But on the internet everyone's front door is accessible from even the most remote and hostile places in the world and you're pretty much on your own for securing it. Internet-facing systems also tend hold far more valuable things than your typical home.

For these reasons, I don't think the household lock analogy works very well.

---

I think you may be overestimating the effects of "the greater security picture" involving community, observant neighbors, other monitoring systems for the average community. For example, my first startup was RateMyStudentRental.com, and as I recall adding automated motion-activated sensors and lighting actually had a negative effect on break-in protection. As in, adding such a system actually increased your chances of having a break-in. According to the study, neighbors don't actually pay much attention to someone standing at a well-lit door (mileage varying based on the specific community obviously).

---

ORIGINAL EDIT: I won't comment on the technicality of the differences between the analogous situation and the actual situation at hand; the differences have nothing to do with the point being made. Don't get caught up in the analogy, because it's just an analogy.

In case it wasn't clear the first time around, the entire point of the analogy was that, breaking into and vandalizing someone's business just to show them that it can be done is generally a bad idea. Though I don't think anyone would argue it isn't effective.

Do you have a source for this? I've always been under the commonly held impression that this has a preventative effect, and it would be very interesting if the opposite really is true.

UPDATE: Hey, awesome, turns out we blogged about it back in the day: http://blog.ratemystudentrental.com/2008/03/05/a-safe-home-i...

Here is the original article: http://www.schneier.com/blog/archives/2007/09/light_and_crim...

Much so-called security lighting is designed with little thought for how eyes -- or criminals -- operate. Marcus Felson, a professor at the School of Criminal Justice at Rutgers University, has concluded that lighting is effective in preventing crime mainly if it enables people to notice criminal activity as it's taking place, and if it doesn't help criminals to see what they're doing. Bright, unshielded floodlights -- one of the most common types of outdoor security lighting in the country -- often fail on both counts, as do all-night lights installed on isolated structures or on parts of buildings that can't be observed by passersby (such as back doors). A burglar who is forced to use a flashlight, or whose movement triggers a security light controlled by an infrared motion sensor, is much more likely to be spotted than one whose presence is masked by the blinding glare of a poorly placed metal halide "wall pack." In the early seventies, the public-school system in San Antonio, Texas, began leaving many of its school buildings, parking lots, and other property dark at night and found that the no-lights policy not only reduced energy costs but also dramatically cut vandalism.

I remembered it incorrectly, as apparently motion-activated lighting helps, but on-all-night floodlighting makes the situation worse.

In short, sometimes darkness helps. Consider a tall glass office building. If all the lights are out, nothing stands out to a security guard more than a flashlight waving around in the darkness.

You have to assume every exploit will be abused. The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way.

I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.

I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.

Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something).

In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.

Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.

Maybe he did try to contact Github first, but I didn't see anything mentioning that in any of the linked posts.

Do you have something similar in the states?

But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.

Of course, it's unfair to blame all those costs on the guy who had to go as far as actually escalating his privileges in order to unmask the Rails developers for being such knuckleheads.

In the white hat scenario, the first part does not exist and the white hat does not actually do anything harmful. The second part still exists and can cost tons of money, but this part is not the fault of the person who found the problem.

So while the costs _after_ a benign "intrusion" like was done to Github can be substantial - both in money and reputation, the costs _because_ of it are much less, since most of the costs weren't caused by it, it only exposed the pre-existing need of bear those costs. Like a doctor diagnosing somebody with serious illness - he's not at fault that the person now has to spend tons of money on drugs and medical procedures.

For all we know, this bug has been abused for a long time to commit backdoors to other projects (perhaps those too big and active to notice).

I haven't looked at Egor's actions too closely, but he seems fairly close to a "white hat". He's been a bit immature, and so has Github, but there's been no real lasting damage.

Anyone who's written a web app knows that mistakes can happen, and they take time to fix. I'm sure Github will handle the PR crisis with an informative and unbiased mea culpa (even if they secretly think Egor was a bit brash). People will keep using them, because their interface rocks.

This will stay on the front page for about 24 hours, then there will be a few link bait articles that also cash in on it, but that's about it.

Admittedly he did then do the online equivalent of pissing on the wall, so minus several million points for artistic endeavor.

I don't think I'm going to take this analogy any further though; things get dangerous when you base an argument entirely on analogy.

From the legal-dictionary [1]:

breaking and entering v., n. entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary. If there is no such intent, the breaking and entering alone is probably at least illegal trespass, which is a misdemeanor crime.

[1] http://legal-dictionary.thefreedictionary.com/breaking+and+e...