Actually pretty familiar, but thanks for your concern.

Sure thing.

Heh. Tons of security research is done without such contracts, because most good security researchers know quite well that companies won’t agree to such deals (or agree to them with all sorts of annoying caveats). Doesn’t mean you can’t still explore security holes.

Security through obscurity may seem like a good idea to you, but it just means that hackers have the info and the company does not.

Interesting attempt at a weak logical straw man, Mike. I was under the impression that the original point was about the legality, and not about my personal opinions on security. I put effort into the original post because, coincidentally, I’m in Information Security for a living. If you really want to talk security, I’d be glad to have an intelligent discussion on the topic. I’m guessing, from your weak attempt to spout a security101 keyword as if it made you sound informed, or that it somehow affected the law of the matter, that you don’t wish to have such a discussion.

Ignoring the fact that you wish to use plenty of very subjective, and unsubstantiated terms (“tons” of research, “good” researchers), and seem only focused on attempting to make it sound like you know what you’re talking about, and that Annonymous Coward here knows nothing, there is a very real problem with saying that it “[d]oesn’t mean you can’t still explore security holes.”

You see, the initial topic was law. And the law can essentially be boiled down to something to the effect of “if it’s not yours, don’t touch it”. “Good” security researchers do this, and in practice you’ll find that “tons” of security research is done in controlled environments by professionals who know they need to cover their asses or jeopardize their career. So, you can in fact explore security holes, but to imply that it’s legal to do so without permission, or that the “good” security researchers work undercover for nothing but fun, is an incredible claim. People with no knowledge in the field may be lead to believe you, which is what scares me most.

As they say, “don’t try this at home.” As the initial point was, it is in fact illegal.

More than that, actually.

Alright then.

I don’t consider a letter on legal stationary listing out all sorts of criminal things you may be charged with as “kindly worded.” I’m surprised you do, but perhaps we have different upbringings.

Yes, it is a legal letter. But the wording and personality of the letter are very professional, and worded as kindly as a legal letter can be worded. You might notice that the letter does not issue demands, it offers requests. The letter does not threaten, it states its legal position, why it feels this way, and where the recipient can look if they’re interested in self-assessing the claims given. The letter expresses the views of the company presenting it, but does not attempt to be the ultimate authority on the matter, and invites the recipient to challenge them if they feel so inclined.

The letter is indeed intended to get the user to remove the content. If that is what you find “nasty” about it, then I respectfully disagree with you. It is my opinion that the letter carries a very professional, mature, and polite nature to it, while still maintaining its ability to represent a legal matter. I know I certainly have seen much more rude and disrespectful letters, and I naturally assumed that you had too. If you find this “nasty”, then you’re entitled to that opinion. I feel this letter is not.

You have a funny definition of kindly.

As stated above, I feel this is certainly one of the more polite and professional letters one could hope to receive on a legal matter. Your mileage may vary.

The blogger in question did none of the above. Details. Details.

It is difficult for me to continue in a manor that is reasonably professional, without resorting to the same sort of sarcastic, insulting nature that you attempt to deal with my response. I fully understand you get your fair share of internet trolls, and may have grown cold to the genuine responses you may receive that disagree with you. However, at this point in your response, I have to reiterate my original point that you just do not seem to know what you’re talking about. I’m not sure if it’s because you really don’t understand law, even though it concerns 80% of your posts, or if it’s just a general quickness to publish articles that you don’t have the opportunity to understand the subject matter before typing. I just don’t know which it is. However, I hate how many people will read your BS and not know the truth, potentially coming to believe the same things you say because they read it on an internet blog. This is why I felt the need to post in the first place, and am wasting the beginning of my Thanksgiving vacation responding to someone who likely doesn’t care what I have to say. My hope is, however, someone else will be able to read it and think about the matter before blindly trusting the things you say.

You claim the blogger did not break the law. This is absolutely not true. Security people know it, the blogger knows it, Microsoft knows it, and if it were to go to court the Judge/Jury would know it. Mike, however, doesn’t. Hopefully your readers will know it too.

The article that you supposedly read very clearly describes how Mr. Meghani not only found the security flaws, but exploited them to result in $2080.06 in his Bing account, from at least 3 separate fake orders. Not only did he fraudulantly exploit this system for personal gain, he published this method for others to examine and exploit. It would be very difficult to convince someone that this was done “to help Microsoft and make them aware of the problem”. Those type of vulnerabilities are taken directly to the company, and often not known about until they’ve been fixed. You may call this “security through obscurity” all you want, it’s truly the only respectable and professional way to deal with such vulnerabilities.

I will again post the first section of the quoted law, so you can put this into context:
(c)(1) Knowingly accesses and without permission alters, damages,deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.

If you still do not see how Mr. Meghani knowingly, without permission, used any data, computer computer system, or network in order to devise or execute a scheme for fraid, or wrongfully controlled or obtained money or data, then I’m afraid it’s time to take your RSS off my page and never look back. I come here for something to do to take mini-breaks at work, but when you’re this far off base with a topic I know much better than you, then I’m afraid to read your opinions on things I know less about, for fear that you’re just as wrong and I won’t know it.

I don’t feel there’s a court in the world that wouldn’t find Mr. Meghani guilty of the violating the cited law. A law which, as I said earlier, is just one of *many* that they could pursue and win on. He very clearly exploited a system without permission to steal money. The fact is, his motives do not matter. Maybe he was trying to help. But he broke a very real, very serious set of laws, published it so others could more easily commit fraud, and then acted surprised that a lawyer got in touch with him.

And when you know how serious the law is, and how easily he could be prosecuted for the accused crimes, the letter seems much more polite than you seem to realize 😉

Either way, I’m done. Have a Happy Thanksgiving.