You can comfortably make a determination about what is right and wrong. We don't know the facts, but if the claims are true, wiping out not just that company's property, but that of their customers, is a crime.
Now, sometimes a crime is justified, but I don't think it is a rush to judgement to work from a starting point that criminal behaviour is bad until proven otherwise.
Why did this happen? How can we prevent it from happening in the future? These are the questions we need to stress.
In particular, why does an ex-employee still have access to production? I say when something like this happens and heads must roll, they must roll at the top. Fire the CEO. Fire the board. Leave the sysadmin alone.
This is a civil matter. My tax dollars should not pay for a criminal lawsuit. Screw that.
Oh and by the way if you're reading this: please help repeal cfaa.
Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear.
Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.
We should not equivocate on cfaa. It is good for nothing. Full and unconditional repeal should be our only demand.
Nope. The affected customers probably have grounds for a civil suit, but no sane prosecutor would think bringing criminal proceedings against Verelox to make sense at all.
The ex-employee who perpetrated this is at fault as well and must bear responsibility for his destructive actions. Having the ability to do something (even due to a lapse in security) does not make that action moral or legal.
We may remain open to additional information without presuming that uncivil and illegal vandalism was justified indeed without inventing a narrative from whole cloth as you have done. The logical conclusion is that drawing from your own life experience you identify so strongly with the narrative of the wronged sysadmin that you desire to fit a narrative to sparse facts that has no basis in fact.
We are merely commenting on a story on hacker news. We aren't members of the jury and don't face the same burden or power. I'm down with repealing the cfaa because its badly written, I'm down with figuring out who dropped the ball as far as giving the sysadmin access post firing, but as to the sysadmin himself, burn the witch!
IIRC, the Soviet Union had a policy rather like this, referred to as something like the Vertical Stroke, where anytime there was a screw-up at a low level, they would fire the screw-up-ee's manager, and manager's manager, and so on, up to a very high level. The practical result was a drastic decrease in innovation and risk-taking. CEOs and others at that level usually aren't close enough to the guys actually doing direct work to supervise them all closely enough to ensure they don't make mistakes. All they can do is create a culture where there's a book of rules, and you don't deviate from the rules ever, for any reason, no matter what. So that's what they do, and that's the resulting culture and economy that you get.
Maybe we shouldn't rush to judge either sysadmins or CEOs, but instead figure out who, if anyone, actually did something malicious, and let everyone else take the lessons they've already learned from what happened.
They can't have it both ways.
If he did it (intentionally wiping the servers), then he is a criminal and a bad person.
If he is a scapegoat, then he didn't do it, so that's a totally different situation.
I don't see how you can disagree with either of these statements.
And discussion of how he still had access is an unrelated matter.
Maybe he became an ex-employee after (and as a result of) wiping production.
I've heard stories where employees wiped production by accident and promptly became ex-employees, followed by their ex-employer trying to put all blame on them. We don't have enough information at this time to determine whether this is what happened at Verelox.
So if an aggrieved ex employee does enough damage that the company has insufficient resources to sue, or has enough resources themselves to make that difficult, it's all good?
Individuals and companies should not be vulnerable to attacks like this based on their resources. It's in all our interests to ensure this sort if activity is dealt with severely because we are all vulnerable. Mutual defence in the form of criminal prosecution of offenders is the way they go IMHO.
Let's be practical. What is our end goal? Is it vengeance or is it prevention? If it is the latter, our actions must not be centered on retribution but rather on logic and reasoning. We should ask what can we do to prevent this from happening again? Throwing someone in prison is not the answer IMO.
http://www.telegraph.co.uk/news/uknews/crime/12090890/Reveal...
What do you expect me to do? Investigate the matter myself? Buy myself an unlicensed firearm and look for the hacker to get it back at gunpoint?
That the actions described in the claims are criminal is not in doubt. Whether those actions actually took place is unproven, as is whether this unnamed ex-administrator performed those actions.
So, I'm not ready to say that this person is a criminal, or that a crime was committed, but I am ready to say that the actions described in the claim are criminal and wrong.
Finally, all of that is applicable to the courts & government determining criminal acts. The courts don't determine what is moral or ethical. Lots of things are wrong that aren't criminal. Saying something particular behaviour wrong really doesn't have anything to do "innocent until proven guilty".
Saying that, "if someone did what the story said they did, it's wrong" is really not saying anyone is guilty of anything.
How many little shops rely on Verelox - aren't they little guys?
How many end customers depend on services that depend on Verelox - you know someone like you - aren't they the little guys?
The police/prosecuting agency in the country where the company is based I imagine. That appears to be Holland [1]
[1] https://www.ripe.net/membership/indices/data/us.verelox.html
The fact that it was an ex-administrator does suggest foul play as opposed to a mistake compounded with poor backup processes. We shall have to see how the story pans out.
Sigh. I can't believe we're going there on this one. Just so we're clear, you think that maybe the definition of criminal behaviour shouldn't include wiping out systems without the owner's consent?
> And why is criminal behaviour always placed on the little guy when companies can always get the leeway of claiming ignorance?
I don't know what you are talking about. Criminal behaviour is placed on the criminal... and ignorance of the law is not a defense.
We do.
I wish HNers would get their heads out of their tech arses and face the reality. Most people do _not_ have a choice where they work. Most people cannot afford to quit. Most people don't have jobs where they can increase their skillsets. Most people do not have time to read HN while they enjoy their 10 AM pause in their comfy sofa while working from home. You are, for the most part, amongst the most privileged people in the world. Yet you continue to spew the "employment is voluntary" propanganda because you never had to face actual hardships. Worse, you push people of lower classes even further in the ground, when what you should be doing is elevating them to make a better and fairer society.
Urbanization fundamentally has been engineered to create "wage slaves", who are basically modern sharecroppers (though the system has some extra steps).
Suppose someone was born out in the forest, and there were no cities, no societies, no technology. Would you call that person a sustenance slave? Would you say that their foraging was involuntary?
> Suppose someone was born out in the forest, and there were no cities, no societies, no technology. Would you call that person a sustenance slave? Would you say that their foraging was involuntary?
No, they are not a slave because they have no master except nature.
A wage slave has at least one master: his boss and the system that forces him to work for one.
The difference lies in the fundamental difference between natural law and synthetic human systems. Entropy isn't your master, it's a fact of your own existence.
By contrast, the present economic system is a synthetic construct made by other humans to exploit you, designed with largely that purpose, co-opting your biological needs for coercive power, and doesn't necessarily need to happen.
That's what makes one slavery and the other not.
The difference is so obvious, I actually am confused why you think conflating physics with political norms was appropriate.
Most of society (and the wage slave concept) is about human farming.
would you say you are a farmer or livestock?
That's right, and it's a shame it's been downvoted.
Being employed at a particular organization is, in fact, voluntary. You are not obligated to stay at one employer forever.
Don't say "no one".
Productivity keeps rising. It becomes possible to support non-workers with a smaller and smaller fraction of that. And thorough safety nets help non-lazy people too. They even help people create their own businesses!
I do my job because I love it. I do my job for you because you pay me more than the next guy.
I enter into employment agreements knowing full well that it's a business transaction. The business and I have agreed to an amount of money (and other benefits) in exchange for my labor.
It's not about the American dream. It's not about "slave labor". It's about you give me money for services I provide. When either of us decides that deal isn't advantageous for us anymore, then we end that agreement.
Stop being edgy.
I think most of HN is in the "baronet" class (say, 2-3x of median income) or higher, and doesn't necessarily have a good perspective on what most people (ie, those at or below median income) deal with.
Per capita income has flatlined for a decade (since 2008), after 60 years of steady growth. But that largely doesn't impact programmers, entrepreneurs, etc. Instead, it impacts the people on the bottom.
Just because the present system works for you doesn't mean it works for everyone.
It was always good to be king.
So, overall, it looks more like a form of economic slavery than some cooperative, voluntary, win-win system. A good hint is that most of the wealth has moved into few hands who usually didn't work their way up into it from the bottom like the people producing it. The people producing it didn't want that arrangement either. They have no control, though, since the elites outspend all of them combined on politicians passing these laws, media shaping perspectives, and public education limiting their intellectual growth while simultaneously reinforcing submission to authority (esp arbitrary requirements) daily for 12+ years. Most of America is born into a new form of slavery that few ever escape.
"[the illusion of]"Democracy", "Organized religions", "history of our society", esp. the last 300 years or so", 3 of the most profitable lies in todays day and age. Its wrong to say that this "happens to be happening because A, B .. Z", this is "works-as-designed". A world viewed from the top has no nations, only powerful blood-lines, it has not morals only self interest, it has no humanity only contempt of the "human animals" they have inherited and extended control over. It's them, a new species, and us, the soon-to-be transformed, stripped of everything that could challenge them, rest of the world.
I suspect that, for many, if not most of us, the loss of the ability to earn income would be an unspeakably grave event. This puts to the lie that we have any real choice about employment, assuming we are one of the vast majority of people who is not financially independent.
Incorrect. Throughout history there has been many societies where people would legally sell themselves into slavery (e.g. to pay a debt, under threat of being imprisoned) and even receive a meager salary.
Yet it's still slavery; you can look up the definition in a dictionary.
No one has the perfect job, everyone thinks they should make more, have more benefits, more freedom. But everyone has choices. You don't have to participate in the rat race, you can stop letting material possessions drive your lifestyle decisions.
The choices that are available, however, have an extreme variance from person to person. At the extremely shitty end, Viktor Frankl, while a captive of a Nazi death camp, worked out that when all other choices are taken from a person, the only remaining one is to die with dignity.
But it's a choice, right?
At the other end of the spectrum, choices may include where to vacation this winter or if the maid should be fired.
The bottom line is that the quality and quantity of choices vary so much, depending on luck and pluck, that it's a bit glib to say "everyone has choices", including, I guess, the choice between working a crappy, abusive, mean job or two to make ends meet, or starve.
I don't think everyone has the luxury to philosophize about giving up material possessions and exiting the rat race, either. A lot of people are living from paycheck to paycheck (or worse), have dependents, and don't have the prospects to find a new job. Those people can't afford to say "no" to their boss' unreasonable demands.
I said you didn't have to participate in the rat race.
For most of human history, choosing not to work for 3 months meant starvation and death. Hunter-gatherers had to work.
My brother is 50 years old and has delivered pizzas for about the last 20 years. He only works enough to afford to rent a room, own a car, and pay for an annual ski pass, and skiing/volleyball gear. He spends his free time on the mountain and the lake.
He obviously doesn't own many material possessions and his retirement isn't going to be pretty. But that choice was his, he had opportunities to work corporate and make far more money, own more stuff, and maybe raise a family, but he chose to have more freedom and the lifestyle he preferred.
It's called collateral damage. There is no context, outside of fantasy, where the admin could be in the right to do this.
If you treat people bad, they'll treat you bad. If you nuke Russia, Russia will nuke you. It's the Nash Equillibrium where each party is faced with a game and certain situations call for your best move. But your best move should account for what I'll do, and that should be factored into your initial move.
Mutually assured destruction is actually a powerful deterrent. Do we know what the ex-admin's situation was prior to all this? Only then should we pass judgement.
You are basically justifying the 'killing of innocents' here..
The collateral damage would low to non-existent for the users depending on how critical the service was. The direct damage would be to the employer. If the employer was the bad guy (hypothetically), would you still state there's no context or any situation whatsoever where the employee should cause them damage?
If their employer was a James Bond level super-villain about to shortly kill millions you could construct this scenario.
Otherwise there is no scenario where inflicting what you term a "brief disruption" (but what they'd likely describe as an awful, painful and expensive) to thousands of innocent customers is justified. Customer costs could easily be millions, if 1,000 customers each spend over ten hours of worker time dealing with that disruption.
If the employer did something illegal, report them to the authorities. If they wronged you, other employees, or customers, take them to court and publicize their malfeasance.
If you can't do any of those things because what the company did wasn't wrong or illegal, and instead wipe their servers, you are a sad little loser who can't handle the fact that they just didn't like you, and for good reason.
The ex-admin in question probably understood the impending customer harm. But the customers are the veins of a company- without them, they're not a company at all. The ex-admin just played dirty- something that he thought was the only way to win a lopsided battle against a force much greater than he.
In David V Goliath, Goliath was taken down... with a slingshot. A weapon. And he's celebrated as someone over coming a stacked challenge. The customers were the ex-admins slingshot. The difference is that the law doesn't allow this behavior
That same logic would make it unjustified for them to be using such a small, unproven service to begin with. I mean, the first thing I do for mission-critical stuff is to see if the hardware, software, or service has supported long periods of uptime with easy maintenance and security patches. Also, has anything really bad like preventable breaches happened? And how are the servers configured by default?
Further, if you're worried about downtime so much, you have two providers in a setup with replication plus failover. The only people responsible for service going down and data destroyed completely in a world where basic HA is cheap are the customers. They should assume some shit could happen. They should mitigate it if it matters. Those that didn't took the risk willingly. Backups in particular are also really cheap these days.
"If the employer did something illegal, report them to the authorities. "
People have reported all kinds of big companies to the authorities for breaking the law. Goldman Sachs nearly destroyed the financial system. They got criminal immunity + $1 trillion from the government whose Treasury was run by their ex-CEO who profited off that activity. They and most of the rest like them still in business mostly without anyone doing time on the top. What's your next move for punishment if law doesn't care or is receiving bribes (esp Congress)?
"If you can't do any of those things because what the company did wasn't wrong or illegal"
Wrong and illegal are two different things. Slavery was legal but wrong. Locking child workers in buildings that might catch fire to force overtime was horribly wrong but legal. Civil forfeiture... taking an innocent person's money or property w/out charges... is wrong but legal. All kinds of abuse of employees, esp regarding promotions or references, is harmful to all but people on top and legal.
You're clear that no illegal action should be taken in response to a wrong. I'm guessing you oppose the underground railroads that freed slaves since they were illegal. You would have griped about it at best while all the harm continued to those people if working within the legal framework.
To us, it's not justifiable. Hell, the ex-admin may think so too. But that doesn't mean we should automatically side with the employer and subsequently crucify the ex-admin. We don't have any information yet.
Not free speech: punching your boss in the face, burning the building down, vandalizing the office, deleting all the data on the servers and hurting a bunch of people that had nothing to do with your conflict with management
I'm all about workers right and have walked out on many a job because management were raging assholes. I have convictions and I stand by them but conviction and doing the right thing in life often come with sacrifices. I'm currently underemployed because of my convictions but I can sleep at night knowing I'm doing the right thing. The way for us to take back power in the tech industry is to organize, unionize and refuse to work for abusive and exploitative employers. We're the ones with the skills. They need us not vise versa.
I don't know you.
But what I have learned that people who do not care about other peoples property, care very much about their own. Destroy other people business? Go for it! Destroy my car which I could kill someone with? No way, it's mine, I've worked hard for it. Vandalize houses of rich people? Go for it! Steal my iPhone? Hey, where is the police when you need them?
In Berlin people cheer the burning of other peoples BMWs - yes this is a thing. The same people go to court when the police scratches their table tennis table during a raid.
There is nothing to imply human rights have been violated. If such information is presented im sure people will respond in kind.
> There is nothing to imply human rights have been violated. If such information is presented im sure people will respond in kind.
What are you talking about? There is no "article," only the statement of one involved party. It's right to be skeptical and theorize about what else might have gone on that was omitted from that statement out of self-interest.
The most prominent example of this in recent memory is Peter Thiel sponsoring Hulk Hogan's lawsuit against Gawker. Do you approve of what he did?
Corporations function as de facto titles of nobility in the US, so crossing one is crossing social rank.
I think that's very on point. While HN is a technology site, it's also one for "founders" * who aspire join the elite of that social order, which explains the exaggerated empathy for the interests of shareholders and companies.
* (and those with fantasies of being one)
Lol. Citation please.
I'd like to see the justification for forcing thousands of customers into expensive disaster recovery because the company fired a sysadmin, likely for good reason.
Mario Savio was a Free Speach Activist and organized a protest to protect the Freedom of Speech at Berkeley around the 60s. In his speech to protestors, he says "there's a time when the operation of the machine becomes so odious... that you can't take part... and you've got to indicate to the people in charge that unless you're free, the machine will be prevented from running at all!" Applied to free speech, this notion of disrupting the functioning of an organization was lauded, because freedom of speech is just that important.
But let's shift to employment. Without employment, it's very hard to survive. And here's a situation where the people in charge has the upper hand in every arena- hiring, pay, work Place behavior... etc. How do we know that the ex-admin wasn't blackmailed by the CEO to come back to work for free to fix something, or future references will be negative? Why are we so quick to side with the employer in this matter when we know nothing of the situation at all? Why do we start calling the employee a felon? He hasn't even been charged yet.
My point is, context is important. Fine, corporations have the power to ruin your life as a deterrent to keep you from acting against their interests, and that's just the way society is. And fine, We're not all rational at every instance of life. The calculus of establishing status quo equilibrium of those two conditions/constraints is hard, but without context to the situation, who are we to decide who's right or wrong? Would you label Mario Savio wrong for protesting and urging protestors to prevent the operation of the college from functioning in the name of preserving Free speech wrong? No, because you've learned the context.