TexasCHLforum.com

RX8er wrote:

RottenApple wrote: I know for a fact that Apple takes user suggestions very, very seriously and....

My understanding is that every report made to Apple gets added to log and investigated. The tune of hundreds a month across multiple prodcut lines. I went to high school and am FB friends with Rich xxxxxx. He heads up a team of 50+ folks on a security team for Apple after leaving M$ five years ago. This is specifically what he does all day and every day. Also, they spend all day trolling forums and hacking sites looking for issues with their product.

He says that M$ and your other major software companies do the same thing.

Yup! I know the guy you're talking about. Well, I should say I know of him. He was involved in a round table for us Senior Advisors on what Apple does to locate & combat security related issues and how we (the Senior Advisors) were to handle customer calls reporting such problems. Basically we created a case and immediately escalated it to engineering, the product manager (the guy/gal responsible for everything having to do with the product, and corporate security (who, unless it involved Apple servers, like iCloud, pretty much left it alone). As SAs, we could keep track of the case and would get updates. Was really cool to see those guys solve some weird problems.

AndyC wrote:

RottenApple wrote:I disagree with your analogy. The "personal belongings" weren't on a "front lawn", they were inside a house (that didnt belong to him) whose door was unlocked. There is a huge difference between the two.

Let's tighten up the analogy. They were inside a house into which the public was invited and given explicit access to their own shelf in a closet.

He then, out of curiosity, found that other shelves were openly-accessible just by looking - that's poor design right there and the designers should take their lumps.

His mistake wasn't even in finding the flaw - it was in alerting others to that flaw.

But if he hadn't taken stuff off those other shelves, he wouldn't have been in trouble for it. As I said before, if he had alerted AT&T or Apple to the flaw, there most likely wouldn't have been an issue. I know for a fact that Apple takes user suggestions very, very seriously and that if this had been brought to their attention, they'd have investigated & notified AT&T of their server insecurity. I honestly don't think that finding the flaw was the crime. It was stealing other people's information, regardless of whether he used it or not.

baldeagle wrote:

poppo wrote:If someone breaks into your house and rifles thorough your personal belongings just to show they can do it, are you saying you would be happy about it and would not press charges just because they didn't actually take anything? Yeah right.

But if you put all your personal belongings on the front lawn, don't be surprised when people go through them. That's essentially what he did.

I disagree with your analogy. The "personal belongings" weren't on a "front lawn", they were inside a house (that didnt belong to him) whose door was unlocked. There is a huge difference between the two.

TexasGal wrote:Two words: Ankle Monitor

Why support this guy in prison for 41 months? He did a stupid thing. It was against the law. He deserves to be punished, but I'd rather his bunk at the prison had a rapist or murderer in it.

They are probably being so harsh it because of the issue that identity theft has become. But I do agree that 41 months seems awfully excessive.

dicion wrote:Actually, there is, legally.

If the window/door is open, it's criminal trespass.

If they open it, it's B&E.

Right. And both are illegal.

psijac wrote:I think there is a difference between Exploiting a security flaw and exploiting the fact that there is no security, Not even a password or encryption.

Lets put it this way, is there a difference between someone who breaks a window to get not your home and one who walks through a door you left open/unlocked? Technically, perhaps. But legally? No way. The system he exploited/broke into (or whatever euphamism you prefer) did not belong to him. Neither was the information he took. Therefore what he did was illegal.

handog wrote:Oh but thanks to the so called Patriot (shred the Constitution Act.) The Feds can hack into my email. listen in on my phone calls. The IRS has hacked Ito my bank account. Looted it. No problem there! He's right this country is toast.


Tyranny is defined as that which is legal for the government but illegal for the citizenry.

2 wrongs don't make a right (though 3 lefts do)....

n5wd wrote:The problem is that he did NOT break into anyone's computer - he used an ATT server set up to provide EXACTLY the information that he collected. He merely wrote a PHP script that harvested the information and saved it, instead of using it only for the Ipad's own use, as ATT intended. When you start your Ipad (if it's an ATT 3G-enabled Ipad) you're accessing the exact same server he did. The only difference is that you're only doing it once, and you're not saving someone else's information.

And that's where you are mistaken. He DID break into someone's computer.... AT&T's. If he had discovered the flaw and informed Apple/AT&T about it without gathering any data, THEN he wouldn't have broken any laws. But, as someone else already stated, he wouldn't have gotten any "fame" over it. Now he's reaping what he sowed.

BTW, a long, long time ago, when I was working as a programmer, my partners and I discovered a minor security flaw in RedHat 4.x (I forget exactly what version it was). We informed the RedHat community (since its open source) and then worked on a patch for it. Several other programmers confirmed it and also wrote patches. Ours was the most elegant fix and was incorporated into the next official build. We didn't call the media or anyone else about it and almost know one knew (outside the RH community) new about it at the time. And today I doubt anyone but us even remembers it!