deductions are liable for more taxes. The ability to re-file works both ways; for the tax payer and for the state. When a tax payer misses something they can re-file. When the state misses something, as in an unconstitutional law, they can too. What they are saying is that since the plaintiff have proven in court that the law that allowed the deduction is invalid, it is invalid for everyone and therefore everyone who claimed the deduction needs to re-file(withing the statute of limitations).
After the first suit did your mother have the premises assessed for compliance with the ADA? Most people would call that due diligence when an issue is brought up. Had it been done that the second and third suits may never have happened.
That would be nice but the appeal court didn't see it that way. Here is the relevant paragraph from their opinion:
Plaintiff asks us to hold that a refund is the only proper remedy in this case, under the authority of McKesson Corp. v. Florida Alcohol & Tobacco Div. (1990) 496 U.S. 18 [110 L. Ed. 2d 17, 110 S. Ct. 2238] (McKesson). In McKesson, the high court held that “[i]f a State places a taxpayer under duress promptly to pay a tax when due and relegates him to a postpayment refund action in which he can challenge the tax's legality, the Due Process Clause of the Fourteenth Amendment obligates the State to provide meaningful backward-looking relief to rectify any unconstitutional deprivation.” (McKesson, supra, 496 U.S. at p. 31, fn. omitted.) McKesson identified three ways to provide the “‘clear and certain remedy’” required for an unlawful tax collection. (Id. at p. 39.) These were (1) “refunding to petitioner the difference between the tax it paid and the tax it would have been assessed were it extended the same rate reductions that its competitors actually received”; (2) “assess[ing] and collect[ing] back taxes from petitioner's competitors who benefited from the rate reductions during the contested tax period”; and (3) “a combination of a partial refund to petitioner and a partial retroactive assessment of tax increases on favored competitors, so long as the resultant tax actually assessed during the contested tax period reflects a scheme that does not discriminate against interstate commerce.” (Id. at pp. 40–41.) In this case the statute of limitations prevents the state from collecting additional taxes from other taxpayers who benefited from the unconstitutional deferral provision.
By including this paragraph in the Remedy section the Appeal Court requires the Board to do something. They chose option two.
This is not a new tax law but rescinding of an unconstitutional one. If effect since the tax law should not have existed it didn't and any tax breaks under the law are invalid. It has the same effect as freeing people who are incarcerated under unconstitutional laws.
Here is the relevant part from the Appeal Court opinion:
Plaintiff asks us to hold that a refund is the only proper remedy in this case, under the authority of McKesson Corp. v. Florida Alcohol & Tobacco Div. (1990) 496 U.S. 18 [110 L. Ed. 2d 17, 110 S. Ct. 2238] (McKesson). In McKesson, the high court held that “[i]f a State places a taxpayer under duress promptly to pay a tax when due and relegates him to a postpayment refund action in which he can challenge the tax's legality, the Due Process Clause of the Fourteenth Amendment obligates the State to provide meaningful backward-looking relief to rectify any unconstitutional deprivation.” (McKesson, supra, 496 U.S. at p. 31, fn. omitted.) McKesson identified three ways to provide the “‘clear and certain remedy’” required for an unlawful tax collection. (Id. at p. 39.) These were (1) “refunding to petitioner the difference between the tax it paid and the tax it would have been assessed were it extended the same rate reductions that its competitors actually received”; (2) “assess[ing] and collect[ing] back taxes from petitioner's competitors who benefited from the rate reductions during the contested tax period”; and (3) “a combination of a partial refund to petitioner and a partial retroactive assessment of tax increases on favored competitors, so long as the resultant tax actually assessed during the contested tax period reflects a scheme that does not discriminate against interstate commerce.” (Id. at pp. 40–41.) In this case the statute of limitations prevents the state from collecting additional taxes from other taxpayers who benefited from the unconstitutional deferral provision.
Under this portion of the opinion the Franchise Tax Board can not do nothing. They are required by this opinion to level the playing field. The Franchise Tax Board has three options; 1. Refund the tax to him and every other other person that was denied or didn't file because they did not qualify. 2. Retroactively tax everyone 3. A combination of partial refunds and partial taxes opening up even more litigation.
Option 1 is bad because the state could loose a lot of revenue. Option 3 is bad because the state loses revenue and spends more on litigation. Option 2 is viable as it already falls under the process of filing and adjusted tax return. By requiring the Board to level the playing field the court threw a wrench in the works.
Birds know nothing about fractal geometry. One does not need to know the fractal geometry of a feather pattern to deem the pattern desirable.
Another point is that they didn't prove the link between fractal dimension and desirability. It is quite possible that the prospective mate does not notice the change in plumage but looks at the overall health of the bird. Now if someone took identically healthy birds and modified some bird's plumage to change the FD and that changed the selection probability then that would be proof.
The report title does not describe the actual analysis done;
Males Are Overrepresented among Life Science Researchers Committing Scientic Misconduct
The main issue is that the source of the statistics is the ORI of scientists found to have committed misconduct. These numbers do not reflect any of the following; 1. Misconduct not noticed 2. Misconduct caught by fellow scientists 3. Misconduct not reported 4. Misconduct not investigated 5. Misconduct not proven. The more accurate title of the paper would be as follows;
Males Are Overrepresented among Life Science Researchers Found by the OSI to Have Committed Scientific Misconduct.
Since they only looked at researchers found by the ISO to have committed misconduct that is the only conclusion that can be drawn. To attempt to extend that to all scientists who have committed misconduct would only be valid if all scientists who committed misconduct were caught and convicted by the OSI. Since we all know that not everyone is caught and convicted that extension is patently false. I wonder if such blatant misrepresentation of facts would be considered misconduct.
It reminds me of a joke; An economist, an engineer and a mathematician are on a train to Glasgow. The economist looks out the window at some black sheep in a field and says, "All sheep in Scotland are black." The engineer looks out the window and says "Some of the sheep in Scotland are black.". The mathematician looks out, sighs and says "In Scotland there exists at least one field in which the sheep are black on at least one side." Considering all they observed was one field and one side of each sheep that is the only absolutely correct conclusion.
Sorry but sneakyness was not accounted for. Here is a quote from the article;
We cannot exclude the possibility that females commit research misconduct as frequently as males but are less likely to be detected.
That is the problem with doing statistical analysis of investigations as opposed to incidents as all incidents may not be detected and/or investigated.
Gee, that is comforting. Maybe you'll only get 35 years for that particular crime at worst... But, that is theft of a physical good - most likely you'll get off pretty light for that. Try to "steal" some music online and you could easily face a suit for 100 year's worth of wages at least.
Lets keep on the subject at hand. This is about criminal litigation and not civil litigation.
And who are you to call them to account?
His lawyer was concerned enough to bring up the possible suicide yet not concerned enough for another human being to do anything about it. The lawyer dropped the ball.
What do you want them to do, lock him up before he gets hauled off to prison?
If that would have saved his life, yes. Perhaps he could have even served his sentence in the cushy hospital.
Clearly you aren't looking to make things better for the next poor soul to end up in his place.
If by "poor soul" you men someone who broke several laws and threatened suicide then no I am not looking to make it better next time. The response to someone threatening suicide is not dropping charges it is institutionalizing that person in a hospital.
As taxpayers we're certainly accountable for his death, even if we outsource the dirty work to government officials.
That is your opinion. In my opinion there are two people accountable; Swartz' lawyer and Swartz himself.
The works being copied should have been in the public domain to begin with, so there should not have been copyright infringement.
So your opinion that the law is wrong means you can ignore it? Does that mean that of you really believe that the abortion clinic should not exist you are within your rights to burn it down? That is not the way the legal system works. Lobby to have the law changed.
The purpose of maximum penalties is to limit prosecutorial misconduct so they can not threaten 100 years for stealing a loaf of bread. They are also not sized for every possible crime that can fall under that law but the worstcase. Any good lawyer will tell his client the true probable sentence that would be imposed for that person's crime. It is based on common law and precedent.People rarely get the max for non violent property crimes and they usually serve their time concurrently for multiple charges.
It comes down to this, the six month plea bargain sentence was reasonable for the crimes committed. The defendant thought death was a better option. Sorry but that is a permanent solution to a temporary problem. Where were his lawyer, family or friends to see he was having trouble and commit him or stay with him for his own protection?
Did they give him permission to test using software that was different than what found the vulnerability and could probably bring down the site as the software's manual states? It comes down to the fact he had no right to do what he did with the tools he used.
The more accurate version of your statement
The moral of the story is it's stupid to do illegal things that impact on system performance and stability and embarrass others when they know who you are.
(bolding is my addition) It's like reporting to a bank that a lock has a vulnerability and then attacking it with a blowtorch two days later. Another view would be the parent yelling at the kid for saying "Are we there yet,?" every 30 seconds.
I think it is funny how you assume the error was made by a "silverback" when it is just as likely to have been made by a programmer right out of college.
He didn't test the specific bug. He tested all possible bugs. Had he written a specific program to test the single bug I doubt there would have been an issue.
Checking on a production site in two days from a report is also a very short time. It takes longer than that to program and test the fix. Then it has to get sent out and installed correctly.
Like I said previously in this thread, wait at least a couple of weeks and test the single vulnerability not test for every possible one in two days.
I find it funny how no sys admins have chimed in that they would have jumped down his throat for screwing with their systems. O right, it's OK to screw with corporations.
In the hands of someone not authorized to use it in a web site it is a hacking suite. In the same vein as lokpicks in the hands of someone other than a lisenced locksmith are breaking and enter tools. He was searching for vulnerabilities in a site he did not own using a tool that can cause sites to crash. Had he wrote a script to test just the one he knew about I doubt there would have been an issue.
That is all beside the point I was trying to make in that he was "threatened" for the unauthorized running of the security test software and not for reporting the issue.
Again, you didn't get the issue. He was "threatened" because he attempted to hack after reporting the bug; not for reporting the bug.
Instead of awarding him or send him a thank you note.
They did thank him UNTIL HE ATTEMPTED TO HACK THEIR SYSTEM WITH A HACKING SUITE. Just because he reported a bug does not mean their system if free and open for him to play with. He crossed the line into hacking.
You continue to miss the point. He was not "threatened" until he used a hacker suite on the server. Finding the exploit was not the issue. He went over the line into hacking when he used a hacker suite. Had he stopped at reporting the issue there never would have been an NDA or any "threatening".
Your rule is to be a black hat in every instance. Not a good rule. My rule would be to report the bug and then check that specific bug much later.
It seems a big issue that the NDA was supposedly signed under duress. To me duress is something like "sign this or we will burn down your house" In this case it is more like "Given that you have now started to illegally use hacking software we are concerned that you will spread this information to others who will cause bigger issues. As a consequence of you illegal action and to protect ourselves we require you to sign this NDA. Failure to sign it shows inclination to spread this information therefore we will have to bring your actions to the police if you do not sign it". To me that is not duress as it is direct consequences of Al-Khabez's actions.
The stupidity of this story is that it is a bright person who has few social skills. Sure he was praised for finding the bug. Then he just had to test it two days later. I can just hear the thoughts going through the president of Skytech's mind, "It's great that you found the flaw but run a hacking suite on our servers and your ass is grass." Ever hear of poking the bear? Skyteck is probably a little sensitive that a major flaw was found. Now you look for more when that is probably what they are already doing? And only after two days? I guess the college student doesn't understand enterprise level software releases as it can take more than a couple of days to get a fix into the field. There are testing and scheduling to be concerned with. Had Al-Khabez waited a month and tested just the vulnerability he found I doubt there would have been an issue. Instead he ran a hacker suite after two days.
After an initial meeting with Director of Information Services and Technology François Paradis on Oct. 24, where Mr. Paradis congratulated Mr. Al-Khabaz and colleague Ovidiu Mija for their work and promised that he and Skytech, the makers of Omnivox, would fix the problem immediately, things started to go downhill.
Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he and Mija had identified had been corrected. A few minutes later, the phone rang in the home he shares with his parents.
“It was Edouard Taza, the president of Skytech. He said that this was the second time they had seen me in their logs, and what I was doing was a cyber attack. I apologized, repeatedly, and explained that I was one of the people who discovered the vulnerability earlier that week and was just testing to make sure it was fixed. He told me that I could go to jail for six to twelve months for what I had just done and if I didn’t agree to meet with him and sign a non-disclosure agreement he was going to call the RCMP and have me arrested. So I signed the agreement.”
Note that jail was only mentioned after Acunetix was run.
When you say "this law" what are you talking about? Breaking and enter? tampering with computers? Copyright infringement? What is wrong with those laws? Everyone keeps harping on the the maximum penalties when we all know few get the max.
Again the summary is inaccurate as was the last article on this topic. All the state has is a list of handgun license holders not gun owners. Though there is a high correlation between the two there are license holders who do not own their own guns and/or do not store them at home. What can't people understand the simple difference between ownership and licensing?
Fist it is not 4096 bits. It takes 12 bits to make up 4096 possibilities. Also, don't you think that the scientists factored the 12 bits into their 300bps calculation? If there were only 300/12= 25 slots per second the data rate would be 300 bps.
Has anyone accused you of being an anarchist? It seems that you think any law (rule in your terms) that you do not agree with can be ignored and trivialized. Sorry but our elected officials have not decided that refusing to clean the bathroom is sufficient social implications to rate prison time. They have decided that breaking and entering, tampering with computers and dissemination copyright material without authorization is serious enough for incarceration. That is the difference between a parental rule and a law. Attempting to equate the two is absurd. It is not about "I have the power to enforce this so I will". It is "this conduct is a determent to society so must be deterred in some way". If you disagree with a law change the law otherwise all we have is anarchy.
Since Swatrz is "much more of an adult than most" then why compare his actions with the actions of a kid? That is another difference in the situations you bring up and the actual situation.
If we went with what you want, an insignificant monetary fine, there would be no "great personal risk to himself" as there would be no real consequences.
Do you really think it would take less police and prosecutor time to prove what he did based on a shorter sentence? No matter how long the sentence is the state still has to prove it's case. He knew what he was doing was against the law. He knew the penalties for the crimes, He chose to do it anyway.
Slashdot Mirror
Sorry but you missed the main issue in what he did. After being denied net access because he was downloading too much he physically entered a server room and installed hardware on someone else's network to download the files we was unable to get over the network. If you want to use your household analogy he was invited in to have some food. He was then told to leave as he had consumed too much. He later broke in the back door and took the food anyway.
California has taken money from out-of-state people that it had no right to take.
You really should really understand the issue before posting. The State gave the tax break to in-state people who invested in in-state companies. The problem is that it is unconstitutional to treat in-state and out-of-state companies differently. They did not tax out-of-state people.
California having a "temporary cash flow issue" could mean things like hospitals closing. When "temporary" could mean almost a year that could be a big problem.
The car analogy is not accurate in that the State did nothing illegal. They created a law that was unconstitutional and therefore was deemed not to exist. Without that law some people who claimed deductions are liable for more taxes. The ability to re-file works both ways; for the tax payer and for the state. When a tax payer misses something they can re-file. When the state misses something, as in an unconstitutional law, they can too. What they are saying is that since the plaintiff have proven in court that the law that allowed the deduction is invalid, it is invalid for everyone and therefore everyone who claimed the deduction needs to re-file(withing the statute of limitations).
Sorry I forgot to lose an o.
After the first suit did your mother have the premises assessed for compliance with the ADA? Most people would call that due diligence when an issue is brought up. Had it been done that the second and third suits may never have happened.
Repeal the law, if you must, and call it even.
That would be nice but the appeal court didn't see it that way. Here is the relevant paragraph from their opinion:
Plaintiff asks us to hold that a refund is the only proper remedy in this case, under the authority of McKesson Corp. v. Florida Alcohol & Tobacco Div. (1990) 496 U.S. 18 [110 L. Ed. 2d 17, 110 S. Ct. 2238] (McKesson). In McKesson, the high court held that “[i]f a State places a taxpayer under duress promptly to pay a tax when due and relegates him to a postpayment refund action in which he can challenge the tax's legality, the Due Process Clause of the Fourteenth Amendment obligates the State to provide meaningful backward-looking relief to rectify any unconstitutional deprivation.” (McKesson, supra, 496 U.S. at p. 31, fn. omitted.) McKesson identified three ways to provide the “‘clear and certain remedy’” required for an unlawful tax collection. (Id. at p. 39.) These were (1) “refunding to petitioner the difference between the tax it paid and the tax it would have been assessed were it extended the same rate reductions that its competitors actually received”; (2) “assess[ing] and collect[ing] back taxes from petitioner's competitors who benefited from the rate reductions during the contested tax period”; and (3) “a combination of a partial refund to petitioner and a partial retroactive assessment of tax increases on favored competitors, so long as the resultant tax actually assessed during the contested tax period reflects a scheme that does not discriminate against interstate commerce .” (Id. at pp. 40–41.) In this case the statute of limitations prevents the state from collecting additional taxes from other taxpayers who benefited from the unconstitutional deferral provision.
By including this paragraph in the Remedy section the Appeal Court requires the Board to do something. They chose option two.
This is not a new tax law but rescinding of an unconstitutional one. If effect since the tax law should not have existed it didn't and any tax breaks under the law are invalid. It has the same effect as freeing people who are incarcerated under unconstitutional laws.
They did not make a law but rescinded a law.
In the Appeal court one of the allowable remedies is as follows;
(2) “assess[ing] and collect[ing] back taxes from petitioner's competitors who benefited from the rate reductions during the contested tax period”;
It seems that the Board is following the court's opinion.
Here is the relevant part from the Appeal Court opinion:
Plaintiff asks us to hold that a refund is the only proper remedy in this case, under the authority of McKesson Corp. v. Florida Alcohol & Tobacco Div. (1990) 496 U.S. 18 [110 L. Ed. 2d 17, 110 S. Ct. 2238] (McKesson). In McKesson, the high court held that “[i]f a State places a taxpayer under duress promptly to pay a tax when due and relegates him to a postpayment refund action in which he can challenge the tax's legality, the Due Process Clause of the Fourteenth Amendment obligates the State to provide meaningful backward-looking relief to rectify any unconstitutional deprivation.” (McKesson, supra, 496 U.S. at p. 31, fn. omitted.) McKesson identified three ways to provide the “‘clear and certain remedy’” required for an unlawful tax collection. (Id. at p. 39.) These were (1) “refunding to petitioner the difference between the tax it paid and the tax it would have been assessed were it extended the same rate reductions that its competitors actually received”; (2) “assess[ing] and collect[ing] back taxes from petitioner's competitors who benefited from the rate reductions during the contested tax period”; and (3) “a combination of a partial refund to petitioner and a partial retroactive assessment of tax increases on favored competitors, so long as the resultant tax actually assessed during the contested tax period reflects a scheme that does not discriminate against interstate commerce .” (Id. at pp. 40–41.) In this case the statute of limitations prevents the state from collecting additional taxes from other taxpayers who benefited from the unconstitutional deferral provision.
Under this portion of the opinion the Franchise Tax Board can not do nothing. They are required by this opinion to level the playing field. The Franchise Tax Board has three options;
1. Refund the tax to him and every other other person that was denied or didn't file because they did not qualify.
2. Retroactively tax everyone
3. A combination of partial refunds and partial taxes opening up even more litigation.
Option 1 is bad because the state could loose a lot of revenue. Option 3 is bad because the state loses revenue and spends more on litigation. Option 2 is viable as it already falls under the process of filing and adjusted tax return. By requiring the Board to level the playing field the court threw a wrench in the works.
Birds know nothing about fractal geometry. One does not need to know the fractal geometry of a feather pattern to deem the pattern desirable.
Another point is that they didn't prove the link between fractal dimension and desirability. It is quite possible that the prospective mate does not notice the change in plumage but looks at the overall health of the bird. Now if someone took identically healthy birds and modified some bird's plumage to change the FD and that changed the selection probability then that would be proof.
The report title does not describe the actual analysis done;
Males Are Overrepresented among Life Science Researchers Committing Scientic Misconduct
The main issue is that the source of the statistics is the ORI of scientists found to have committed misconduct. These numbers do not reflect any of the following;
1. Misconduct not noticed
2. Misconduct caught by fellow scientists
3. Misconduct not reported
4. Misconduct not investigated
5. Misconduct not proven.
The more accurate title of the paper would be as follows;
Males Are Overrepresented among Life Science Researchers Found by the OSI to Have Committed Scientific Misconduct.
Since they only looked at researchers found by the ISO to have committed misconduct that is the only conclusion that can be drawn. To attempt to extend that to all scientists who have committed misconduct would only be valid if all scientists who committed misconduct were caught and convicted by the OSI. Since we all know that not everyone is caught and convicted that extension is patently false. I wonder if such blatant misrepresentation of facts would be considered misconduct.
It reminds me of a joke;
An economist, an engineer and a mathematician are on a train to Glasgow. The economist looks out the window at some black sheep in a field and says, "All sheep in Scotland are black." The engineer looks out the window and says "Some of the sheep in Scotland are black.". The mathematician looks out, sighs and says "In Scotland there exists at least one field in which the sheep are black on at least one side."
Considering all they observed was one field and one side of each sheep that is the only absolutely correct conclusion.
Sorry but sneakyness was not accounted for. Here is a quote from the article;
We cannot exclude the possibility that females commit research misconduct as frequently as males but are less likely to be detected.
That is the problem with doing statistical analysis of investigations as opposed to incidents as all incidents may not be detected and/or investigated.
Gee, that is comforting. Maybe you'll only get 35 years for that particular crime at worst... But, that is theft of a physical good - most likely you'll get off pretty light for that. Try to "steal" some music online and you could easily face a suit for 100 year's worth of wages at least.
Lets keep on the subject at hand. This is about criminal litigation and not civil litigation.
And who are you to call them to account?
His lawyer was concerned enough to bring up the possible suicide yet not concerned enough for another human being to do anything about it. The lawyer dropped the ball.
What do you want them to do, lock him up before he gets hauled off to prison?
If that would have saved his life, yes. Perhaps he could have even served his sentence in the cushy hospital.
Clearly you aren't looking to make things better for the next poor soul to end up in his place.
If by "poor soul" you men someone who broke several laws and threatened suicide then no I am not looking to make it better next time. The response to someone threatening suicide is not dropping charges it is institutionalizing that person in a hospital.
As taxpayers we're certainly accountable for his death, even if we outsource the dirty work to government officials.
That is your opinion. In my opinion there are two people accountable; Swartz' lawyer and Swartz himself.
The works being copied should have been in the public domain to begin with, so there should not have been copyright infringement.
So your opinion that the law is wrong means you can ignore it? Does that mean that of you really believe that the abortion clinic should not exist you are within your rights to burn it down? That is not the way the legal system works. Lobby to have the law changed.
The purpose of maximum penalties is to limit prosecutorial misconduct so they can not threaten 100 years for stealing a loaf of bread. They are also not sized for every possible crime that can fall under that law but the worstcase. Any good lawyer will tell his client the true probable sentence that would be imposed for that person's crime. It is based on common law and precedent.People rarely get the max for non violent property crimes and they usually serve their time concurrently for multiple charges.
It comes down to this, the six month plea bargain sentence was reasonable for the crimes committed. The defendant thought death was a better option. Sorry but that is a permanent solution to a temporary problem. Where were his lawyer, family or friends to see he was having trouble and commit him or stay with him for his own protection?
Did he promise to trust them on that?
Did they give him permission to test using software that was different than what found the vulnerability and could probably bring down the site as the software's manual states? It comes down to the fact he had no right to do what he did with the tools he used.
The more accurate version of your statement
The moral of the story is it's stupid to do illegal things that impact on system performance and stability and embarrass others when they know who you are.
(bolding is my addition)
It's like reporting to a bank that a lock has a vulnerability and then attacking it with a blowtorch two days later. Another view would be the parent yelling at the kid for saying "Are we there yet,?" every 30 seconds.
I think it is funny how you assume the error was made by a "silverback" when it is just as likely to have been made by a programmer right out of college.
Here is a quote from the Acunetix User Manual page 21:
NOTE: DO NOT SCAN A WEBSITE WITHOUT PROPER AUTHORIZATION!
Emphasis theirs
He didn't test the specific bug. He tested all possible bugs. Had he written a specific program to test the single bug I doubt there would have been an issue.
Checking on a production site in two days from a report is also a very short time. It takes longer than that to program and test the fix. Then it has to get sent out and installed correctly.
Like I said previously in this thread, wait at least a couple of weeks and test the single vulnerability not test for every possible one in two days.
I find it funny how no sys admins have chimed in that they would have jumped down his throat for screwing with their systems. O right, it's OK to screw with corporations.
In the hands of someone not authorized to use it in a web site it is a hacking suite. In the same vein as lokpicks in the hands of someone other than a lisenced locksmith are breaking and enter tools. He was searching for vulnerabilities in a site he did not own using a tool that can cause sites to crash. Had he wrote a script to test just the one he knew about I doubt there would have been an issue.
That is all beside the point I was trying to make in that he was "threatened" for the unauthorized running of the security test software and not for reporting the issue.
Again, you didn't get the issue. He was "threatened" because he attempted to hack after reporting the bug; not for reporting the bug.
Instead of awarding him or send him a thank you note.
They did thank him UNTIL HE ATTEMPTED TO HACK THEIR SYSTEM WITH A HACKING SUITE. Just because he reported a bug does not mean their system if free and open for him to play with. He crossed the line into hacking.
You continue to miss the point. He was not "threatened" until he used a hacker suite on the server. Finding the exploit was not the issue. He went over the line into hacking when he used a hacker suite. Had he stopped at reporting the issue there never would have been an NDA or any "threatening".
Your rule is to be a black hat in every instance. Not a good rule. My rule would be to report the bug and then check that specific bug much later.
It seems a big issue that the NDA was supposedly signed under duress. To me duress is something like "sign this or we will burn down your house" In this case it is more like "Given that you have now started to illegally use hacking software we are concerned that you will spread this information to others who will cause bigger issues. As a consequence of you illegal action and to protect ourselves we require you to sign this NDA. Failure to sign it shows inclination to spread this information therefore we will have to bring your actions to the police if you do not sign it". To me that is not duress as it is direct consequences of Al-Khabez's actions.
The stupidity of this story is that it is a bright person who has few social skills. Sure he was praised for finding the bug. Then he just had to test it two days later. I can just hear the thoughts going through the president of Skytech's mind, "It's great that you found the flaw but run a hacking suite on our servers and your ass is grass." Ever hear of poking the bear? Skyteck is probably a little sensitive that a major flaw was found. Now you look for more when that is probably what they are already doing? And only after two days? I guess the college student doesn't understand enterprise level software releases as it can take more than a couple of days to get a fix into the field. There are testing and scheduling to be concerned with. Had Al-Khabez waited a month and tested just the vulnerability he found I doubt there would have been an issue. Instead he ran a hacker suite after two days.
Here is the relevant section of the article;
After an initial meeting with Director of Information Services and Technology François Paradis on Oct. 24, where Mr. Paradis congratulated Mr. Al-Khabaz and colleague Ovidiu Mija for their work and promised that he and Skytech, the makers of Omnivox, would fix the problem immediately, things started to go downhill.
Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he and Mija had identified had been corrected. A few minutes later, the phone rang in the home he shares with his parents.
“It was Edouard Taza, the president of Skytech. He said that this was the second time they had seen me in their logs, and what I was doing was a cyber attack. I apologized, repeatedly, and explained that I was one of the people who discovered the vulnerability earlier that week and was just testing to make sure it was fixed. He told me that I could go to jail for six to twelve months for what I had just done and if I didn’t agree to meet with him and sign a non-disclosure agreement he was going to call the RCMP and have me arrested. So I signed the agreement.”
Note that jail was only mentioned after Acunetix was run.
When you say "this law" what are you talking about? Breaking and enter? tampering with computers? Copyright infringement? What is wrong with those laws? Everyone keeps harping on the the maximum penalties when we all know few get the max.
Again the summary is inaccurate as was the last article on this topic. All the state has is a list of handgun license holders not gun owners. Though there is a high correlation between the two there are license holders who do not own their own guns and/or do not store them at home. What can't people understand the simple difference between ownership and licensing?
Fist it is not 4096 bits. It takes 12 bits to make up 4096 possibilities. Also, don't you think that the scientists factored the 12 bits into their 300bps calculation? If there were only 300/12= 25 slots per second the data rate would be 300 bps.
Has anyone accused you of being an anarchist? It seems that you think any law (rule in your terms) that you do not agree with can be ignored and trivialized. Sorry but our elected officials have not decided that refusing to clean the bathroom is sufficient social implications to rate prison time. They have decided that breaking and entering, tampering with computers and dissemination copyright material without authorization is serious enough for incarceration. That is the difference between a parental rule and a law. Attempting to equate the two is absurd. It is not about "I have the power to enforce this so I will". It is "this conduct is a determent to society so must be deterred in some way". If you disagree with a law change the law otherwise all we have is anarchy.
Since Swatrz is "much more of an adult than most" then why compare his actions with the actions of a kid? That is another difference in the situations you bring up and the actual situation.
If we went with what you want, an insignificant monetary fine, there would be no "great personal risk to himself" as there would be no real consequences.
Do you really think it would take less police and prosecutor time to prove what he did based on a shorter sentence? No matter how long the sentence is the state still has to prove it's case. He knew what he was doing was against the law. He knew the penalties for the crimes, He chose to do it anyway.