Jail Looms for Man Who Revealed AT&T Leaked iPad User E-Mails - <AUTHOR> http://www.technologyreview.com/view/507661/jail-looms-for-man-who-revealed-att-leaked-ipad-user-e-mails/ <comment><USER2> Hi there - I'm the one who put up the $50k to bail weev out of jail.[1] (Otherwise he would have had to sit in Essex County Jail during these ~2 years since this started.)

There were some others in line to assist (I live in Europe), but they all feared various forms of retribution/harassment from the FBI/DoJ, so it fell to me (someone with comparatively little to lose, stateside). This only serves to underscore the truly chilling effects of these sorts of governmental abuses of power.

I also host his website, <http://freeweev.info>, where you can make donations to his case via both Paypal and Bitcoin. (He has various restrictions placed on his use of technology while out on bail.)

Please feel free to contact me directly if you have questions related to his case. Contact info can be found in my profile.

5539 AD00 DE4C 42F3 AFE1 1575 0524 43F4 DF2A 55C2

[1] <https://twitter.com/rabite/status/270668883172671489>

<comment><USER3> I'm glad someone is taking on the task of defending Weev because the charges they have against him are ridiculous and stupid.

Sadly, Weev's nature is that of a rattlesnake, and he's basically burned every bridge he could on his way here. Thus, the EFF will have nothing to do with him.

<comment><USER4> > Sadly, Weev's nature is that of a rattlesnake, and he's basically burned > every bridge he could on his way here. Thus, the EFF will have nothing to do > with him.

Could you expand on that? Why doesn't the EFF want to help him?

<comment><USER3> Sorry, not going there. Suffice to say, he burned a bridge.

</comment></comment></comment></comment><comment><USER5> From my understanding all you had to do was pass the ICC-ID to a script on AT&T's servers to get back the user data. I can see the court interpreting the ICC-ID as a form of access control since you'd have to guess them similarly to passwords.

What isn't quite clear to me is what they did with this data. It seems they reported the hole to AT&T who then fixed it. That's good. It also seems they passed the data off to reporters, which may be bad for their case. It seems like they acted, at least mostly, responsibly.

Assuming the data was never released to the public I don't think they should be prosecuting Auernheimer. That said, it does seem like they have a case based on the wording of the law.

It's a very real possibility that he's facing jail time, especially when you consider the volume of data. He's charged with breaking 18 USC § 1028A (aggravated ID theft laws) which carries a mandatory minimum of 2 years. Federal judges have _some_ control over this but generally stick with sentencing guidelines. He could fight it and win, get them to reduce the charges, or do some serious work for the gov and hope the judge goes easy on him.

 _Note: I was convicted of violating 18 USC § 1028A (among other laws) so I have personal experience with this law, sentencing guidelines, and judge discretion but IANAL._

<comment><USER2> The ICCIDs here are sequential integers. It wasn't brute force, just incrementation. They are not secret and are certainly not access credentials. There were no access controls surrounding the web service in question.

The prosecution is asserting that access to any system without authorization is "access to a protected system" in the legal sense, which is obviously bogus. This would make the Googlebot's operators criminally liable if I put up a site at "johndoessocialsecuritynumber.com".

In fact, authorization is built into HTTP. There were no protections in place surrounding this data. Regardless of what he did with the data, downloading something from a public website is not criminal. (Though irrelevant legally, it's worth noting that he did nothing with the data except shame AT&T.)

(I put up weev's bail and am handling some of his PR while his computer restrictions are in place.)

<comment><USER6> No, it wouldn't expose Google to that liability, because Google would have no intent to access information of any sort, let alone information that Google would have reason to believe it shouldn't have access to. The crimes charged here aren't strict-liability; the prosecution is required to prove intent.

Also: the authorization "built into" HTTP is used by a tiny minority of all web applications. Clearly, if you break into a retail brokerage and execute trades on behalf of other people, you're going to be liable, regardless of how that retail brokerage chooses to authenticate access to the site.

(I don't have a position about this particular case; I know virtually nothing about it).

<comment><USER7> I'm guessing that sneak wasn't referring to HTTP Basic Auth, but rather the fact that when an HTTP client says "GET", the server effectively says "HOW MUCH?" (A crude allusion to the classic "jump/how high?") I think sneak is arguing that receiving a response to an isolated GET request implies that the GET request was "authorized."

Edit: after reading selections of IRC logs and e-mails from the indictment, my sympathy with weev has been reduced. Granted, an indictment will select the most salacious excerpts to make its case in the strongest way possible, but the conversations in the indictment are far from white hat (unless the defendants manage to convince the court that their talk of phishing and spamming was merely juvenile humor).

<comment><USER8> I wonder what one could get an expert witness to testify to with regards to the meaning behind the HTTP protocol with respect to 'authorization'.

<comment><USER2> Sergey Bratus[1] (of Langsec[2] fame) testified as an expert witness for the defense in this very way within the last few days.

[1] <http://www.cs.dartmouth.edu/~sergey/>

[2] <http://www.cs.dartmouth.edu/~sergey/langsec/>

<comment><USER6> Do you really buy this line of argument? How many banking applications configure themselves so that they rely on the intended meanings of HTTP verbs and authorization headers as their primary overt security mechanism? And of those, how many do so correctly?

I get why Bratus would testify. The defendant here needs all the help he can get and is morally entitled to the best case he can possibly present. I respect and admire everyone who is trying to help him out. But presuming he's not guilty of a real conspiracy to defraud anyone, I have a hard time believing it's because AT&T's web application vulnerability entitled the public to their database.

<comment><USER7> I think it's reasonable for them to argue that AT&T's server's willingness to give them the e-mail addresses means that obtaining the addresses was not illegal, and that despite mulling over the darker possibilities available to them, by choosing not to put the e-mail addresses to illegal use they committed no crime. They could argue that they should not be convicted of conspiracy because they ultimately decided not to abuse the list of addresses.

<comment><USER6> I would like it to be harder than it seems to be to prove conspiracy to commit fraud.

I don't think I'd like it to be harder than it seems to be to prove unauthorized access.

I know that's the opposite of what most nerds like me want, but I think we're well served by a very broad definition of unauthorized access, and we're poorly served by vague conspiracy laws in more places than just online.

Note that under the US Code, you need _both elements_. Just plain unauthorized access isn't a federal crime; you need an intent to defraud.

<comment><USER7> _I know that's the opposite of what most nerds like me want, but I think we're well served by a very broad definition of unauthorized access, and we're poorly served by vague conspiracy laws in more places than just online._

I do agree with you regarding conspiracy, but you are right that I would in principle prefer to have every Internet-facing system as robustly secured as if it had been independently reviewed by you, cpercival, and the people who wrote the space shuttle's software. A small part of the reason I want this is so that absolutely anybody can confidently write and deploy scraping software that collects and analyzes information in new ways (e.g. IBM Watson, better search engines, or some other as yet undiscovered idea).

<comment><USER6> The CFAA does not in practice prevent search engines from scraping pages. In order to be charged under the CFAA, you must willfully access specific information on a website in furtherance of a fraudulent scheme, which in turn means you must be making specific representations as to your identity or actions that a website could reasonably rely on in order to trick that website into doing something it wouldn't have done otherwise. In CFAA cases, the prosecution must prove not only unauthorized access (which is easy) but also fraud (which is not as easy).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The article states

"Weev and a fellow hacker who originally uncovered AT&T's mistake and collected the e-mails didn't ask the company for permission to access the Web addresses that shared iPad users' private information"

I really don't see how this argument holds up.

From a technical point of view the very nature of HTTP includes asking for permission. You send a request "Please can I see the information at this URL" If the organisation running the server does not give that permission, it should not serve the data.

These charges seem pretty odd to me, hopefully it gets resolved in a sensible manner.

<comment><USER10> > From a technical point of view the very nature of HTTP includes asking for > permission.

A web server isn't an agent of the company and has no capacity to grant or deny permission.

Think of it as a security system you install in your home. Now, if the security system is malfunctioning and you notice that it is malfunctioning ... do you call up the owner and let them know or do you go inside and look through their stuff? If you go inside and look through their stuff, it's trespassing.

Obviously the two scenarios aren't the same, but I'd imagine that's the logic used in the argument.

<comment><USER11> As an information security professional, I see two different issues at play here. First, they got access. They were granted access by the admin who did not lock down the server. I am not a lawyer, but I see the unauthenticated web server, no matter how much of a mistake, as being implicit permission to access the site. A house, by default, implies privacy. A web server is more of a business in this metaphor. If the door is open and the lights are on, it's implied you can come in and look around. Machines accessible over the web are by default open to everyone unless permission is revoked. The "unauthorized access" charge, in my opinion, should be struck down. When a site is made accessible from the unauthenticated Internet an admin implicitly granting you permission to visit the site.

The second issue at play is the fact that the guy apparently collected some email conversations to use as proof. Using my business metaphor, walking into a closed business that to a layman appears open is a simple mistake. Anyone could reasonably assume the business is open. However, collecting their merchandise even just to prove they forgot to lock up would still be stealing. In this situation, it's unauthorized copying. Most reasonable people would consider this to be unacceptable.

The second situation is muddied a bit further by my wording "most". Websites accessible when unauthenticated are able to be scraped easily. What if the Googlebot crawled the site and collected the information due to a poor robots.txt? What if you walked into the business and tried some free samples (unauthenticated websites are implicitly free samples)? Data privacy comes into play on this one though, and I would argue that any reasonable person would understand these as private communications. While they are accessible to view, any reasonable person would understand it is unethical to read them and unacceptable to copy them.

The fatal flaw of the defendant was copying the emails. Up to that point, he was completely within reasonable practice in my opinion. Here's a takeaway for any startups: security isn't a joke. It's a career ender, it's a business ender, and it could be a career ender for your customers who trusted you. You hire the best programmers, but budget a little aside for an external penetration test, and take the results seriously. Don't lose your company and your reputation because of a caffeine-fueled oversight.

<comment><USER10> You don't live in a world governed by machines and pure logic. You live in a world governed by human beings and their nature.

You have the capacity to recognize where you should be and where you shouldn't be. What you should be seeing and what you shouldn't be seeing.

Right from wrong.

> A web server is more of a business in this metaphor. If the door is open and > the lights are on, it's implied you can come in and look around.

No.

If you're inside a business and you see a door open and it is evident by the design of the building that it is their storage space ... you do not have the right to waltz on in. You damn well know through your experience in hundreds of other stores that this area is used by employees and for employees only. You do not belong there.

Are you telling me he read those emails by accident? Just stumbled on them? Or did he know _exactly_ what he was doing?

Enough of this white hat bullshit. I do not have the right to self-deputize myself and become a vigilante on the Internet. If these clowns don't know how to secure their own damn servers, let them pay the price that will be exacted by less scrupulous individuals. That's how the free market works. Stupidity is severely punished. They will very quickly learn how to properly set permissions on their server.

<comment><USER11> The problem with metaphors is that they only resemble what they are describing. They'll always be imperfect. The problem with web servers is that anything that is public-facing is just that. Security through obscurity is no security at all.

Like I said, the guy went too far. But visiting a public-facing website is not a crime, no matter how you happen to discover the URL. There's no sign on the door saying "keep out", even though the server is more than capable of displaying one. Do you have a right to walk into any business, or walk into their storage space? No, but any reasonable person (notice I keep using this phrase? It's going to come up in court) would assume if the lights are on and the door is open, you can walk in. You might be mistaken, and a clerk might show you out. Intent is a critical factor. Like I said, the guy went too far. He didn't enter by mistake, though someone could have. He entered with the intent of making unauthorized copies of private data. Walking into a store's storage space isn't illegal, but a reasonable person would know that taking pictures of customer data _is_.

It's not illegal to visit any public facing Internet site. It is illegal to make unauthorized copies of restricted data. It's also against The company is hugely to blame in this situation for leaking private information. So is the guy who broke the law by making unauthorized copies of this private information. I support him having criminal charges filed against him. My point was that there are two issues at hand, one illegal and one perfectly within the law. Implied consent at odds with intent. It should be an interesting case.

<comment><USER10> > Intent is a critical factor. Like I said, the guy went too far. He didn't > enter by mistake, though someone could have. He entered with the intent of > making unauthorized copies of private data.

We're in agreement here. I think we're both making the same point. Intent is the key here.

The problem is that if you just consider servers, configurations, permissions, and other technical aspects ... intent doesn't enter the picture. That's the wrong way to think about this.

<comment><USER11> I do agree that we're making the same point, and I wrote my response to you in the mindset that I had poorly communicated my initial conclusion. Your point compliments my own. The difference we may have is that I don't view intent in the highest importance when someone visits a public server. Intent will only get you so far as long as server, configurations, permissions, and other technical aspects are in order. The reason he was able to copy restricted data is because the technical aspects were not in order. That's where the muddiness comes in; you wouldn't need intent to make unauthorized copies in this situation. The Googlebot could have made unauthorized copies. Your browser's cache could make unauthorized copies. Archive.org could have made unauthorized copies. Googling for plaintext and valid credit card numbers might shock you in what Google is finding on public servers.

His intent comes into play only secondarily in my opinion. I might enter a store with intent to steal something, but if a security guard is standing next to me and a camera is watching, I'd walk right back out. The lack of security is what allowed him to complete his intentions of unauthorized copying. It does not absolve him of his crimes, but thinking about the potential for unintentional restricted data access tells me that his crimes sit in line with the failed (non-criminal but out-of-compliance) policies of the host.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> We live in a tech-filled world without a reliable means for responsible disclosure, no way to hold a company accountable for reacting to attempts of responsible disclosure, and any whistle-blowers are immediately branded as "criminals" and "hackers".

This whole process, or lack thereof, needs some serious disruption.

 _Edit: My comment is intended to be a general observation and not specifically about this case_

<comment><USER13> >> We live in a tech-filled world without a reliable means for responsible disclosure

There are many avenues for responsible disclosure, Google that phrase.

<comment><USER14> As far as I know, following responsible disclosure practices does not waive any legal liability. It may make you look professional, but if someone who is friends with the FBI wants to fuck you, they can still fuck you.

<comment><USER6> Following the published disclosure guidelines that Google and Facebook created will in fact prevent the FBI from "fucking you", because any lawyer in the world can read the plain meaning of the statutes point out that a reasonable person would believe they had permission to conduct tests.

On the other hand, if you're dealing with an application for which you don't have any written permission to test, just stop. You are not entitled to conduct your own security tests of other people's applications. Leave them alone.

<comment><USER12> > You are not entitled to conduct your own security tests of other people's > applications. Leave them alone.

Your attitude is part of the problem and why we need a solution.

Let's create an analogy: I drop off my daughter at daycare, I've entrusted this place of business with something vital to me, as have numerous other customers. I get off work early to go pick up my daughter, upon arrival, I find the guardian eating lunch in an adjacent room and the children are left completely unattended. This is clearly a problem on numerous levels.

So what do I do? Do I politely inform the administration of the issue and hope they will fix things immediately? What if they blow me off and do not discipline nor change policy? Do I withdraw my child's enrollment and just blindly hope that other customers know of their utter disregard for the trust we've placed in them? Do I report them to the police or child protective services? Do I picket the business and attempt to inform other people of the issues? What if informing the public simultaneously informs some criminals of the ability to do some baby snatching?

In this scenario, a parent actually has some legal recourse options to ensure the problem is fixed. The issue in web security is there is no governing authority to report the problem to and if we take our findings public, we place other customer's information at risk and put ourselves in a position of legal risk as well. We get branded a "criminal hacker" and find ourselves off to jail.

<comment><USER6> Two things.

First, you're responding to a factual argument with an argument about my attitude. It is not "my attitude" that people "shouldn't" be entitled to test applications. It is a fact that they are not allowed to do that. Unauthorized access to computer systems, which has a broad but actually very straightforward definition, is unlawful. If you cause damages when you do it, you're liable for civil damages. If you attempt in any way to profit from having done it, you're liable for a felony charge.

Second, arguing about this stuff by analogy is perilous. You can see that here, because it's immediately obvious that observing your child's caretaker eating lunch is not comparable to breaking into a web application to steal a database over the span of several days. To attempt to equalize the analogy, imagine that instead of simply observing your child's caretaker, you instead break into that caretaker's residence or place of work. You've now committed a felony.

I am for many obvious reasons pro- security testing, and I'm happy to speak glowingly of the companies that have set up policies to make it safer for researchers to test their sites. In advice I've provided on HN and to startups, I've consistently told companies to create pages to thank security researchers.

Having said all that: if you don't have permission to test someone's web app, don't do it. The law very reasonably says that if a company doesn't want to submit itself to unauthorized intrusive testing by strangers, it is entitled to treat its applications, its servers, and the data it holds as private property. Not every case in which a stranger pokes for flaws in someone's app will be open- and- shut, and that's for the best too. But the rule of thumb is very simple: leave other people's apps alone.

<comment><USER12> _(To be clear, I'm speaking more broadly about the topic and absolutely not condoning the weev's alleged actions. Lack of responsible disclosure, discussion of profiting from the flaw and exploiting it far beyond simple validation tests are all going to make it very difficult for him.)_

Observing sequential identifiers in a URL and validating a gaping security hole is hardly something I'd classify along the lines of "stealing a database" nor should it be considered "unauthorized access", however the judicial system clearly feels different and that's the sort of changes I'm advocating that need to be adjusted.

Of course, discussing legislation changes that would allow anyone to execute security testing is probably not a very lucrative topic with the founder of a company that provides security research & testing.

<comment><USER15> That last sentence is incredibly lame. I've had problems with 'tptacek (from an incident several years ago that I'm finally over) but he argues for security policies that he believes work, not those that are in his interest.

A wild-west attitude, with every man for himself, no-holds-barred, no-legal- resource-when-you-are-hacked is the best possible thing for security people, who would be kingmakers in such a universe.

<comment><USER16> The security field in such a universe would be a gigantic, insanely lucrative shakedown racket. "I can help harden your systems against attacks — or I can just steal your customer database and sell their info to these nice Russian gentlemen. Whichever you prefer."

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> guard-of-terra He should totally have posted those on pastebin instead and shared on the net.

I think that if one finds an embarrassing security vulnerability, they should look up the offending company and upon finding that company ever took part in the crap like described in the article, they should publish the vulnerability wide open, goatse-style, anonymously via pastebin.

Those companies should suffer to the end of times and their clients should too.

Unless that company properly apologized, which they never do. Corporations don't seem to be capable of that. Not in their DNA.

<comment><USER17> Why should I, as an innocent party to a companies security failings have my personal details revealed. This is exactly why we have laws protecting identity theft and fraud.

Naming and shaming the company and the extent of their security failing is enough. But only _after_ they have patched the hole.

<comment><USER18> Because you trusted the wrong people, and this has consequences.

The customer has to suffer from the mistakes of the companies so that:

1\. She stops trusting any company blindly with her data.

2\. The market demands improvements from the service providers (and no, sacrificing a scapegoat in court is not an "improvement").

3\. Service companies react. Unless there's a major scandal, companies are slow to react to vulnerabilities.

 _About that last point, it's a bit unfair to assume that the activist tried to contact AT &T and they didn't react. I honestly don't know if that's what happened in this case, and I hope it is. However there are several cases of companies "turning a blind eye" on the issue._

As a customer, the only entity to blame when such a breach occur, is the provider that you entrusted with your data. Not the activists (regardless of their intents) nor the _hackers_ or whatever monster you heard about in the media.

If I entrust (and pay) someone with my bike and it gets stolen on his watch, who's to blame? The thief or the guardian?

<comment><USER19> This is an excellent point... sloppy, careless companies can operate more cheaply (until they go down in flames); insulating the consumer from these security risks would introduce the same kind of moral hazard as insulating investors from the downside on risky investments.

</comment></comment></comment></comment><comment><USER20> This is extremely dangerous. Condemning the whistle blowers results in a much less secure environment, since you'll scare away the white hats, and insecure systems will remain insecure. We need whistle blower protection laws in place, and we need them now.

<comment><USER2> What's further terrifying is that the courts have made restriction of his use of non-windows non-monitored computers part of his bail conditions - prior to a trial to determine guilt.

A person who's only marketable skill is on the Internet, completely prohibited from using ssh or virtualization, by nothing more than an error-riddled FBI complaint document. (This started prior to the grand jury indictment.) He's been without significant work for over two years as a result.

It's a scary thought that this could happen to any one of us.

<comment><USER21> >What's further terrifying is that the courts have made restriction of his use of non-windows non-monitored computers part of his bail conditions - prior to a trial to determine guilt.

How does he use a telephone? Or a suitably advanced toaster?

<comment><USER2> At first, we had to drive all over to find a phone that couldn't even MMS (because MMS can be used to send email). It was a nightmare.

Eventually some of those restrictions were relaxed.

</comment></comment></comment></comment><comment><USER22> Bah, more weev hagiography? He's not a whistle blower, he's a troll.

Look: first off, he didn't tell AT&T about the hack, he told a bunch of news organizations. See [http://www.forbes.com/sites/firewall/2010/06/09/atts-ipad- ha...](http://www.forbes.com/sites/firewall/2010/06/09/atts-ipad-hackers- ignored-by-reuters-other-mainstream-press/) for details. "we did a benefit analysis and decided they could take our story viral the fastest."

One of those organizations presumably told AT&T; all AT&T has ever said is that they learned about the exploit from a business customer.

Second, weev is the same guy who got up on stage at Toorcon and lied about finding an exploit in Firefox. Just flat out lied. One of the ways in which he's a great social manipulator is that he has no qualms about the big lies, and doesn't really care if they're noticed.

Third, at the time, weev said "There is nothing in Apple's SDK APIs that would allow an application to have this identifier [the ICC-ID] – it is a shared secret that should indicate physical proximity to the iPad." So while it's amusing to see his defenders talk about how unimportant ICC-IDs are, it's an interesting change of tune.

Fourth, even if you believe weev when he says he forced the Amazon delist of gay-themed books (I never have), that goes over the line from activism to exploiting.

Yeah, we do have to protect even unpleasant, obnoxious whistle blowers. I just don't see how weev counts as a whistle blower, and I think that any article on his situation should present the full picture rather than painting him as a misunderstood good guy.

<comment><USER23> Weev is different. That's for sure. But what's at stake here is bigger than him. Anyone can be sued for going to a damn URL. That's the real problem here (as well as a myriad of others).

</comment></comment><comment><USER24> And who at AT&T faces jail for publicly exposing these Emails in first place?

</comment><comment><USER25> 10 years in jail for incrementing an integer at the end of a URL. Wow. What a disconnect.

</comment><comment><USER26> It's pretty scary that you can go to jail (for a long time!) for something as simple as:

> ~curl <http://example.com/att/[1-100].html>

I understand what the lawyers are saying, but this is just beyond common sense. There _should_ be liabilities for deploying software that publicly gives out information you do not intend to.

<comment><USER15> If you've never deployed software without security flaws, it means you have never deployed software.

<comment><USER26> Sure, but why should who makes the software bear no responsibility? If a building is found to have a flaw the architect or an engineer are who get questions, not whoever noticed the flaw.

<comment><USER15> The flaws in architecture are well-understood and there are rarely-changing building codes to describe exactly what should and should not happen.

Software does not exist in any such stable world. There can be two pieces of software, each perfectly legitimate and doing exactly what they intend, that when both are present format a customer's hard drive. Who does the customer sue then?

If you want to make developers responsible, I won't personally be hurt much, since I can make a shitload of money finding vulnerabilities in other people's code (and have done so in the past). The lawyers will make lots of money, too, as we have jury trials to figure out whether that SQL injection was really negligent or not.

</comment></comment></comment></comment><comment><USER27> The indictment filed against Weev by the DOJ in 2011:

<http://www.scribd.com/doc/113664772/46-Indictment>

<comment><USER28> The complaint cites "losses"

> To date, AT&T has spent approximately $73,000 in remedying the data breach. > Those costs include, among other things, the cost of contacting all iPad 3G > customers to inform them of the breach and AT&T's response to it.

BOO-#$%^ING-HOO.

As if AT&T shouldn't have had to lock down their user's info, and it's some kind of injustice to them that they have to do things the right way now. This perfectly highlights the fundamental disconnect between the corporations, the (their) legal system, and the Internet-connected world.

</comment></comment><comment><USER29> How about this. What if we have another section on websites called something like 'Submit a bug' next to 'About,' 'Contact Us' etc.

If more and more sites make it easier to report these things to them, hopefully either the error will be fixed or if it is being ignored, the "hacker" will have some kind of proof to claim that he tried to tell the bank to fix their door.

<comment><USER2> How about this: We don't prosecute people for loading URLs on the public internet first and foremost.

</comment></comment><comment><USER30> > "The more concerning charge to online activists watching Weev's case is > based on the Computer Fraud and Abuse Act, which forbids "unauthorized > access" to a computer."

There are HTTP codes to indicate lack of authorization. Presumably he didn't encounter those. How is this an argument?

</comment><comment><USER31> Although we all know what 'hacker' means, I suspect that most people think the words means 'someone who does nefarious things with computers.' Calling him a hacker probably doesn't help his case, regardless of him being guilty or not.

</comment><comment><USER32> He's no whistleblower; a criminal bum is all. He's a Freemason (wannabee or otherwise), enough said.</comment>


World's Most Expensive Single Objects - <AUTHOR> http://en.wikipedia.org/wiki/List_of_world%27s_most_expensive_single_objects

<comment><USER2> Note that the list is sorted by absolute dollars, not taking inflation into account; the Alaska Pipeline, costing $8B in 1977 would be roughly $28B in 2009 dollars (subject to the entirely unsupported assumption that construction costs rise in parallel with CPI), which would put it into second place after the ISS instead of 6th place.

Or, put another way: the Alaska Pipeline is, corrected for inflation, the most expensive object on earth. :-)

</comment><comment><USER3> I'm somewhat surprised to see that San Francisco's New Bay Bridge is going to cost more than the LHC.

</comment><comment><USER4> Interesting that the Big Dig cost twice as much as the Channel Tunnel.</comment>


The Website MLB Couldn't Buy - <AUTHOR> http://grantland.com/features/the-website-mlb-couldnt-buy/ <comment><USER2> Love that they're Twins fans. What a funny coincidence.

</comment><comment><USER3> I liked the humour tucked into the article

> ... Seattle, it seems, takes its URLs seriously ...

and

> ... replaced by an "Under Construction" sign and no fewer than four GIFs of > jackhammers and excavators. Clearly, some serious site building was under > way.

Things like that keep me interested in an otherwise (too) long article.

</comment><comment><USER4> I actually sold a team domain to MLB. They didn't approach through Cahn (and the fact that his name appears is a PR coup for him) but through a corporate registrar iirc was CSC who does some name recovery for big brands.

<comment><USER5> Which one?

<comment><USER4> Wish I could say but probably not a good idea to give out that info. It was an East Coast team though.

</comment></comment></comment><comment><USER6> Nowhere did they mention [http://www.baseball.com/](http://www.baseball.com/), the website I would have guessed was referred to by the title before I read the article.

<comment><USER7> I lost interest half way through. It seems strange to me to hold on to a domain name when someone is offering almost 1mil for it.

<comment><USER8> If you don't need money there's not really any reason to sell something for it.

<comment><USER4> I deal in this industry. It's not always about needing the money or not needing it. It about gambling that the that offer of 1 million actually could be 2 million. You'd be surprised at how even ordinary people think when they get wind that they have something valuable.

Fun Fact: I bought a domain name for a reasonable price off a patent troll company. Was actually one of the easier and most surprising transactions I ever did.

<comment><USER7> These guys down sound like squatters. They just have had the domain their entire lives and don't really care to sell it.</comment></comment></comment></comment></comment>


Is it acceptable that Slack uses 50% CPU when you're simply typing? - <AUTHOR> http://imgur.com/a/5Wt2n <comment><USER2> Slack is a really nice chat tool but I ended up uninstalling. Both on my phone and laptop slack is the most resource hungry app I use and just obliterates my battery power. I was at most only connected to two slack groups and only one on the mobile app, so I was not even abusing it the same way i do chrome tabs :(

</comment><comment><USER3> The question is: is it acceptable to you?</comment>


(When) Will The MacBook Air Get a Touchscreen? - <AUTHOR> http://www.i4u.com/46922/when-will-macbook-air-get-touchscreen

<comment><USER2> When it can look good and easy to touch (which isn't in the normal laptop way). Dell have some laptops with a double hinge, which I doubt is good enough for Apple.</comment>


Zune Phone announced by end of 2008?  - <AUTHOR> http://www.thestandard.com/predictions/zune-phone-announced-end-2008 <comment><USER2> I doubt you can win a hockey game by skating towards where the puck was a few moments ago.</comment>


Ask HN: best explanation of HTTP request from ground up - <AUTHOR>

A few months ago someone submitted a blog post that explained what happens in an HTTP request from the ground up, at the level that your mom could understand it.  It included nuances like DNS lookup, SSL, interpreting the URL, etc.<p>Does anyone have the link handy?  Alternatively, if you think something does this particularly well, feel free to chime in with it. <comment><USER2> [http://www.moserware.com/2009/06/first-few-milliseconds- of-h...](http://www.moserware.com/2009/06/first-few-milliseconds-of- https.html)

any chance it's this?

<comment><AUTHOR> That's not the one, but this is interesting all the same. I'm gonna have to dive into this.

<comment><USER3> Thought I'd contribute this link.

<http://tomayko.com/writings/rest-to-my-wife>

</comment></comment></comment><comment><USER4> try this :

<http://www.garshol.priv.no/download/text/http-tut.html></comment>


Ashley Williams Joins the Core Team and Taking Lead of the Community Team - <AUTHOR> https://imgur.com/a/ERFYP <comment><USER2> The people who's posts were deleted do not deserve to be part of the Rust community.

<comment><USER3> An overwhelming majority of the deleted posts are actually very reasonable. When I checked the thread yesterday it was already locked and only the offensive posts were deleted.

Looks like now someone decided to also delete everything that wasn't praise.

[https://archive.fo/tmKkN](https://archive.fo/tmKkN)

</comment></comment><comment><AUTHOR> [https://imgur.com/a/nbT2G](https://imgur.com/a/nbT2G)

</comment><comment><AUTHOR> [https://www.reddit.com/r/node/comments/6whs2e/multiple_coc_v...](https://www.reddit.com/r/node/comments/6whs2e/multiple_coc_violations_by_nodejs_board_member/)</comment>


Ask HN: Do you have a side project you want to sell? - <AUTHOR>

It has been a while since the last time this was asked. Would love to see an updated version for 2015.<p>Previous thread: https://news.ycombinator.com/item?id=7656154 <comment><USER2> I was thinking about this HackerNews post last night and it got me thinking that small acquisitions are quite interesting. So I created a little site [http://startupsale.co](http://startupsale.co) as a place to facilitate people that want to sell/buy startups. Would love to hear everyones thoughts.

</comment><comment><USER3> We are currently looking to acquire established projects with revenue, budget up to 6 figures. Email me with details (address in profile).

</comment><comment><USER4> I'm selling my SaaS project. It's profitable but I don't have time to focus on marketing. Link to the flippa listing is in my profile.

<comment><USER2> This is really interesting. I would love to hear more about it. Please email me at email@example.com.

</comment></comment><comment><USER5> This one needs more attention than I have time for: [https://resumejoy.com](https://resumejoy.com)

<comment><USER6> Did you have a price in mind?

</comment></comment><comment><USER7> I have a side project that needs some life! [http://www.hurl.io](http://www.hurl.io)

</comment><comment><USER8> My old blog [http://upgadgets.com](http://upgadgets.com)

</comment><comment><USER9> I have a video blog that needs to go. homecookingrecipes.net.</comment>


Let's Make Vim Approachable - <AUTHOR> http://blog.paulrugelhiatt.com/vim/2014/10/21/lets-make-vim-approachable.html

<comment><USER2> Vim is user friendly. It's just picky about its friends.</comment>


Picturelife is giving Everpix customers a free place to park their photos - <AUTHOR> http://blog.picturelife.com/post/66939413446/a-safe-haven-for-everpix-customers-picturelife

<comment><USER2> As a pretty satisfied paying Picturelife user for the past year, I was kind of wondering when they were going to make some effort to attract those Everpix users. Good move.

Let's hope the "extended" freemium accounts of those Everpix users don't end up taking down Picturelife as well.

<comment><AUTHOR> They won't! We're in great shape and I think Everpix customers will help make us strong. Thanks for the kind words! Nate</comment></comment>


Show HN: See how technical recruiters view your resume - <AUTHOR> http://trystackup.com <comment><AUTHOR> Hi Hacker News - this is a project I've been working on to see what might happen if you try to extract information from technical resumes. Any feedback would be appreciated!</comment>


Ask HN: Founder vs Co-Founder title etiquette - <AUTHOR>

If person A founds a company, and several months later person B joins as a co-founder, what is the proper title etiquette for person A?<p>Is person A now a co-founder, or does person A still retain the title of founder, while person B has the title of co-founder? <comment><USER2> As an example of this, look at BankSimple. Josh and Shamir had been working for several months on the business deals and the beginning of the technology stack. They brought Alex on months later, but all three are now considered co- founders. Obviously, your situation could be different, but if the person's coming on as a partner, and not as an employee, then I'd go with "co-founder" for all involved.

</comment><comment><USER3> What do you mean by "founds a company"? Have an idea, create a product, incorporate, have paying customers, etc.?

<comment><USER4> Right - I have trouble with this too. How does person B join an already established, built company as a "co-founder"?

</comment></comment><comment><USER5> both person A and person B are co-founders.</comment>


Zenbar: The Fastest Smartphone App Switcher Concept on the Planet. - <AUTHOR> http://www.theverge.com/2012/12/2/3719600/zenbar-the-fastest-smartphone-app-switcher-concept-on-the-planet <comment><USER2> I really like this - swiping up from the bottom on either side would also be nice. Maybe sort them in reverse when pulling the bar up from the bottom vs. from the top. LRU vs MRU...?

Anyway, love the concept overall.</comment>


How to Live More Wisely Around Our Phones - <AUTHOR> https://emptyday.today/readings/how-to-live/ <comment><USER2> This title makes me a bit sad to be honest

Can't believe we reached a point where we need to live more wisely around our phones</comment>


Every single thing you see is future trash - <AUTHOR> http://believermag.com/issues/201009/?read=interview_nagle <comment><USER2> Whenever I'm making a purchase, I try to think about whether or not I'll still want to use that item in a few years. The way many of us buy new gadgets and throw them in the trash the second the next generation comes out scares me. Food and biodegradables will disappear over time, but the cell phones and laptops we toss in the trash for that next version of Android or iOS will sit in landfills forever, or until someone in a third world country melts it down in a home-made crucible. Even recycling electronics is a gamble--when I went to visit an HP recycling center 5 years ago, they admitted that much of what they reclaim stays in storage or goes otherwise unused because it's not cost- effective. (Maybe things have changed since then).

A history professor of mine once said that the legacy the Greeks and Romans left behind is bronze and marble; the legacy we leave behind will be all plastic.

<comment><USER3> Why would you leave your mobile phone at a recycling center for free?! Sell it on EBay!

</comment></comment><comment><USER4> The future is now... (throws something away)

Seriously though, I was trying to clean up my house a few years ago and over the summer filled three, 40 cubic yard construction dumpsters full of junk and my house is still full of junk.

</comment><comment><USER5> Well, or grist for an archaelogist of the 21+nth century.

</comment><comment><USER6> Including this post!</comment>


Data breach at IEEE.org: 100k plaintext passwords leaked - <AUTHOR> http://ieeelog.com

<comment><USER2> repost: <http://news.ycombinator.com/item?id=4570494>

</comment><comment><USER3> this is ridiculous, that 1. IEEE would be using FTP (instead of ANY more secure protocol (SFTP/SCP)? and 2. plaintext passwords in 2012 , man...

<comment><USER4> It's not quite what it seems. The passwords got into log files before the passwords were stored in the password database, and someone got a hold of the log files.

I suspect that this is far more common than people realize (sensitive data getting into log file, not log files getting leaked).</comment></comment>


Show HN: Memgraph – Transactional, in-memory, cypher-compatible graph database - <AUTHOR> https://memgraph.com/blog/announcing-memgraph-1-0-enterprise-ready-real-time-graph-database <comment><USER3> Hey everyone, Memgraph CTO here. This is a massive milestone for us that took almost 3 years to reach and I would like to thank everyone who helped us get here! If you have any questions or feedback, I'll be around all day to answer :D

<comment><USER4> Congrats. I'll be kicking the tires with this for some projects at my company.

</comment></comment><comment><USER5> How does this compare to Dgraph? Most recent discussion about it: [https://news.ycombinator.com/item?id=23031762](https://news.ycombinator.com/item?id=23031762)

Also, does it support GraphQL?

<comment><AUTHOR> To answer your first question, the main difference between Memgraph and Dgraph seem to be:

1\. The graph model: Property graph for Memgraph vs RDF for DGraph (Depending on the use-case you have one model might be better than the other. E.g ontologies are better served with RDF, whereas graphs with a lot of properties and labels are better served by the property graph model)

2\. Memgraph is an in-memory first system where is Dgraph is a disk-based system. Again depending on your use-case and the performance you are looking for, an in-memory system might be better suited.

3\. Query language & Ecosystem: we support Cypher and the Bolt Protocol (Same as Neo4j) so we work with a lot of the existing graph tools.

In terms of performance, we don't have official benchmarks yet but we have a few clients that test Memgraph and Dgraph and reported a 3-5x in read performance and about an 8x in write performance for their specific workloads.

I hope this answers your question.

<comment><USER6> Hi guys,

I'm community support at Dgraph. Reading that question. I come to clarify some points.

First of all, I don't particularly know Memgraph internally. So, I'll stick to Dgraph and related only.

About Karimtr's reply

1\. The graph model: Although Dgraph uses RDF as input data. Dgraph is not a Triple Store per se - and the RDF we have is a customized version, which means that it is not 100% compatible with any RDF model (e.g. Turtle RDF) - <USER2> eventually, many RDF syntaxes may be compatible.

The decision to use RDF was made a long time ago, for reasons that I am particularly unaware of. It was long before I joined Dgraph. We also accept JSON as data input. By the way, I also don't understand why Neo4j uses CSV as input data since it is not a Graph standard. RDF itself would be more acceptable than CSV. I assume they use CSV for strategic reasons.

1.1 In practice Dgraph is technically a "Property graph" like. There are no fundamental differences between the Dgraph's graph model with Neo4j other than the language itself and the way the data is stored and injected.

1.2 In Dgraph the data is stored in KV using BadgerDB.

1.3 Ontologies can be represented in any GraphDB. The difference is that Triple Store DBs have a language created to infer data specifically with the concept of ontology. And Triple Stores has standardized data input for this.

2\. That's right. However, I think we will soon have the option to keep it in memory. But I don't particularly know how useful this is. Today you can keep some Memory first data, but with the guarantee that they will be saved on disks. This helps in performance when there is no use of NVMe.

3\. We have GraphQL+- which is a rich language and inspired by GraphQL. And we also have GraphQL which is an "API" language that is now native in Dgraph. A friendly front-end language. And it works "out of the box" once you mount your schema. Dgraph creates a CRUD model based on your Schema. This reduces production time for your application and less logic on your business side. We are still adding "Black Magic" so that the experience in producing APPs is exceptional. And less code typing.

About performance. I suggest doing a test against ludicrous mode [https://discuss.dgraph.io/t/sharing-some-numbers-from-the- lu...](https://discuss.dgraph.io/t/sharing-some-numbers-from-the-ludicrous- mode/6310?u=micheldiz)

Cheers.

<comment><AUTHOR> Hey Michel,

thanks for joining the conversation and clarifying things. I'm far from being an expert on Dgraph so I learned a few things from your answer.

Regarding the data model, that makes sense. I read that Dgraph support properties so I thought you built something along the lines of the RDF+ framework with seems to support properties and labels.

Yes, you're right, ontologies can be represented in any graph but it's clear that RDF is a better option due to the reasons you mentioned and other ones. That's the nice thing about the emergence of different graph databases, you get to pick the right system for the right job :)

When it comes to performance, to be honest, I'm not a big fan of random benchmarks, as it's always tricky to get them right, especially for systems that have big differences. We usually let developers do that for their specific use-cases and we just try to help them set up Memgraph as best as possible. Cheers.

<comment><USER6> Nice, I didn't know about Memgraph. I gonna try it out, there is some video showing the goodies?

I'm with your docs in hands, need to finish some tasks and I gonna check it out!

Cheers!

</comment></comment></comment></comment></comment><comment><USER7> Can I use all NetworkX features and library functions from within memgraph, e.g. can I apply k_components to graph held within memgraph?

<comment><USER3> Yes, Memgraph has an embedded Python interpreter so you can run any NetworkX graph algorithm or any other Python code. The code has access to the whole graph, so a bunch of options exists. The entire Python integration is still in the early days, and we have a bunch of plans on how to improve further. What Python libraries do you generally use?

</comment></comment><comment><USER8> Congrats on reaching 1.0! I'm always interested in new GraphDB solutions and glad to see the Cypher integration and Neo4j wire compatibility here.

I'm excited seeing the progress being made in this space recently (this, redisgraph, etc) - the wider ecosystem is still immature but promising.

<comment><USER9> Thank you! We are here to do our fair share and provide the community with the right tools to solve different kinds of graph problems. Exciting space nevertheless and growing fast!

</comment></comment><comment><USER4> "An integrated ecosystem that would allow data scientists to easily leverage existing data science and machine learning tools to build graph-powered applications with minimum friction."

Graph databases have as much to do with data science as they do with any software applications.

Going to guess a VC made them put that there.

Definitely excited to try it out for a project I'm working on with DAG optimizations.

</comment><comment><USER10> Will there be an open-source edition?

<comment><AUTHOR> Karim from Memgraph here. That's a good question we get really often. As you can imagine we had our hands full for the past few years building a DB from scratch, and so we didn't really have the resources to put together an open- source project the way we imagine it. It's something we'll explore this year to try to come up with the best way to do it.

</comment></comment><comment><USER11> Would Memgraph be a good app to geolocate all of the data involved with a graph database? Example: geolocate all of the electric distribution networks around the country7globe that interconnect with the values of the graph?

<comment><AUTHOR> Karim from Memgraph here. Thanks for the questions. Are you referring to geospatial capabilities? If I understand correctly, you would like to add geospatial coordinates to specific elements in the graph (e.g. power stations, power lines etc) and be able to search and query for specific areas (e.g. countries, cities, etc)?

If that's the case, although we don't have direct support for Geospatial data format, you can easily encode it into your graph by setting coordinate as a property on your nodes and edges.

Does this answer your question?

<comment><USER11> Yes Karim, exactly that! :) Thank you for the answer

</comment></comment></comment><comment><USER10> Can Memgraph be used as an embedded database similar to SQLite?

<comment><USER3> The intended usage isn't that one because Memgraph is built as a server database system. The communication has to go via the binary protocol. But, because Memgraph is implemented in C/C++ and there is the C API for the query modules already in-place, offering an embedded solution is possible. This feature isn't high on the priorities list at the moment. What would be your target platforms? Mobile or maybe something on the IoT side?

<comment><USER12> +1 for mobile

</comment></comment></comment><comment><USER13> Congrats on the launch! Which graph algorithms do you support?

<comment><USER3> Thank you! Memgraph has built-in BFS, DFS, and weighted-shortest path. These can leverage the query planning (use the details about data distribution to perform better). Since query modules are introduced, algorithms like Page Rank could be easily implemented. Memgraph offers a couple of them out of the box. Last but not least, all algorithms from the Python eco-system could be run inside Memgraph.

</comment></comment><comment><USER14> Congratulations on your release! Keep up the good work!

<comment><USER9> Thank you!

</comment></comment><comment><USER15> Congrats on the launch!

Do you have any plans to release a NodeJs Driver?

<comment><USER3> Thank you! So far, Memgraph offers and supports C/C++ library ([https://github.com/memgraph/mgclient](https://github.com/memgraph/mgclient)) and Python binding ([https://github.com/memgraph/pymgclient](https://github.com/memgraph/pymgclient)). Node.js is going to come shortly. Please stay tuned!

</comment></comment><comment><USER16> This looks really cool, congrats on publishing DB :D

<comment><USER3> Thank you!

</comment></comment><comment><USER17> How do you handle high-availability? Also, do you have some sort of persistency model for the community version which doesn't have HA?

<comment><USER9> Dominik from Memgraph here. Good questions!

All editions of Memgraph persist data to the disk via write-ahead logging (WAL) and periodic snapshots for log compaction so even though Memgraph is designed to be in-memory first, data is always backed up to disk. If you enable asynchronous (periodic fsync) WAL, you can trade off a small window of durability for better performance.

Before 1.0, Memgraph leveraged the RAFT consensus algorithm for HA which worked great but had some performance implications. Based on feedback from our users and customers, we have decided to switch our HA implementation to the streaming replication model (similar to PostgreSQL) with automatic failover.

<comment><USER18> Interesting. Would you mind to go into details about dropping RAFT? It would make a great tech blog post imho, but maybe you could share some high level insights on that?

Related to that: have you considered extensions to the RAFT standard e.g. pipelining?

</comment></comment></comment><comment><USER19> This is huge! I'd like to see the roadmap for graph algorithms and graph neural nets! I can provide feedback on both.

<comment><USER3> Yea, we're still discussing the exact roadmap on this side. In the short term, the plan is to integrate better with the whole ecosystem. We are still exploring options on the graph NN side. Do you have any specific algorithms to point out? :D

</comment></comment><comment><USER20> Hey everyone,

Two questions, please. What about C#? Do you have some API? What about spatial search? Do you have that integrated in API?

Thanks

</comment><comment><USER21> How does this compare to RedisGraph?

<comment><AUTHOR> Good question :D We haven't spent much time trying out RedisGraph, nor we ran any kind of benchmarks at his point, but from what I can see, I would say that the main differences would:

1\. Memgraph is a native GraphDB which means that it's specifically engineered to support graph and graph only whereas RedisGraph is a module that runs on top of key-value store (nothing wrong with that, but it might have some limitation when it comes to performance on complex graph algorithms and traversals)

2\. Cypher coverage – We cover about 80% of the cypher query language, where I think RedisGraph covers only a small portion (But I hear that they're improving on that)

Apart from that, I guess you would really need to test both when for specific use-cases to judge performance and scalability. We'll try to provide some benchmarks in the next few weeks.

I hope this helps :D Have you used RedisGraph? Any thoughts?

</comment></comment><comment><USER22> Congrats :)! How does this compare to Neo4J and what would be some typical use cases?

<comment><USER3> Thank you! So, Memgraph is compatible with Cypher ([http://www.opencypher.org](http://www.opencypher.org)) query language and Bolt protocol ([https://boltprotocol.org](https://boltprotocol.org)) which means that existing tools and workloads will work. When it comes to the differences, because of our in-memory first approach, low-level implementation and optimizations Memgraph is more suitable for real-time analytical graph workloads. Please let me know if this makes sense or you would like to learn more about specific details. Out of curiosity, do you have an interesting real-time graph use-case?

<comment><USER23> This looks awesome! How much Cypher does Memgraph support? Also, what are the difference compared with Neo4j's Cypher?

<comment><USER3> Memgraph supports more than 80% of openCypher TCK scenarios ([https://github.com/opencypher/openCypher/tree/master/tck](https://github.com/opencypher/openCypher/tree/master/tck)). For more details about the actual differences, please take a look here [https://docs.memgraph.com/memgraph/reference- overview/differ...](https://docs.memgraph.com/memgraph/reference- overview/differences). The biggest difference is that Memgraph supports loading custom query modules implemented in almost any programming language and compiled into a dynamic library (.so file). Or, running query modules written as Python scripts.

</comment></comment></comment></comment><comment><USER24> This is awesome!</comment>