should hackers jailed?

[jcmcb]

8B@ll -

I agree that to you and I (and those others who are computer literate) that does not make sense....but we wouldn't need someone to explore our system or we would ask for help. To those whoses system needs major help, it might seem as if the following occured:

1. System Fine
2. Hacker vists
3. System has holes
------------------
4. Hacker broke system.

Know we both know that 1 is a faulty assumption, but one that is going to be made... SO IMHO its better to stay away from examing other peoples websites without permission...cause you going to end up on the wrong end of the court room one way or another....

[jared_c]

if your intent was not malicious a smart person wouldn't have gone inside they would have picked up a pay phone and called 911 and let them handle it. It's the same with Systems if no one authorized you to enter you don't go in period.

1. System Fine
2. Hacker vists
3. System has holes
------------------
4. Hacker broke system.

The above statements are catch 22's. In order to see if a system has a security flaw, 99% of the time the only way to know is if you have already violated the system. For example, in order to know directory listing is enabled you must be at that directory already. So you just accessed a directory listing that you weren't supposed to see. Noticing a security flaw, and breaking into the system are both in the same step. The majority of the time, one comes with the other without an option. So since you just violated the system you obviously aren't going to go call 911 on yourself. And if you report it to the webmaster, you are openly admitting that you accessed their system. Even though you didn't do any damage, and no harm was meant, you just trespassed. Should you go to jail.

Now since everyone seems to love the break into a house comparison, which I constantly say is NOT the same, here is another comparison for you. Let's say you are going for a walk in the woods. You enter the woods in a public area, but there is a section of the woods that is private property. You are just going for a stroll, and you happen to enter the private property without knowing it was private property because the owners stupidity of not having a fence securing the area. You are minding your own business then you see a sign that says "No Trespassing". You realize you are on private property. You just broke the law. Did you mean to? No. Did you hurt someone? No. Now the question is do you bring the fact that there is an open area leading to private property to the owner or not. If you do you are openly admitting you are trespassing. More importantly, should you now be jailed for trespassing?

Get what I am saying? You shouldn't go run around purposely trying to break into people's system without permission, but you shouldn't be jailed for stumbling across a security flaw.

[jcmcb]

jared_c -

I would agree with that statement, with the cavaet that you don't make this flaw public. As much as our jobs are easier with full access to vul. info., it makes it very hard on the person with the flaw, and will def. cost them money. If all you tell is that person, then fine, no harm no foul....