<story><title>How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)</title><url>http://blog.phpfog.com/2011/03/22/how-we-got-owned-by-a-few-teenagers-and-why-it-will-never-happen-again/</url></story><parent_chain><item><author>parfe</author><text>&lt;i&gt;Maybe then they&apos;ll stop with the half-assed apologies and recognize that there&apos;s a right way and a wrong way to do things.&lt;/i&gt;&lt;p&gt;PHPFog built a castle out of sand and you&apos;re upset that a wave came and demolished it.  I&apos;m always surprised at how thin-skinned a lot of HN commentary is.  &quot;Oh, Zed shouldn&apos;t be so rude&quot; &quot;These kids&apos; lives should be destroyed for playing games with an wholly insecure website.&quot;  &quot;I stopped reading that article because it used the word blowjob.&quot;&lt;p&gt;I don&apos;t get angry at my dog when he shits in the house.  Being angry at something that can&apos;t understand only satisfies the urge to shift blame.&lt;p&gt;My dog shits in the house and it&apos;s my fault for not walking him sooner.  If some children compromise every level of your company then getting mad at them is only trying to deflect the blame.  PHPFog is the only responsible party in this mess.  I feel for the customers who still trust them.</text></item><item><author>dolinsky</author><text>What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist.&lt;p&gt;Maybe then they&apos;ll stop with the half-assed apologies and recognize that there&apos;s a right way and a wrong way to do things.</text></item><item><author>sriramk</author><text>I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning.&lt;p&gt;I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up phpfogsucks.com, it &lt;i&gt;might&lt;/i&gt; have been ok. But tweeting trash from their twitter account, redirecting their root domain to phpfogsucks, etc - are all not cool at all and should have &lt;i&gt;some&lt;/i&gt; consequences.</text></item></parent_chain><comment><author>lambda</author><text>This isn&apos;t a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn&apos;t then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works.&lt;p&gt;This is like someone finding an unlocked door to the apartment building&apos;s maintenance office, taking the master keys from there, rifling through a bunch of people&apos;s personal belongings, sticking signs in the windows saying &quot;this building&apos;s landlords suck,&quot; and changing the locks on some of the doors to make it hard to clean up the whole mess.&lt;p&gt;They absolutely are the responsible party; you should never blame the victim of a crime just because the victim didn&apos;t take adequate steps to defend themselves. If I accidentally leave my door unlocked one day, that does not make it suddenly OK to come in and take my stuff and it&apos;s my fault for not having locked my door, instead of yours for taking my stuff.&lt;p&gt;Now, in this case PHPFog does bear some responsibility, because they have a duty to protect their customers as well as possible, and from reading about how this happened, it sounds like they were amazingly sloppy and irresponsible about it (passwords stored in the clear on the server, passwords shared between various accounts, leaving unsecured shared systems running after beta launch, etc). But that doesn&apos;t reduce the culpability of the attackers; they acted maliciously, with full knowledge of what they were doing, vandalized systems, changed passwords, and bragged about it.</text></comment>
<story><title>How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)</title><url>http://blog.phpfog.com/2011/03/22/how-we-got-owned-by-a-few-teenagers-and-why-it-will-never-happen-again/</url></story><parent_chain><item><author>parfe</author><text>&lt;i&gt;Maybe then they&apos;ll stop with the half-assed apologies and recognize that there&apos;s a right way and a wrong way to do things.&lt;/i&gt;&lt;p&gt;PHPFog built a castle out of sand and you&apos;re upset that a wave came and demolished it.  I&apos;m always surprised at how thin-skinned a lot of HN commentary is.  &quot;Oh, Zed shouldn&apos;t be so rude&quot; &quot;These kids&apos; lives should be destroyed for playing games with an wholly insecure website.&quot;  &quot;I stopped reading that article because it used the word blowjob.&quot;&lt;p&gt;I don&apos;t get angry at my dog when he shits in the house.  Being angry at something that can&apos;t understand only satisfies the urge to shift blame.&lt;p&gt;My dog shits in the house and it&apos;s my fault for not walking him sooner.  If some children compromise every level of your company then getting mad at them is only trying to deflect the blame.  PHPFog is the only responsible party in this mess.  I feel for the customers who still trust them.</text></item><item><author>dolinsky</author><text>What I find most disturbing about this whole situation is the way in which these teenagers are handling themselves, especially after the fact. The continued denial of responsibility and half-hearted mea culpa, coupled with the monetary damage to those businesses who had been running on PHPFog, leads me to sincerely desire that these teenagers face a penalty of some magnitude, not just a slap on the wrist.&lt;p&gt;Maybe then they&apos;ll stop with the half-assed apologies and recognize that there&apos;s a right way and a wrong way to do things.</text></item><item><author>sriramk</author><text>I feel really bad for the phpfog guys. But given the situation, I think they handled it admirably well - kudos to them. No software is secure and this could have happened to anyone. Especially startups who have to take shortcuts at the very beginning.&lt;p&gt;I know the attackers were just kids but I have to admit pursuing legal action sounds very tempting - even to just act as a deterrent to others. If they had just put up phpfogsucks.com, it &lt;i&gt;might&lt;/i&gt; have been ok. But tweeting trash from their twitter account, redirecting their root domain to phpfogsucks, etc - are all not cool at all and should have &lt;i&gt;some&lt;/i&gt; consequences.</text></item></parent_chain><comment><author>nbpoole</author><text>&quot;&lt;i&gt;PHPFog built a castle out of sand and you&apos;re upset that a wave came and demolished it.&lt;/i&gt;&quot;&lt;p&gt;Your analogy is slightly off. A wave is an act of nature: this is more along the lines of a jealous kid who knocks down someone else&apos;s sandcastle because he can&apos;t build his own.&lt;p&gt;&quot;&lt;i&gt;I don&apos;t get angry at my dog when he shits in the house. Being angry at something that can&apos;t understand only satisfies the urge to shift blame.&lt;/i&gt;&quot;&lt;p&gt;While some HN posters might feel the the 16 year olds involved in this incident have the same mental capacity as your dog, I&apos;d like to give them slightly more credit. ;)&lt;p&gt;I can only speak for myself here, but I do think the people involved in compromising PHP Fog should be punished. No, I don&apos;t think they should get life in prison (&amp;#60;/hyperbole&amp;#62;): I hope they can learn from their mistakes. However, they did commit a crime, as they&apos;ve admitted both here and elsewhere online. They should be capable of understanding that their actions have consequences, so I think some consequences are in order. What those consequences should be is up to PHP Fog.</text></comment>