MySpace Private Pictures Leak 405
Martin writes "We all heard about the MySpace vulnerability that allowed everyone to access pictures that have been set to private at MySpace. That vulnerability got closed down pretty fast. Unfortunately though (for MySpace) someone did use an automated script to run over 44,000 profiles that downloaded all private pictures which resulted in a 17 Gigabyte zip file with more than 560,000 pictures. The zip file is now showing up on popular torrent sites across the net."
It's a diversion.. (Score:5, Insightful)
Solution: (Score:5, Insightful)
Then ask 'why?'
Then ask 'so?'
Then keep asking 'so?' until you realize it's not that big of a deal.
Problem solved.
Why you would want to do that? (Score:-1, Insightful)
1- You are just a punk who give a shit about privacy and fuck everybody else
2- YoU R jUsT ShOwInG ThE wOrLd ThAt YoU ArE JuSt TeH ShIt aNd PoWn MySpAce. YoU R sO KoOl
3- Just to piss off MySpace, because it sucks and you think, you , of course suck less (or rule the universe)
Anyway, there are no legitime reasons for just doing that.
Maybe it's just me... (Score:5, Insightful)
Trap! (Score:5, Insightful)
Re:Solution: (Score:5, Insightful)
Private? (Score:5, Insightful)
I know, I know, the myspace demographic doesn't know any better.
Re:You know what to do... (Score:3, Insightful)
Misplaced Trust (Score:3, Insightful)
If anyone was actually exposed by this, it's their own fault.
Can someone run porn detection on this and reseed? (Score:4, Insightful)
Looking through all the junk is going to take too long.
Re:Solution: (Score:5, Insightful)
Ummm, if you store potentially damaging photos on a third-party web site that is not intended to be a secure repository, why would you expect high security?
Because this has huge implications for online security.
Really? I think it just shows that MySpace is not (nor is it intended to be) a high security repository.
It bears repeating: (Score:2, Insightful)
Re:Misplaced Trust (Score:3, Insightful)
Top it off with the fact that MySpace really seem to be pretty poorly written to start with and it is no big shock.
What I don't get is how they didn't notice this one IP address sucking down this much data.
I guess they don't look at logs.
Re:Solution: (Score:3, Insightful)
Do you really think they have the common sense to know that?
One of the first rules on the internet? (Score:4, Insightful)
I thought one of the first rules on the internet was that anything you put out there can fall into the wrong hands / become public?
I certainly wouldn't trust MySpace with personal affairs - if not because of technical glitches / hackers, then because of a disgruntled employee who decides offering the entire database up is so much more rewarding than going postal.
Though the whole idea of using MySpace - a site where everybody openly shares information about themselves.. that's the whole point, after all - for *anything* private at all sounds ridiculous to me in its very premise.
Just my 2cts.. I do feel sorry for those who are/will be affected, especially in the days to come as the juicier bits are filtered out and plastered all over the web and into youtube videos for truly everybody to see, as even though my opinion is that there's no reasonable expectation for true privacy on those sites, that doesn't mean they asked for some stupid hacker and a scriptkiddie to go running amok with it.
Gee Thanks (Score:4, Insightful)
Dueling compression algorithms (Score:1, Insightful)
Re:Solution: (Score:4, Insightful)
Rule #1 of the internet: If you don't want anyone to see something, don't fucking put it it on the internet! There is no such thing as "posted privately on the internet". If it's REALLY something you don't want seen don't even put it in a computer CONNECTED to the internet. In fact, don't even take the damned pictures!!!
Gees, if brains were dynamite some people wouldn't have enough to blow their noses. I wonder how many pics in that 17 gig file are goatse?
Re:Maybe it's just me... (Score:2, Insightful)
Re:Trap! (Score:5, Insightful)
Figures... and they just put further measures in place to attempt to "protect" children from themselves. Oh well, I have a hard time feeling sorry for myspace since (a) it's myspace and (b) it's owned by News Corp.
Re:Solution: (Score:3, Insightful)
Re:It bears repeating: (Score:1, Insightful)
Re:Misplaced Trust (Score:3, Insightful)
While there are ways to reduce your exposure, there is no black and white answer to who you should trust and who you shouldn't. Only shades of gray.
Just look at the number of people that trust private information to Google or their ISP. It is no less reasonable for most people to trust MySpace than it is to trust Google with their data.
Re:4chan is gonna have a field day with this... (Score:5, Insightful)
Re:Solution: (Score:1, Insightful)
Second - myspace has a large teenage and younger crowd who don't necessarily know all that is internet security. I agree that if you don't want a picture seen you shouldn't post it, but when Myspace says nobody but you and your friends or nobody but you can see these pictures, they should be able to back that up.
While Myspace did a timely job in fixing the exploit, they are just as much at fault as the users who put private pictures there in the first place.
Re:Trap! (Score:5, Insightful)
Figures... and they just put further measures in place to attempt to "protect" children from themselves. Oh well, I have a hard time feeling sorry for myspace since (a) it's myspace and (b) it's owned by News Corp.
Re:Dueling compression algorithms (Score:3, Insightful)
In case you're new at this: a torrent file can contain more than one file, organized unto subdirectories. There's no need for any encapsulation.
What makes even less sense, though, is where a single large (compressed) file is split into a bunch of .RAR files and then all the .RAR files are repackaged into a single torrent. The resulting torrent is no smaller or resistant to corruption, and requires external tools that most people don't have to reassemble.)
Re:Trap! (Score:5, Insightful)
You charge the perpetrator with child abuse and with making and distributing indecent images of a minor. And you try them as an adult just for the glorious irony.
Re:Private? (Score:5, Insightful)
We, (I refer to the
We know the danger is from information about us being harvested, being used by future employers, insurance companies, the government, other corporates etc.. They (the 'myspace' generation) are worried about paedophiles and stalkers, whilst simultaneously being drawn to having deep personal relationships and generally being interesting (by whose standards I don't know) and pushing their personal information to anyone who will give them a linden dollar, a discount voucher or a chance to win an iPod.
Or am I just getting old?
Re:Solution: (Score:5, Insightful)
Really.
So you don't have an online interface for your credit card? You don't do online banking? You don't manage your IRA or 401K online? You don't write any emails that you wouldn't want published? You don't use SSH to access sensitive information? You don't send any instant messages that you wouldn't want published? You don't visit any websites that you wouldn't want the world to know about?
Oh, but that stuff's all different, you say. Sure, the information is all on a server, but the server will only send it to people who have the right password! Except, the MySpace photos weren't leaked by a mole; they were leaked because the server mistakenly sent it to anyone who asked for it.
This is a big deal, and your snide reply (essentially "don't use the internet") doesn't come close to offering a workable solution.
Re:Solution: (Score:4, Insightful)
No, it does not. It is the job of the parents to provide moderation. It is not my job, my company's job (though I don't work for MySpace), nor my government's job to parent someone else's children. If we can have cars traveling down streets at high speed without child restraint systems to keep children from walking into traffic, we can damned well expect parents to keep their kids safe online.
Re:Trap! (Score:5, Insightful)
Re:Dueling compression algorithms (Score:3, Insightful)
The multi-part
Re:Solution: (Score:3, Insightful)
That's not really what I'm saying. You're already given the fact that kids are posting god knows what online, whether parents moderate it or not (and I agree with you: they should). Given that, whatever it is they've got up there be it really sleazy or not needs to be kept away from pedophiles and other shady characters anyway. The point I was making is that there are far too many users, far too many photos, for all of them to be looked over before they're made public. There's a reason profiles of children under the age of 16 are made private, anyway, and it's mostly to absolve Myspace of liability. I'm saying that they have failed even at this.
Look where you're posting. I don't think there's anyone here who's arguing that it's the government's job to raise people's children. The government's job is to protect the common good, which includes keeping children safe from predators.
Re:Misplaced Trust (Score:3, Insightful)
uh... seriously? Did no one notice a huge spike of requests for only images from one IP, over the course of almost four days?
Though I guess this seems to be just the most egregious violation of this hole (any double entendre based on the potential content of said pictures is unintentional); as "The MySpace hole surfaced last fall, [...] A YouTube video showed how to use the bug to retrieve private profile photos. The bug also spawned a number of ad-supported sites that made it easy to retrieve photos. One such site reported more than 77,000 queries before MySpace closed the hole last Friday following Wired News' report." (emphasis mine)
So, as long as your privacy hole doesn't get on Wired's front page, you don't need to close it, I guess?
Re:Solution: (Score:1, Insightful)
Rubbish. It's not about "anyone", it's about limited access. Possibly only access for the owner from various locations, or from one location that cannot be used as trustworthy storage, but also possibly and likely only for a designated group, like family.
Which if obvious but you've skipped sense to make a stupid rant. That's par for an open forum, but the question is what moron made this Score:5 Insightful?
Re:anything interesting? (Score:2, Insightful)
Re:You know what to do... (Score:5, Insightful)
Yes, because teens on myspace who take nude pictures of themselves are clearly being exploited by... themselves.
The insane kneejerk hysteria surrounding the ever-growing umbrella of things that unfortunately technically qualify as "child pornography" is truly something to behold.
Re:Solution: (Score:5, Insightful)
Re:Trap! (Score:5, Insightful)
Just to play devils advocate: If we consider publishing nude photos of yourself to be pornography, why would we consider it not pornography when a young person does it?
You might make the argument that child pornography should be treated differently when the perpetrator is also the child in question, but trying to say it's not pornography is nonsense.
Re:Gee Thanks (Score:1, Insightful)
Doug Stanhope (Score:2, Insightful)
Re:I've looked. Yaaaaawn. Look again (Score:3, Insightful)
Just watch. Queue the countdown.
Re:Trap! (Score:4, Insightful)
Of course, this whole is pretty silly since any possession conviction must, by definition, be willful possession with presumption of illegality. A UPS driver can't be charged with possession of kiddie porn for delivering a package that happens to contain it unless the driver has reason to suspect that something in the package is illegal. Is there reason to have a presumption of the existence of kiddie porn in this torrent? I would say that there is not, since MySpace has people who go through the private photos and look for that stuff and report it, IIRC. No guarantees, of course. Therefore, I would find it highly unlikely that somebody downloading this torrent would get prosecuted for kiddie porn possession. Invasion of privacy, perhaps, trafficking in stolen proerty, perhaps, copyright violation (all photos are copyrighted by their creator), perhaps, but not kiddie porn possession....
That said, IANAL, so do not take this as legal advice.
Re:Trap! (Score:5, Insightful)
Re:Once again - two faces. (Score:3, Insightful)
It's almost like there's more than one of us here, isn't it...
Re:Trap! (Score:5, Insightful)
"Child pornography" is generally considered bad because in order to make it, you have to have a minor in front of your camera who's posing erotically or having sex. Since the law presumes that minors are incapable of knowing whether or not they want to pose erotically or have sex, this means that producing these photos or videos involves an act that's equivalent to rape: putting a minor in that situation without her (legally recognized) consent.
In the case of a minor posting her own pictures, however, there's no third party who could be accused of putting the minor in that situation against her will. It isn't even conceivably similar to rape, because the "victim" is making all the decisions on her own - if that's analogous to rape, then so is underage masturbation, and every teenager in the world is a sex offender.
Re:Solution: (Score:4, Insightful)
Who defines common good? Who defines what level of 'protection' is appropriate or necessary? Sorry, but i disagree with you. It is the job of the *PARENTS* to keep children safe. No one else unless they agree to take the responsibility. i.e. you hire a babysitter, school, or other activities intended specifically for children. Even then, the ultimate responsibility still falls back on the parents. Check out the daycare. Babysitter isn't a pothead?
It's not myspace's fault if their site is mis-used by children. They make a reasonable effort to protect children on their site. There is NO guarantee of ANYTHING (read the 20 page TOS/disclaimer). Just like gun makers aren't responsible for gang shootings, myspace isn't responsible if someone uploads KP.
Re:I've looked. Yaaaaawn. (Score:4, Insightful)
It is done for the same reason women, including me, enjoy fretting about rape: they're flattering themselves.
One thing the internet's sheer size teaches you: you are just another nobody, who'd have to dig deep to find some trait that is simultaneously unique and valuable. On the one hand this is a Good Thing, because it blasts from Earth forever the notion that one might be a freak in some way. On the other hand, now we have to struggle to differentiate ourselves, even in our own minds.
Re:Solution: (Score:1, Insightful)
I'm sure as soon as one person shows up to the interview with pictures of the hiring manager with a plunger up his ass and a ballgag in his mouth, there'll be a law banning the use of myspace in hiring and firing decisions. Ah, I love the smell of corporatism in the morning!
Re:It bears repeating: (Score:3, Insightful)
Putting it on the net just implies that you're trying to show some people, but not others. That's a mistake (see above). Even if you assume perfect cryptography and perfect server security, your friend could send it to someone else.
Not getting old, just stupid (Score:3, Insightful)
There is no /. crowd. Get this stupid idea out of your head, you got Bill Gates lovers and Steve Jobs fanboys. You got MSCE's and real engineers. You got Window monkeys, linux users and BSD weido's.
There is everything here from rocket scientists to people who clean toilets for a living. Age varies from almost dead to just old enough to sit upright.
We even have rumors of women visiting this place.
So how can you have a /. crowd?
Answer you don't. Sure there are some trends, there are probably a few more MS haters here and a few more Jobs lovers then in society as a whole, but read any article on Apple/MS and you will find people who go against the flow.
The reason I point this out is that it is VERY dangerous to think that all people from a certain part of society are the same.
And it is very relevant in this discussion. SOME kids using myspace are stupid enough to send private information on a public network, therefore YOU seem to conclude ALL kids using myspace are stupid enough to send private information on a public network.
This leads to nanny state rules, where because 1% of the populatin is unfit to live 99% has their freedoms restricted.
Myspace is a tool some people will get it wrong, though shit. This has nothing to do with generations or whatever, there have ALWAYS been stupid people who do stupid things, society survives.
Re:Trap! (Score:3, Insightful)
The assumption appears to be that sex offenders WILL offend again no matter what.
In which case why don't you just lock them up permanently or execute them?
Are rapists so much more likely to rape again once you let them out of jail, compared to say a violent person being likely to bash someone else up again?
Re:You know what to do... (Score:2, Insightful)