Aside from the legal liability (which is obviously ridiculous and possibly quite realistic;) of intercepting communications, say, as the article suggests, that the hacker sets up a chat. By leaving it up (monitoring it, of course) you are indirectly helping the hackers that use said chat.
Of course if you see the hacker actually hacking somebody else (very realistic scenario) you really *should* do something. Is alerting them enough? Would you be happy if you get a phone call saying: "So sorry friend, you should reinstall your servers, I just had an incredibly fun and instructive week watching some hackers make swiss cheese out of your systems."
You can probably gather from the above I am not a big fan of honeypots. Aside from all else I think they could give you a false sense of security- you watch the honeypot with an eagle eye, while your other systems get hacked - unless your security is perfect, and then why bother. I do see their use, it is likely you would detect at least a probe - but if your system is at all typical, you allready have a bunch of probes every day...
Reading slashdot beats working - Q
Slashdot Mirror
Aside from the legal liability (which is obviously ridiculous and possibly quite realistic ;) of intercepting communications, say, as the article suggests, that the hacker sets up a chat. By leaving it up (monitoring it, of course) you are indirectly helping the hackers that use said chat.
Of course if you see the hacker actually hacking somebody else (very realistic scenario) you really *should* do something. Is alerting them enough? Would you be happy if you get a phone call saying: "So sorry friend, you should reinstall your servers, I just had an incredibly fun and instructive week watching some hackers make swiss cheese out of your systems."
You can probably gather from the above I am not a big fan of honeypots. Aside from all else I think they could give you a false sense of security- you watch the honeypot with an eagle eye, while your other systems get hacked - unless your security is perfect, and then why bother. I do see their use, it is likely you would detect at least a probe - but if your system is at all typical, you allready have a bunch of probes every day...
Reading slashdot beats working - Q