Originally Posted by jayeff

On the face of it, this kind of thread seems like an extraordinary indictment of our industry. What else could such weak member-area security be except a consequence of poor management? But there are two things to consider...

The first is that the owners of a retail store - for example - can accurately measure their losses due to various types of theft, and they can also calculate the cost of and savings resulting from measures intended to reduce theft. Thus they can apply such measures as are cost-effective and budget the practically unavoidable thefts as an expense.

We know password trading sites exist. We know their activities cost paysites bandwidth and we strongly suspect they cost them sales. But we do not have any way to quantify these losses and therefore no way to know what security measures might be cost-effective. So what to do? Good management isn't acting simply for the sake of being seen to be doing something, but acting in a way which demonstrably improves profitability.

And then there is the nature of our industry at this moment in time. It isn't made up of corporations with legal responsibilities and answerable to shareholders. Because this is still a young industry, many people in it have made, are making, far more money than just a few years ago they ever imagined: despite the password traders and all the other leaks. Yes, by absolute standards their management may be poor, but so what? They could learn and apply some new skills or hire those skills and add some points to their bottom lines as a result. But if that meant diverting part of their time and energies away from the things they enjoy doing and believe make them the big money, I seriously doubt many would be interested.

So what does someone like Ciao bella really have to gloat over? By his own admission he is hacking systems with minimal security, so what he is doing isn't much of a technical achievement. And sooner or later he risks falling foul of the law when he likely could make as much or more money legitimately.

The bottom line is that he is no better than any other kind of small-time thief and while he might be an irritant, the people from whom he is stealing will still be making serious money, long after he has been shut down.