• Jon Haugsand (unregistered) in reply to Forumtroll
    Forumtroll:
    Dave:
    realmerlyn:
    But just because it can't be said enough times... it's not PERL, it's Perl.

    Duh. Obviously it's PERL. Practical Export and Retrieval Language, abbreviated to P.E.R.L. or PERL for convenience. Duh.

    Wrong answer. The correct answer would be "Pathologically Eclectic Rubbish Lister".

    I always thought it was Pwrite Eonce, Read, Lnever.

  • Wonko (unregistered) in reply to Cbuttius
    Cbuttius:
    The real WTF is that you can't just host websites on your own machines and need to use hosting companies.

    Really? Because I'd argue that its easier to outsource all of that than to host (and support it in house).

    Think about it, Server Hardware is Expensive, Becomes Obsolete, needs Loads of power/security/cooling.

    using a web host you get to lease your hardware so when its old you simply upgrade your package, power/Security/cooling/backups/support all covered in the monthly cost.

    Im surprised there are as many small companies hosting their own sites as there are (Obviously some companies have reasons for doing it, but unless your are in the business of hosting sites already, for a corporate web site - why have the hastle?)

  • asdf (unregistered) in reply to jay

    Yes, he did vandalize the site as the story is told here. He uploaded content that the owner of the server specifically disallowed and changed the publicly available site. While it may not have been malicious, it's closer to hotwiring the car because you wanted to leave before they gave you the key.

  • Neil (unregistered) in reply to Calli Arcale
    Calli Arcale:
    Kevin:
    This is like when a burglar sues homeowners because they get hurt breaking through a window.
    It's like breaking into the company that provides your security system, finding their proprietary design drawings, noticing an error, proving the error by exploiting it to break into another part of their facility, telling them all of this, and then getting surprised when that comes back to bite you.
    The impression I got was that it was like using the entryphone to call security and issue you a pass, because they failed to notice that the entryphone is equivalent to an outside line.
  • G (unregistered) in reply to Decius

    At the risk of posting a serious comment, this is exactly what Rich was being encouraged to do if the precedent is being set that he be fired for privately testing the vendor's security for them.

    It's unacceptable that Rich should be fired because the vendor company is run by incompetent morons.

  • A Gould (unregistered) in reply to L.P.O.
    L.P.O.:
    Kasper:
    It would be a better outcome if Rich got hired by the customer. But that could easily lead to other lawsuits as both the employment contract as well as the contract between the two companies may forbid that.

    In the country I live in those kinds of limitations would be illegal and thus null and void if Rich was fired by the company. Also, even if he parted with the company by his own free will, any limitations as to his new employer would be illegal unless he is compensated for that (for a one-year limitation he'd have to be paid a one year wage when quitting).

    Of course, this still comes down to "how much justice can you afford?". Rich might have a great chance at winning a lawsuit, but he would still need to fight (and spend) to get that settlement. In contrast, the company will just send their in-house lawyers out to drag proceedings as long as possible.

    Add the fact that Rich is unemployed at the end of the story, and it's very unlikely he has the wherewithal to go to war against his previous company.

  • (cs) in reply to PiisAWheeL
    PiisAWheeL:
    Zylon:
    Given that certain editors are known to enhance these supposedly true stories for dramatic effect, I'd love to hear from the original submitter on whether he was actually fired.
    Yes, he was fired. They had 2 options: A: Deal with a long costly legal battle and not fire Rich. B: Push Rich in front of the bus. Which one did you think they would pick?

    C: Get Rich to change his name. (Maybe to Modest?)

  • jay (unregistered) in reply to Johnny Come lately
    Johnny Come lately:
    jay:
    hoohoo:
    Except he didn't do any damage or act with any intent to harm or unfairly profit.

    The law is more fair than you think. A good lawyer could show he acted in good faith.

    IANAL, but I would think the hosting company would have a tough case. Rich was authorized to use the system. He had a contract to write code to be deployed on the system. This implies a right, indeed a responsibility, to test that code. In the course of testing, he found a security flaw, which he promptly reported.

    Imagine a non-IT analogy: You hire a plumber to perform upgrades on your house. He makes several visits, and each time you let him in so he can do his work. One day he arrives to find the door ajar. He opens the door, sticks his head in, and calls, "Hello, anybody home?" When there is no reply, he steps in and looks around to see if perhaps you are injured and unable to speak. When he finds no one, he leaves and calls your cell phone to explain what happenned.

    Could he be charged with breaking and entering or burglary? I doubt it, and if he was, I doubt he'd be convicted.

    Sure, laws can be pretty stupid, and legislators, lawyers, and judges can get very confused by new technology. But Rich's position seems pretty safe to me.

    AS amny others have said, it's not about being directly liable, it's about the perception that (costly - time and money wise) legal proceedings may be imminent against the company. It's easier to get rid of the problem....

    Oh, I don't dispute that under the circumstances a company might fire someone to avoid litigation. "We should in all justice win this case" != "We will win this case" != "The cost of settling < the cost of going to court".

  • (cs) in reply to asdf
    asdf:
    Yes, he did vandalize the site as the story is told here. He uploaded content that the owner of the server specifically disallowed

    And that's the real WTF: A web hosting company that disallows uploading Javascript![B]

    That is at least a "surprising limitation" (to call it in modest language) and it is certainly not Rich's job to deal with it when they came up with that lame excuse. Just call up his Boss "Hey, they won't let upload us Javascript! Is that really in their contract? If yes, fire the person who signed that rdiculuous contract! If no, just threaten legal action on [b]them for not fulfilling their contract!".

    A webhosting company that claims you cannot upload Javascript on the webspace you fucking pay them money for? Are you serious?

  • Mr.Bob (unregistered) in reply to the beholder
    the beholder:
    If I were Rich I would contact <someone important> in the customer and tell the whole story, adding at the end: "I was the only guy in this whole project that took your company's interest at heart, yet I was the only one who has been screwed at my former employee. You can put pressure on them to get the idiot who decided to fire me fired and force them to hire me back. I could be a valuable ally to you from inside."

    It might result in nothing, but he won't lose anything for trying.

    No, after parting ways like that, Rich would be a sucker to want to work there again. Even worse would be for word to get around to his former employer, the customer, and hosting company that he was trying to blackmail his way back in. (No, I don't think "blackmail" is the right word, but it could be perceived that way.)

    But, Rich was also a sucker for lining up to be the patsy this way. Strike #1 was hiding the hosting company's reluctance to work with them from the customer. Strike #2 was exploiting the security hole he found. Strike #3 was having nothing in writing when the shit hit the fan.

  • Moshes (unregistered) in reply to Kevin

    It seems that you are new to our world. Rich found an easy & efficient way to do his job & avoid conflict. Instead of using it and keep his employer, the client & the adversary (hosting company)happy and\or pacified he chose to poke a stick in the eye of one company, involving his employer in a legal and changing the future from a safe peaceful place to a chaos of probabilities, setting in motion big changes that he WAS NOT GETTING PAID TO MAKE BIG CHANGES. Rich is an asshole.

  • Kasper (unregistered) in reply to A Gould
    A Gould:
    Add the fact that Rich is unemployed at the end of the story, and it's very unlikely he has the wherewithal to go to war against his previous company.
    That's a situation where a labour union may help. I have previously worked in a company where there were anticompetitive clauses, etc. I was supposed to receive a compensation for that along with my last paycheck. Not nearly as much money as what L.P.O. was talking about, but still a decent amount.

    I did not receive the money along with my last paycheck. I wasn't in an urgent need of money, so I waited to see if I was going to get the money the next month, assuming that they might process it as just another paycheck.

    I still didn't receive the money, so I contacted them. They said they didn't have to pay the money to me. So I contacted my labor union. The labor union send a letter to the employer. I don't know the exact wording of that letter, but it only took a couple of days from when the letter was sent before I received my money.

  • Mick (unregistered) in reply to Tony
    Tony:
    Yep, Texas is a small town in south west Queensland.
    I guess it shouldn't havce surprised me that QLD would have a Texas....I just sort of expected them to have a Tokyo first....
  • Spewin Coffee (unregistered)

    Oh that was so...

    Wait for it...

    Rich!

    [You can groan now]

  • Luiz Felipe (unregistered) in reply to Some Jerk
    Some Jerk:
    If only Rich had worked for Microsoft so he could have instead been deleted like the peons in the AOE games.
    +1 for killing the useless peon. i hate other RTS games that you cant kill own units as easily as AOE.
  • Luiz Felipe (unregistered) in reply to no laughing matter
    no laughing matter:
    asdf:
    Yes, he did vandalize the site as the story is told here. He uploaded content that the owner of the server specifically disallowed

    And that's the real WTF: A web hosting company that disallows uploading Javascript![B]

    That is at least a "surprising limitation" (to call it in modest language) and it is certainly not Rich's job to deal with it when they came up with that lame excuse. Just call up his Boss "Hey, they won't let upload us Javascript! Is that really in their contract? If yes, fire the person who signed that rdiculuous contract! If no, just threaten legal action on [b]them for not fulfilling their contract!".

    A webhosting company that claims you cannot upload Javascript on the webspace you fucking pay them money for? Are you serious?

    If i was in this situation, i take my javascript (.js), renamed it to text (.txt) and put in a url routing & translation module. problem solved.

  • d (unregistered) in reply to bye
    bye:
    hoohoo:
    The law is more fair than you think.
    Which extraterrestrial planet (or alternate universe) do you inhabit, and how do I get there?

    Let me guess, you have to hack the galactic server.

    Can I come too? Sounds like a wonderful place!

  • (cs)

    Has anybody yet commented on the real WTF here?

    That the vendor, i.e. the hosting company, was supposed to specialise in security and yet you could run scripts on their machine simply by uploading them as images?

  • Engelbart (unregistered) in reply to Accalia.de.Elementia
    Accalia.de.Elementia:
    OK. Hands up those of you that couldn't see that coming.

    what? no-one? huh...

    I thought the answer was going to be that they host everything on their own server and just drop a redirect page on the old providers server. www.initrode.com just becomes a redirect to www.initrode-inc.com.
  • random lurker (unregistered) in reply to Engelbart

    How would this have played out if Rich had gotten initrode to sign on for a security audit of their site? Certainly he couldn't be legally culpable?

  • jmacpherson (unregistered)

    TRWTF is that firing Rich satisfied the hosting company. How does firing Rich make them whole? If I were suing another company and they fired someone, I'd take that as an admission of guilt and just sue harder.

  • pants (unregistered)

    Okay, I don't know if anybody noticed this, but PERL isn't the right form. It's perl for the interpreter, Perl for the language, and pErl on Apple machines.

  • Anonymous Coward (unregistered) in reply to Philip Newton

    It’s Perl, not PERL, despite the existens of backronymic expansions.

    The real scripting name was changed to protect the guilty.

    captcha: saepius - frequentious.

  • Essex Kitten (unregistered)

    Oy! Sue 'em back for misrepresenting their security standing!

  • The geek (unregistered) in reply to Audi Tor
    Audi Tor:
    Yeah, sorry, you can only perform "security tests" on your own stuff unless you have written permission, also known as a get-out-of-jail-free card.

    Rich's motives don't matter in a world of lawyers and politicians who don't understand the technologies they try to control. He had to be fired. Any employer with a clue would be forced to reach the same conclusion.

    news flash, if you have bought and paid for hosting the majority of places are renting you hardware...which means running scripts on said hardware is against no laws.

  • ccj (unregistered) in reply to Raedwald

    How is it criminal to expose stupidity? If they left a 'back' door (really a front door in this case, with neon arrows pointing inside) open, then they have (effectively) given consent for anyone to execute code on their servers. Every (good) web developer should also be a pen tester, and Rich didn't even destroy the fools' system; he was not only doing his job right, but also doing it like a hero! Further, neither business nor security interests should ever, ever stand in the way of development and innovation. 4-6 weeks to audit a simple revision for security?! Now that's criminal.

  • tbo (unregistered)

    He was allowed to upload a javascript. The server let him do it. He was allowed to run scripts on the server. The server let him do it. He didn't have to change anything already on the server.

    How did he make it through the conference call without saying "I put it on the server using the tools you gave me"?

Leave a comment on “Healthy Competition”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article