SoylentNews is people
SoylentNews
USA Today has a story about a New Jersey couple who allegedly used a glitch in Lowes website to steal merchandise.
A New Jersey couple used a website glitch to try and get more than $258,000 worth of goods — everything from a gazebo to an air conditioner to a stainless steel grill — for free from a home improvement store, authorities said.
Ultimately, the couple was only able to secure nearly $13,000 worth of merchandise from Lowe's after exploiting "weaknesses" in the company's website to have the items shipped to their home in Brick for free, according to a release from the Ocean County Prosecutor's Office.
Romela Velazquez, 24, was arrested and charged with theft by deception and computer criminal activity for accessing a computer system with the purpose to defraud. She attempted to get about $258,068 worth of unpaid merchandise from Lowe's, according to the release.
She actually received about $12,971 in stolen products, according to the release.
Her husband, Kimy Velazquez, 40, was charged with third-degree receipt of stolen property and fencing for his role in the alleged scheme.
The couple tried to sell some of the products on a local Facebook "buy and sell" group for half of the original sale price, listing the products as "new in box," authorities said.
According to an article on NJ.com, an attorney for the couple has stated that Velazquez is just an expert shopper, not a criminal hacker.
Jef Henninger, an attorney for Romela Velazquez, said his client is "the farthest thing from a computer hacker."
"Like many young mothers, she needs to stretch every dollar she can," Henninger said in a statement. "As a result, she has learned to spot good deals. These are the same deals that any of us can take advantage of, but most of us are too busy to learn how to spot them.
"Buying things at a big discount and selling them is not illegal. As a result, she maintains her innocence (and) looks forward to her day in court."
As far as I have been able to find, no technical details about the hack have been released.
One of the more interesting details that I did see was
Lowe's, makers of Ugg shoes and Victoria's Secret have been identified as victims so far – but many more retailers were also ripped off and will eventually be identified, officials said.
Who knew?
Additional coverage at the New York Post and BleepingComputer.
(Score: 4, Interesting) by Snotnose on Tuesday August 22 2017, @01:00AM (33 children)
on a BBS I was given a phone number. Using my 300 baud modem to connect to that phone number I connected to Monkey Ward. From there I could order anything they offered in their catalog. No money required, just a mailto address.
I thought about it, then decided no, I don't want to go to prison 10 years later when they figured it out.
This is the same shit. Get a 20% discount? Yeah, that's plausible. Get a 100% discount? Yeah, you're a thief and fuck you.
When the dust settled America realized it was saved by a porn star.
(Score: 1, Troll) by kurenai.tsubasa on Tuesday August 22 2017, @01:04AM (11 children)
Yeah, but I'm guessing you couldn't hide behind female privilege.
(Score: 2, Insightful) by Snotnose on Tuesday August 22 2017, @01:07AM (10 children)
Fail to see male/female privilege here. You're either a thief or not a thief, gender doesn't come into the equation.
When the dust settled America realized it was saved by a porn star.
(Score: 2) by FakeBeldin on Tuesday August 22 2017, @07:53AM
Maybe GP was talking about a <pun>thyvette</pun>?
(Score: 3, Insightful) by kurenai.tsubasa on Tuesday August 22 2017, @01:25PM (1 child)
Let me try to make this obvious.
What's the difference between a SWAT team at 4 AM and being thrown straight into PMITA prison where one will be subjected to rape (we are ok when men are raped; we lose our shit when women are raped) along with press coverage that's already convicted one of not only a felony violation of the CFAA, but of being a “hacker” and worse than that, somebody who hasn't had enough sex with women…
What's the difference between that and being a “young mother” who's “learned to spot good deals.” Yeah, I'm sure whatever way she's abusing the website merely constitutes a “good deal.”
The difference, folks, is gender!
(Score: 3, Interesting) by Immerman on Tuesday August 22 2017, @04:25PM
The difference is a lawyer is grasping at any straw possible to get their client off the hook - or have you never seen the ridiculous defense arguments made in.. frankly just about every case where the perpetrator is caught red-handed?
(Score: 2) by hemocyanin on Tuesday August 22 2017, @03:16PM (4 children)
In crime, it pays to be a (white) woman because you are A) less likely to be charged, and B) less likely to be convicted, and C) if you are convicted, serve a much shorter sentence:
http://www.huffingtonpost.com/2012/09/11/men-women-prison-sentence-length-gender-gap_n_1874742.html [huffingtonpost.com]
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @04:52PM (2 children)
Well that's not really a problem since more guys are committing the crimes than women. At least the major crimes.
Despite throwing fewer women into prison, there still aren't that many women serial killers/rapists/robbers/investment bankers/etc.
https://www.prisonpolicy.org/graphs/genderinc.html [prisonpolicy.org]
(Score: 2) by chromas on Tuesday August 22 2017, @10:13PM
Dat's raci—oh wait, you said "guys", not "black guys". It's okay then. Carry on.
(Score: 2) by FatPhil on Wednesday August 23 2017, @07:46AM
And really, a "rate" for incarceration should be "incarcerations per guilty defendant", not "... per head of population". If women commit only 1% of the crime (with the same distribution of crime types as males) then were they 5% of the incarcerations, males being 95%, that 5% statistic would imply there was a gross bias against females.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by chromas on Tuesday August 22 2017, @10:41PM
I'm pretty shocked huffpo would run such an article.
(Score: 2) by FatPhil on Wednesday August 23 2017, @07:53AM (1 child)
k.t. says effectively "there should be no gender disparity, but she's probably going to get special treatment because she's female" and gets -1 troll?
You say effectively "there should be no gender disparity" and you get modded +1 insightful?
OK, k.t. gets a couple of insightfuls when spelling out the deadly headshot long-hand, but everything necessary to get the point was in the original post.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by FatPhil on Wednesday August 23 2017, @07:58AM
The history's more complex... Troll (->0), Insightful (->1), Troll (->0), Offtopic (->-1), Underrated (->0), Touché (->1)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 4, Insightful) by Fluffeh on Tuesday August 22 2017, @01:27AM (4 children)
If you cheat the system to get a 20% discount, it's just as much stealing as getting a 100% discount using the same bug.
Having said that, I am much more concerned about the other side of the coin in this situation - it seems to imply that the vendor/business is not responsible for ensuring that their website is properly operating. Okay, sure this one sounds like a pretty obvious case of cheating on the side of the customer... but what about when the wrong price is advertised and the vendor doesn't want to fulfill the advertised price? It seems like a get out of jail free card. Also seems to imply that as a business, I can use any quality IT vendor for my needs as I am not on the hook for any screw-ups their code allows customers to do...
It's a damned race to the bottom if you ask me...
(Score: 1) by tftp on Tuesday August 22 2017, @03:08AM (2 children)
Not any more than a homeowner is responsible, when locking up his house on the way to work, to ensure that his locks are free of zero-day or any other vulnerability as known by at least one person on this Earth this very minute.
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @03:33AM
Nope, if there's no sign of forced entry then insurance won't pay out when you're robbed. Something like 90% of household locks are trivially picked without leaving signs, but few people with brains are robbing houses.
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @05:33AM
Really? So filthy rich corporations running their own websites are equivalent to the average homeowner? Don't you think people/corporations with that many resources should be held to a higher standard than that?
(Score: 2) by FatPhil on Wednesday August 23 2017, @08:01AM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 3, Insightful) by drussell on Tuesday August 22 2017, @03:02AM (5 children)
Why? If the store offers you a 75% discount, you would take it, wouldn't you?....
If they offer you a free item, 100% off, you would take it, wouldn't you?
Isn't it their fault for offering to "sell" you something at 100% off list price?
(Score: 2) by quacking duck on Tuesday August 22 2017, @01:50PM (1 child)
On the contrary, Microsoft was literally offering Windows 10 for 100% off until last year, but I refused to take it. And thank goodness I didn't.
(Score: 2) by Immerman on Tuesday August 22 2017, @04:39PM
No they weren't. If they were, I would have stockpiled a few copies against possible future need.
What they were offering was a free but irreversible (beyond the trial period) "upgrade" from older (but not *too* old) versions of windows. Basically a trade-in program from Win 7 and 8, where the price was your old version of Windows.
As such I "traded in" a Windows 8 license, with no regrets - nowhere to go but up from there. Would have done the same with XP if I could have (no use for an OS I can't safely connect to the internet) But I kept Windows 7.
Of course my main PC is still running Linux, because why would I want to do my day-to-day stuff on an OS with factory-integrated spyware?
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @05:06PM
0) https://en.wikipedia.org/wiki/Mens_rea [wikipedia.org]
1) If the page immediately showed you a big discount and a reasonable person would have thought it was a discount, then I'd say you were innocent. >=100% discount is not reasonable, normally stores will say "Free!" instead of 100% discount. People make mistakes. But on the flip side, people make mistakes and think 100% is reasonable too. So I might give the benefit of doubt to the "buyer" ;).
2) BUT if you had to do unusual steps before you got that discount then it starts to depend on those steps, e.g. was it some sort of online "treasure hunt" planned by the store? An online treasure hunt gone wrong with a buggy discount thing?
(Score: 2) by FatPhil on Wednesday August 23 2017, @08:03AM (1 child)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 3, Funny) by Azuma Hazuki on Wednesday August 23 2017, @04:40PM
Ah, but they ALSO marked up air freshener by 250%!
I am "that girl" your mother warned you about...
(Score: 5, Interesting) by stormreaver on Tuesday August 22 2017, @03:18AM (9 children)
I couldn't disagree more. The couple in the story is a victim of a vicious double standard. Lowe's agreed to give stuff away, and then had a change of heart after the fact. Because Lowe's is rich, it was able to have the police declare the transaction invalid. If it were you or me, the police would say, "Sorry, but you agreed to the transaction. Be more careful next time." And that would be the end of the story. That Lowe's agreed to the transaction algorithmically is entirely irrelevant. A binding contract was created (offer and acceptance).
That Lowe's made a bad deal should not invalidate the deal.
(Score: 2) by arcz on Tuesday August 22 2017, @05:22AM (1 child)
If that's really the case, the criminal complaint will be dismissed and the property returned to the couple.
(Score: 2) by aclarke on Tuesday August 22 2017, @11:37AM
Minus the fact that these two folks probably can't afford a great lawyer, compared with Lowes and their legal team. Court isn't likely to be a level playing field, although I am glad to read that they at least do have a lawyer.
(Score: 1) by Virindi on Tuesday August 22 2017, @06:36AM (3 children)
Agreeing to give something away for free is not a "binding contract". See: "consideration".
(Score: 2) by stormreaver on Tuesday August 22 2017, @11:53AM (1 child)
"Consideration" can be waived, if both parties agree.
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @09:01PM
No, you cannot "waive" consideration. If any of the 3 elements of a contract (offer, consideration, and acceptance) are missing then it is not a contract.
(Score: 2) by FatPhil on Wednesday August 23 2017, @08:12AM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by digitalaudiorock on Tuesday August 22 2017, @02:12PM
Since they haven't reveled the technical details of how they did this, so it's hard to say, but if in fact this was just a dumb mistake as to how they handle their pricing, and not an actual "hack" I'd say it should fall under the same laws as when merchandise is incorrectly priced in a store...that is where Lowes would be obligated to honor it. Again, though, it's unclear what exactly happened.
(Score: 2) by bart9h on Tuesday August 22 2017, @07:54PM (1 child)
If only she used the opportunity to get some goods she was in need of, probably she could get away with it.
But to profit from it by trying to get all she could? It's obvious it would be noticed.
(Score: 2) by stormreaver on Tuesday August 22 2017, @08:24PM
Who cares is she profited from it? It's how businesses are started, maintained, and grown. She found a great source, and sold at a profit. It's not her fault if the source didn't calculate its own profits accurately.
(Score: 1, Offtopic) by realDonaldTrump on Tuesday August 22 2017, @01:05AM (7 children)
Trust me, Lowe's doesn't make Victoria's Secret. It's made by L Brands but the L doesn't stand for Lowe's. It stands for Les Wexner. Who is disgusting. He said I'm like Emperor Nero or Emperor Caligula. Who, even though they were Emperors, were not popular. Not at all popular. And worst of all, he compared Crooked Hillary to those Emperors in the same breath. In the same sentence. So no one knows whether he's saying I'm like Nero and she's like Caligula, or I'm like Caligula and she's like Nero. Which she is, but I'm not. Disgusting! 🇺🇸
(Score: 4, Funny) by bob_super on Tuesday August 22 2017, @01:11AM (3 children)
Donald prefers the Oxford comma? I guess when you reach three wives, it starts to matter.
(Score: 2) by realDonaldTrump on Tuesday August 22 2017, @02:14AM
Absolutely! But I call it the Chicago comma. They taught it to me at Wharton. Where I minored in real estate, and majored in RULING INCREDIBLY. Ruling the likes of which you've never seen in your life. Like this world has never, ever seen before, and may never see again! 🇺🇸
(Score: 3, Insightful) by Magic Oddball on Tuesday August 22 2017, @07:50AM (1 child)
Using an Oxford comma doesn't seem anywhere near as weird as the fact that he has produced so many comments without making catastrophic spelling errors. ;-)
That said, I thought that the Oxford comma was limited to sequences with three or more items, and the only list I can see there has just two compound items: (a=1 and b=2) and (a=2 and b=1).
(Score: 2) by Osamabobama on Wednesday August 23 2017, @10:26PM
I count three items on the list:
1. Lowe's
2. makers of Ugg shoes (i.e. Deckers Outdoor Corporation)
3. Victoria's Secret
Appended to the end of comments you post. Max: 120 chars.
(Score: 2) by Snotnose on Tuesday August 22 2017, @01:14AM (2 children)
When the dust settled America realized it was saved by a porn star.
(Score: 2) by realDonaldTrump on Tuesday August 22 2017, @02:07AM (1 child)
Are you quoting yourself? Let me tell you, when you quote yourself you don't need to use quote marks. You can just come out and say it! Believe me, I love to quote myself, I quote myself all the time. And no one ever questioned it. So I know. And I don't know how Victoria's Secret got a shout out, but they did. In the summary, in bold. It's a long summary, but just skip to the bold part. And there it is! Amazing and very, very disappointing, but true. Sad! 🇺🇸
(Score: 2) by realDonaldTrump on Tuesday August 22 2017, @02:21AM
P.S. when I say come out, it's OK if you come out as gay. I'm very, very OK with the gays! ✔ And especially with my beautiful lesbians! Just remember who has your back. Who always, always stood behind the gays and lesbians! Not trans, I'm done with the trans. In 2020, remember me! #TRUMP2020 🇺🇸
(Score: 1, Offtopic) by MichaelDavidCrawford on Tuesday August 22 2017, @01:09AM
HiRez Plz.
Yes I Have No Bananas. [gofundme.com]
(Score: 5, Insightful) by Justin Case on Tuesday August 22 2017, @01:17AM (34 children)
OK I get it that most people would judge this as theft.
But just to present another perspective...
I call you up and say "Hey I want to buy a couch. Can you ship it to me?"
You: "Sure"
Me: "How much?"
You: "$500"
Me: "OK I'll take it but I'm not paying $500. Will you accept $300?"
Now you have a decision. You've stated a price. I made a counter offer. You can accept or not. Shipping the goods after I propose a price reduction seems to be accepting my offer.
How is it different if you delegate the decision to a web site? If you did not adequately explain your discount policy to your web server how is that my fault?
I send you a message. You accept it and act on it. You had a choice to decline my order. Where is the crime?
Most "web site hacking" involves sending a (possibly unusual) request to a web site and the web site chooses how to respond.
(Score: 1) by khallow on Tuesday August 22 2017, @01:54AM (19 children)
Why the expectation that the web site operates flawlessly?
Further, what is the price offered for unpaid merchandise? Why should there be an expectation that a business is going to legitimately negotiate their products down to free for the taking?
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @03:00AM (1 child)
Because the cost to give you free shipping may be less than the cost to have the merchandise disposed. Should we pay someone to get rid of this office furnature or set the price to $1.00 or $0.00 and have customers carry it away for free? I've rang up an on sale item that was an in store display, and after the $20.00 off MFG coupon I ended up paying the customer to take the item. The MFG coupon will be reimbursed.
Your black and white view of economics is so mentally deficient you need to check yourself back into elementary school.
(Score: 2, Insightful) by khallow on Tuesday August 22 2017, @12:29PM
But that's not the case here.
We're not speaking of economics here. We're speaking of someone who found a trick for getting a quarter of a million dollars in merchandise for free and is claiming as their defense that they thought it was legitimate. Where is the expectation here that a business will legitimate give away that quantity of merchandise for free no matter the supposed economic reason when they weren't prior? Especially when the person then turns around and sells the merchandise for a significant fraction of its original price?
(Score: 5, Insightful) by Justin Case on Tuesday August 22 2017, @03:14AM (4 children)
Why the expectation that an employee operates flawlessly?
A business is usually liable for the mistakes of its employees, even if the employee fails to follow instructions. Here, the web site is following the instructions given to it by the business.
(Score: 1) by khallow on Tuesday August 22 2017, @12:35PM (3 children)
There is no such expectation of that either. And there have been times when large mistakes by employees have been reversed rather than honored (for example, mistyped refunds).
Sorry, I don't think this story would turn out different if it were an employee who mistakenly gave this person $250k in merchandise rather than a website.
(Score: 2) by Justin Case on Tuesday August 22 2017, @01:46PM (2 children)
What if the clearly written company policy said "If a customer walks in the door wearing a tinfoil hat, their purchases are free"? What if the employee and the customer can produce that written policy in court as part of the customer's defense?
If the employee follows the written instructions exactly, it isn't an employee mistake. It might be a mistake in the written policy. Responsibility for that would have have to rest on the people who wrote the policy.
The customer would say "Hey, I read your policy. I'm not responsible for your pricing decisions and promotions. You said if I wear a tin foil hat I get free stuff. I acted on that discount you made available. It isn't my fault other customers didn't read the fine print. It surely isn't my fault you didn't read your own fine print.
(Score: 1) by khallow on Wednesday August 23 2017, @06:21AM (1 child)
Feel free to consider whatever you want. But if you want me to consider it, it should have some real world relevance. This scenario has no relevance to the story since as described, it wasn't a policy failure, but bugs in the website.
"IF".
(Score: 2) by Justin Case on Wednesday August 23 2017, @01:30PM
From the perspective of the web server, the site's code is the company policy.
I suspect the web server followed its employer's written instructions exactly. Computers are very good at that.
(Score: 2) by sjames on Tuesday August 22 2017, @05:12AM (8 children)
I see no such expectation. If the company chooses to be represented by an idiot (meat or electronic), that's their issue.
(Score: 1) by khallow on Tuesday August 22 2017, @12:44PM (7 children)
(Score: 2) by Justin Case on Tuesday August 22 2017, @01:30PM (5 children)
Software bugs no longer exist. We are about to trust our lives to self driving cars.
(Score: 2) by Immerman on Tuesday August 22 2017, @04:46PM (2 children)
Not a problem so long as the cars' software is less buggy than most human drivers, which is a relatively low bar to cross.
(Score: 2) by Justin Case on Tuesday August 22 2017, @05:21PM (1 child)
So the amount this couple "stole" from Lowe's should be not a problem, so long as it is less than most thieves usually steal.
On the one hand "web site bugs are so common Lowe's should not be expected to have a bug free site".
On the other hand "self driving car bugs are so rare we can bet our lives on this untested future vaporware".
If we've learned anything from decades of web site developers it is that sloppy code is common, easy to abuse, and never goes away. Yet we have people arguing that incompetence is to be expected, and not a problem, and surely not anyone's responsibility.
(Score: 2) by Immerman on Tuesday August 22 2017, @06:15PM
I was commenting primarily on your implied smearing of self-driving car capabilities - which are not untested vaporware. Tests have been ongoing for years, and even compensating for manufacturer overstatement they're at least getting into the same league as the average (incompetent) human driver.
In a broader context yes, incompetence is *absolutely* to be expected - only gods are infallible... and actually most religious texts make a pretty good argument against even that if you read them carefully - even the Abrahamic ones.
As for responsibility - it's the responsibility of anyone relying on the results of such known-flawed individuals or infrastructure to ensure that adequate safeguards are in place to reduce the risk to acceptable levels. If you're operating a large-scale store I expect there are safeguards to protect against incompetent (or corrupt) human employees - no less should be expected of your expected-flawed software.
The big problem with software is not that it's flawed - that's implied by its very existence. The problem is that it fails *predictably* - which humans (mostly*) don't. Wouldn't be a problem in an "honest" world, but it means that any flaw discovered can potentially be exploited on a large scale by dishonest individuals if sufficient oversight isn't present. Quite similar to the law really, where the wealthy and powerful will predictably exploit any loophole they find (or have intentionally installed) until such time as sufficient public outrage builds around it to get the flaw repaired. In both cases, the key to continued exploitation is to maintain a low enough profile to avoid triggering repairs.
(*Though we do have our weaknesses - most of which are exploited mercilessly by marketing and political campaigns).
(Score: 1) by khallow on Wednesday August 23 2017, @06:23AM (1 child)
Ok. Feel free to get back on subject any time you'd like. Last I checked, web sites were not being managed by self driving cars.
(Score: 2) by Justin Case on Wednesday August 23 2017, @01:37PM
Way to miss the point. I didn't say web sites are being managed by SDCs. They're both being coded by careless quick-to-market fix-it-later-or-never development teams. The difference is sloppy websites sometimes cost the seller (who should therefore have at least a little reason to care) while SDCs will kill innocent bystanders, and so far I have not heard anyone who is going to be held responsible (by the death penalty, preferably) for that.
Here's what I did say... currently just TWO posts above your reply:
(Score: 2) by sjames on Wednesday August 23 2017, @11:54PM
No provision needed. Offer made and accepted. Perhaps it was accepted because the website was the modern electronic version of the village idiot, but that's who/what Lowe's chose to have represent it.
(Score: 2) by urza9814 on Tuesday August 22 2017, @06:54PM (2 children)
Because they agreed to the transaction and because they've empowered that software to make decisions on the company's behalf. If they're afraid of bugs in their site shipping things out for free, they can always code additional layers of validation before the item ships. They can pay a room full of humans to validate every single transaction if that's what it takes. But once they take your money and ship the merchandise, they've agreed to the sale.
If you go into a store and the cashier charges you the wrong price, the store can't arrest you just because their employee screwed up. It's their job to ensure their employees know how to do their job. If they want to use automation to replace those cashiers -- whether it's in store or online -- then that automation ought to be held to the same standard. It's not my job to know the difference between a good deal and a faulty algorithm. It's often not even possible. I can buy a pair of sunglasses for one cent on Amazon while WalMart would charge twenty bucks for an identical pair (identical as far as I can tell from an online photo at least). Seems like a mistake. But they've been on sale at that price for years, people are buying and reviewing them, nobody has removed the listing...so it's probably not a mistake, it's probably cheap Chinese garbage and they're siphoning a profit off the shipping fees or bundled ads or something. So what you're saying is the company can ship those out for years, and then when they start going bankrupt they just threaten to arrest everyone who ever bought a pair unless they pay an additional $20? That's not retail, it's extortion.
(Score: 1) by khallow on Wednesday August 23 2017, @01:29AM (1 child)
They can, if you do it often enough that you get $250k of merchandise that way. This goes way beyond exploiting a single mistake. It's stealing the store blind.
And since we're putting arbitrary words in each others' mouth, what are you really saying? "khallow is quite right and I beg his mercy for having the foolish temerity to question anything he has ever posted." I think it is quite possible that that wasn't what you were saying just like your straw man wasn't what I was saying. A single exploiter who steals a lot of merchandise is not equivalent to selling items to a zillion people at a discount and then attempting to extort considerably more money from them in some ludicrous scheme.
(Score: 2) by urza9814 on Wednesday August 23 2017, @11:37AM
So if instead of one pair of those cheap sunglasses I buy twenty thousand and start selling them for a profit, THEN I may or may not be a criminal depending on whether or not the company later decides that their pricing algorithm was incorrect?
(Score: 2) by maxwell demon on Tuesday August 22 2017, @04:54AM (10 children)
Imagine you are making a written contract. The other side signed it and hands it to you to sign as well. Before you sign it, you alter it without the other side noticing. The other side proceeds to fulfil his part of the contract, and then when its your turn you point to your alterations, pointing out they say you are not required to fulfil them. Now please tell me, did you defraud the other party or not?
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by Immerman on Tuesday August 22 2017, @04:55PM
My parents actually had such a case go to court - slightly less simplified as there's not really any way to unilaterally modify a contract after one person has signed it.
The contract was sent back and forth many times with revisions highlighted, until right near the end the other guy failed to highlight a two-word change buried in a "settled" part of the contract, that seriously changed the balance of power in the business relationship. The judge's final ruling, despite having the paper trail of evidence showing the intentional deception - "Tough luck. The law is responsible for upholding the contract you signed, not the one you intended to sign."
(Score: 2) by urza9814 on Tuesday August 22 2017, @07:09PM (1 child)
Big companies like Lowes do this as standard business practice. You sign up for an account and agree to their terms of service, then six months later an email drops into your spam folder saying "We've updated the terms; continuing to use the service constitutes agreement to these terms." They don't renegotiate, they don't ask if you agree, that's all just assumed.
(Score: 2) by maxwell demon on Wednesday August 23 2017, @05:04AM
They can do this because there was a clause in the previous version that stated it explicitly. That is, when you accepted the original terms, you also accepted that they may change the terms whenever they want. I'm pretty sure if they didn't include that clause in the original terms, later changes without your explicit agreement would not be allowed. Similarly, they certainly don't include a clause that you may change the terms as you see fit, therefore I'm pretty sure if you just sent them an email telling them "I changed the terms of service in that and that way; if you continue to provide the service that counts as implicit acceptance" that wouldn't work.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by FatPhil on Wednesday August 23 2017, @08:34AM (6 children)
Your tale seems to be making the second player the corrupt one, the computer in a webshop. This tale is "You modify the contract, sign it, and hand it back. Player 2 signs it." which is very different.
Depending on the lengths that were gone to in order to wrangle the deal (anything more than editing a human-visible field on a page would probably constitute a deliberate intent to defraud), I'd say this looks like a case of "the computer fucked up". If the shop feels hard done by, it should try to sue whoever it got its crappy webshop software from. If that company goes bust, good, it's shitty software is bringing down what's left of the good name of real programmers.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by maxwell demon on Wednesday August 23 2017, @06:28PM (5 children)
No, in every online shopping system I know, the shop makes the offer and I can accept.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by Justin Case on Wednesday August 23 2017, @07:05PM (3 children)
I don't think we have the details of this "attack" but the way it usually goes is something like this:
Website: Please buy my WIDGET for $100.
User: I want the WIDGET but I think the price should be $0.
Website: OK.
Perhaps this was a stupid response from the website, but it is up to the website to enact Lowe's business logic.
To put it another way, it is not "unauthorized access" to a website when the website explicitly accepts, approves, and responds positively to your request.
(Score: 2) by maxwell demon on Wednesday August 23 2017, @08:00PM (2 children)
We must visit different web sites. I wouldn't have an idea where I could suggest a price.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by Justin Case on Wednesday August 23 2017, @11:18PM (1 child)
Just because you don't know how doesn't mean nobody knows how.
This is a common mistake made by web site developers. "I can't imagine a way to abuse this, so there's no need to validate the data."
(Score: 2) by maxwell demon on Thursday August 24 2017, @05:46AM
So you admit they abused an error in the programming. Thus it's the equivalent to my scenario. Note that you are not making a contract with the computer; a computer cannot ever be a legal agent. The computer is only a means, and they used a programming error to make the computer do something the shop owner did neither intend nor approve of.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by FatPhil on Thursday August 24 2017, @03:24PM
Why should web-shopping be different? Citation requested if you're claiming contract law applied differently to them.
A quick google search implies that they're the same. Check the terms and conditions - they might say that the offer/order is only accepted, the contract concretised, when the order is dispatched.
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 1) by Virindi on Tuesday August 22 2017, @06:43AM (1 child)
The difference is, in this particular situation, is it reasonable for the "buyer" to believe that they were actually making such a deal? Or does the "buyer" think they are deceiving the website and getting something against the will of the company?
The crimes she is charged with require this intent. By her actions, the prosecutor believes it is obvious that she knew that the site did not actually intend to make such a sale, but rather, she was tricking them into getting merchandise that did not rightfully belong to her.
Criminal law is all about intent, not the technical form of the interaction.
(Score: 2) by FatPhil on Wednesday August 23 2017, @08:37AM
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by FakeBeldin on Tuesday August 22 2017, @08:48AM
That's what one side alleges. The other side seems to claim it went something more akin to:
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @01:33AM (2 children)
It never ceases to amaze me how stupid people like this are. If you find an exploit like this and actually want to use it, it would be smarter to only use it occasionally over a long period of time, and not to sell the merchandise online (which leaves behind evidence). Even if the exploit is eventually fixed, that's better than getting caught like an idiot.
(Score: 0) by Anonymous Coward on Tuesday August 22 2017, @05:05PM (1 child)
No, you only do it once. Never tell the same lie twice.
Fortunately this type of criminal is usually pretty stupid, and does the same thing over and over again until people notice the pattern.
(Score: 2) by maxwell demon on Wednesday August 23 2017, @08:05PM
How do you know? You only know of those who get caught, that's a pretty hefty selection bias.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by Whoever on Tuesday August 22 2017, @01:50AM (2 children)
So is this like the pudding guy, who spent about $12,000 on pudding snacks and got over $100,000-worth of flights (and a large tax deduction) out of it?
(Score: 4, Informative) by drussell on Tuesday August 22 2017, @03:05AM (1 child)
Hoover basically went out of business when their UK division gave away the free flights with the purchase of a vacuum (where they obviously though that not enough people would redeem the reward but the reward was worth more than the vacuum!)....
(Score: 5, Funny) by Azuma Hazuki on Tuesday August 22 2017, @03:35AM
Oh, that's what happened to them. Well that sucks.
I am "that girl" your mother warned you about...
(Score: 2) by arcz on Tuesday August 22 2017, @05:32AM
They used a credit card, and for some reason Lowes didn't check the card's credit limit before allowing the purchases to go through.
(Score: 3, Insightful) by FakeBeldin on Tuesday August 22 2017, @08:57AM
Robbery isn't theft, stealing isn't defrauding, etc.
Semantic games aside, ordering over $200k in goods without having to pay goes well beyond any reasonable expectation of "that's just how the world works". If you then also engage in selling the goods on yourself, you bloody well know that that's not how the world works - you're not giving away those goods for free, are you?
I don't know how the USA laws view such things legally, which may give them an out.
(Score: 1) by pTamok on Tuesday August 22 2017, @09:59AM (4 children)
I guess it will depend on the details.
There's a concept of reasonable expectations. I don't think, for example, specially crafted http requests, edited cookies, or exploiting lack of input validation would be regarded as legitimate shopping. Give-aways would normally be well signposted.
To use a real-world analogy: if Lowe's left their doors accidentally unlocked over a holiday period, and people went in and helped themselves to whatever was on the shelves, would that be stealing? Exploiting someone else's mistakes for personal gain is, if nothing else, shady practice. Some people regard exploiting marks as entirely legitimate. I don't.
(Score: 2) by aclarke on Tuesday August 22 2017, @11:46AM (3 children)
If Lowes left their doors open and I walked in, I'd call that stealing.
If I was given a coupon that said "100% off lawnmower" and I went in and got a free lawnmower, I'd do that in a heartbeat. That's their problem, not mine, and I am not going to judge their intent. Perhaps they have a reason why they're considering that a loss leader in some way. Companies do weird things sometimes.
If Lowes printed a "50% off lawn ornaments" coupon and I used it for "100% off lawnmower", I'd consider that immoral. I wouldn't do it, in the same way that if I discovered I was given too much change back, I'd let the cashier know.
I don't know what the law says, but to me those are the ethical lines.
(Score: 2) by Fnord666 on Tuesday August 22 2017, @01:47PM
Now to make this a closer analogy, let's say you use photoshop to create your own coupon and you happen to find an employee willing to honor it. The intent is now much more clear.
(Score: 2) by VLM on Tuesday August 22 2017, @08:09PM (1 child)
My guess based on some client interaction and working retail decades ago is the company refund / deal codes are pants on head retarded.
Customer service is supposed to be able to deduct $100, $200, whatever from an order to pay back a legit customer for a problem. Oh you ordered $5000 of lumber for your deck and two pieces are unservicable sry sir have code WTF501234 which entitles you to $50 off on your next order. And the next call for $50 off is WTF501235, you get the idea. Take a guess how much the refund is for code WTF256789, why thats $25 off serial number 6789
Now someone out there can order a pallet of driveway salt online and take a wild ass guess that code WTF001500 is pre-loaded for $50 off.
Obviously this is WAY more fun for applying 100 refund cards on one order, or refund codes worth $2500 not $50. But its the same general idea.
Some coupon codes are just dumb encodings, not exactly a SHA256 hash. Taking a very recent example, so you can get 10% off at papa murphys pizza using tmobile10 and some rocket surgeon out there posts that tmobile50 takes ... 50% off your pizza. There's whole subreddits devoted to this kind of code trading.
(Score: 2) by FakeBeldin on Wednesday August 23 2017, @01:24PM
True, though I have yet to see a "coupon" for a 100% discount. And even if I did, to me there's a huge distinction between "I was given code DISCOUNT10, let's try DISCOUNT25" and "I have code DISCOUNT10, let's try DISCOUNT100".