If that's the only logic that successfully gets through to the boss, it's good logic.

Not necessarily causality, but I'd say there's at least a correlation, and a good enough reason to make office life as bearable as possible.

> There is nothing to imply human rights have been violated. If such information is presented im sure people will respond in kind.

What are you talking about? There is no "article," only the statement of one involved party. It's right to be skeptical and theorize about what else might have gone on that was omitted from that statement out of self-interest.

Until they release specifics if ever, it's hard to know what to make of the status message.

If there isn't a police report, and charges aren't pressed against a malicious individual, then the company may be at fault.

Certainly the employee could willingly and pro-actively step down, out of personal guilt and feelings of shame, but then, one need not qualify with "ex" as simply "employee" will suffice. A criminal incident is worthy of such a clarification, indicating that the incident is a deliberate attack, but human error is not.

If this was a "cyber crime" they could possibly be picked up to stand trial in any cooperating country which would narrow their choices of travel.

However, in that situation they would probably be fine except potentially limited ability to work for Companies who do background checks

"Your honor, my client, the recently released child rapist with an iffy work record, is suing because BigCorp says they normally don't hire felons, but a few years ago BigCorp made an exception for a felon who sold marijuana, got his college degree in prison, then after he was released worked at non-profits helping the poor while getting an advanced degree in computer technology and writing several highly regarded academic papers on improving user interfaces for the disabled. That's not fair!"

The specific facts matter, and HR should be fired if they have blanket polices that ignore them. HR needs to serve the business, not the other way round.

One day one of the feared internal security team who had caught him years ago was in the building and met him and freaked out - our centre mangers politely told him to f off when he demanded that we fire the guy.

I've been following and partaking in various European cybercrime trials for years and unless this guy is a repeat offender or acted in a particularly methodical manner it seems utterly ridiculous to make blanket statements like "this guy will go to jail". He most likely will not.

o_O

Why would you assume you couldn't?

People assume that that is all about skills but it isn't necessarily. An employee with a serious debt problem and a mortgage payment due soon will be more likely to accept a bad deal than an equally skilled employee who doesn't.

* The irrational biases of other companies (even if we didn't care about you being a university grad, our commensurately lower wage offering reflected the fact that other companies did).

* If the employee telegraphed an air of needing the job (e.g. people with a debts), they got offered commensurately less.

It's an ugly process, truth be told.

If they're sharing them individually with you... Then clearly they're not paying attention

Also, the CA mode of OpenSSH is great. More people should use it. It's like PKI but sane.

https://en.wikipedia.org/wiki/Two-man_rule

What they did; and more importantly have they recovered and not commited another crime of similar circumstances.

P.S. I knew a kid when I was younger who helped an ISP start up in Colorado Springs in the late 90's... he got fired and he hacked them and spent 6months in jail; eventually they re-hired him after he got out of jail only for a repeat offense.

There is a point; he did it twice. The first time they could pass it off as they didn't know; the second time they hired him they were legally liable.

So this gentleman should spend some time in jail for what he did.

Automated tools may need to delete and list; but heck off site secure backups are an amazing thing.

I think that's very on point. While HN is a technology site, it's also one for "founders" * who aspire join the elite of that social order, which explains the exaggerated empathy for the interests of shareholders and companies.

* (and those with fantasies of being one)

You are basically justifying the 'killing of innocents' here..

Although that's perhaps not the right word. There is contiguous land between e.g. The Netherlands and Russia, so there's no "shore" involved as there would be between e.g. the USA and Russia. I do think the word's meaning is now more "another country", rather than denoting crossing physical land/water boundaries.

You mean in any kind of practical or legal sense or in your personal opinion?

I see this happen all the time and am not aware of any thing barring this in the U.S.

Think about the two extremes. If a startup of a few people run a background check there is no HR dept so the CEO/hiring manager is seeing it.

On the other hand if the hiring manager is the CEO at an F500 company trying to hire a handpicked rockstar exec and a background check pops there no way that person will be rejected only on the word of HR without understanding what the issue is and the context around it.

Somewhere in the middle of those extremes companies may have policies to address the situation, but I don't see how any blanket statement can be made here.

If their employer was a James Bond level super-villain about to shortly kill millions you could construct this scenario.

Otherwise there is no scenario where inflicting what you term a "brief disruption" (but what they'd likely describe as an awful, painful and expensive) to thousands of innocent customers is justified. Customer costs could easily be millions, if 1,000 customers each spend over ten hours of worker time dealing with that disruption.

If the employer did something illegal, report them to the authorities. If they wronged you, other employees, or customers, take them to court and publicize their malfeasance.

If you can't do any of those things because what the company did wasn't wrong or illegal, and instead wipe their servers, you are a sad little loser who can't handle the fact that they just didn't like you, and for good reason.

That the actions described in the claims are criminal is not in doubt. Whether those actions actually took place is unproven, as is whether this unnamed ex-administrator performed those actions.

So, I'm not ready to say that this person is a criminal, or that a crime was committed, but I am ready to say that the actions described in the claim are criminal and wrong.

No. It's easy to revoke access to a user. An admin is different - an admin can install whatever he wants to give him backdoor access. Or a timebomb.

Password rotation becomes necessary, and a little bit riskier, because now you have to deal with accidental lock-outs in a sane, coordinated manner.

> Do they fire you if you're not testing positive for cocaine?

How many little shops rely on Verelox - aren't they little guys?

How many end customers depend on services that depend on Verelox - you know someone like you - aren't they the little guys?

The police/prosecuting agency in the country where the company is based I imagine. That appears to be Holland [1]

[1] https://www.ripe.net/membership/indices/data/us.verelox.html

The fact that it was an ex-administrator does suggest foul play as opposed to a mistake compounded with poor backup processes. We shall have to see how the story pans out.

Sigh. I can't believe we're going there on this one. Just so we're clear, you think that maybe the definition of criminal behaviour shouldn't include wiping out systems without the owner's consent?

> And why is criminal behaviour always placed on the little guy when companies can always get the leeway of claiming ignorance?

I don't know what you are talking about. Criminal behaviour is placed on the criminal... and ignorance of the law is not a defense.

We do.

The relationship in most companies is entirely asymmetrical. If times are tough, employees are expected to work unpaid overtime, to sacrifice on pay and perks, to accept layoffs. If times are good, shareholders and executives see all the profit. Employees are expected to show absolute loyalty, but are shown not one shred of loyalty in return. Productivity is soaring across the economy, but wages have been stagnant since the 1970s.

Most employers will never truly respect their employees, ever, under any circumstances. Employees aren't people, they're a "human resource", a cog in the corporate machine as interchangeable as any hardware. More so, in fact - a piece of machinery would be hired on a fixed-term lease, but most employees can be dismissed at will.

I don't endorse vandalism, but I think that it's utterly naive to expect that you can earn the respect or loyalty of corporate America. It doesn't matter how honest you are or how hard you work, you'll still be discarded like an oily rag if you're surplus to requirements. You'll still be lowballed on every pay rise while executives and shareholders make record earnings.

I get rid of people from my life who I think don't have integrity, or whose values are different from mine in critically important ways.

On this, however, we agree entirely.

The large majority of the population will succumb to "what's normal" vs. "what's for the best" to avoid being casted unfavorably. Your regimented approach to seek out the carved out channels of recourse, dictated by authority, suggests you won't combat for change.

We live in a society, yes, and we have norms to abide to. But when we propagate the notion that everyone should put their heads down for the sake of reputation, then the world will never progress.

Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear.

Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.

We may remain open to additional information without presuming that uncivil and illegal vandalism was justified indeed without inventing a narrative from whole cloth as you have done. The logical conclusion is that drawing from your own life experience you identify so strongly with the narrative of the wronged sysadmin that you desire to fit a narrative to sparse facts that has no basis in fact.

We are merely commenting on a story on hacker news. We aren't members of the jury and don't face the same burden or power. I'm down with repealing the cfaa because its badly written, I'm down with figuring out who dropped the ball as far as giving the sysadmin access post firing, but as to the sysadmin himself, burn the witch!

IIRC, the Soviet Union had a policy rather like this, referred to as something like the Vertical Stroke, where anytime there was a screw-up at a low level, they would fire the screw-up-ee's manager, and manager's manager, and so on, up to a very high level. The practical result was a drastic decrease in innovation and risk-taking. CEOs and others at that level usually aren't close enough to the guys actually doing direct work to supervise them all closely enough to ensure they don't make mistakes. All they can do is create a culture where there's a book of rules, and you don't deviate from the rules ever, for any reason, no matter what. So that's what they do, and that's the resulting culture and economy that you get.

Maybe we shouldn't rush to judge either sysadmins or CEOs, but instead figure out who, if anyone, actually did something malicious, and let everyone else take the lessons they've already learned from what happened.

If he did it (intentionally wiping the servers), then he is a criminal and a bad person.

If he is a scapegoat, then he didn't do it, so that's a totally different situation.

I don't see how you can disagree with either of these statements.

And discussion of how he still had access is an unrelated matter.

Maybe he became an ex-employee after (and as a result of) wiping production.

So if an aggrieved ex employee does enough damage that the company has insufficient resources to sue, or has enough resources themselves to make that difficult, it's all good?

Individuals and companies should not be vulnerable to attacks like this based on their resources. It's in all our interests to ensure this sort if activity is dealt with severely because we are all vulnerable. Mutual defence in the form of criminal prosecution of offenders is the way they go IMHO.

They can't have it both ways.

It was the creepiest, most cynical thing I've ever seen.

Those guys are gonna be RICH.

Denying transport to someone who's got a history of doing anti-social things behind the wheel seems reasonable. But making them required for all vehicles (if I'm understanding your intention correctly) seems likely to have undesirable results.

Seriously, read up on the history of breath-test machines sometime. Everything from difficult chemistry to literal "oops we misplaced a decimal point in the software".

Suppose someone was born out in the forest, and there were no cities, no societies, no technology. Would you call that person a sustenance slave? Would you say that their foraging was involuntary?

Being employed at a particular organization is, in fact, voluntary. You are not obligated to stay at one employer forever.

No one has the perfect job, everyone thinks they should make more, have more benefits, more freedom. But everyone has choices. You don't have to participate in the rat race, you can stop letting material possessions drive your lifestyle decisions.

First, rsync.net is "cloud storage for offsite backup" - you can't run a git server[1] (or anything else) there. It's not a VPS or a web host. It's a remote unix (ZFS) filesystem that you can access over SSH.

The other point you are missing is that the ZFS snapshots I refer to are immutable as far as you are concerned. Of course we can remove them[2], and could do so at your (vetted, verified) request. Further, we don't have unlimited disk space so the snapshots rotate out (expire) over time. Every day the 7th one is removed to make room for the new "yesterday" snapshot, and so on.

The point is, an attacker can gain full access to your backups with all of the control you have ever had over them and they can't destroy/delete the snapshots. That would have helped the victim in this story immensely.

[1] You can, however, put git repos there and interact with them, using git, over ssh.

[2] Although it requires root and is an involved, manual process - which is good.

What do you expect me to do? Investigate the matter myself? Buy myself an unlicensed firearm and look for the hacker to get it back at gunpoint?

I think most of HN is in the "baronet" class (say, 2-3x of median income) or higher, and doesn't necessarily have a good perspective on what most people (ie, those at or below median income) deal with.

Per capita income has flatlined for a decade (since 2008), after 60 years of steady growth. But that largely doesn't impact programmers, entrepreneurs, etc. Instead, it impacts the people on the bottom.

Just because the present system works for you doesn't mean it works for everyone.

It was always good to be king.

So, overall, it looks more like a form of economic slavery than some cooperative, voluntary, win-win system. A good hint is that most of the wealth has moved into few hands who usually didn't work their way up into it from the bottom like the people producing it. The people producing it didn't want that arrangement either. They have no control, though, since the elites outspend all of them combined on politicians passing these laws, media shaping perspectives, and public education limiting their intellectual growth while simultaneously reinforcing submission to authority (esp arbitrary requirements) daily for 12+ years. Most of America is born into a new form of slavery that few ever escape.

Incorrect. Throughout history there has been many societies where people would legally sell themselves into slavery (e.g. to pay a debt, under threat of being imprisoned) and even receive a meager salary.

Yet it's still slavery; you can look up the definition in a dictionary.