Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

41–50 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#41

Post by interfixus »

rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

Fine. I hereby forbid access by any entity owned, operated, or otherwise controlled by Microsoft Corporation to any internet server or service operated by me. Disregard of this interdiction shall be considered a crime, the digital equivalent of trespassing.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#42

Post by ynniv »

UncleEntity wrote: post #35
ynniv wrote: post #29

Earlier quoted context omitted.

Trespass is not illegal until the owner informs you that you are not wanted. Private information that has accidentally been made public is like an unmarked field. It may be private, it may be public, but until the owner takes specific action it is not illegal to use the field. If the owner decides to take action, that action cannot be retroactively applied, even if there is a record of who used the field. Regardless,…

The difference is Linkedin knows they're scraping the site, asked them to stop and is now trying to force them to stop through the courts (in a really bad way).

Google, Bing, etc are also scraping their site, and I see no cease and desist order there. Make Googlebot authenticate itself, or admit the data is publicly accessible.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#43

Post by laderach »

This is incredibly important. If you dig deep into why LinkedIn is behaving the way it is, it is definitely not an attempt into protecting users' privacy. It's all about maintaining and expanding the ways it can monetize the data that users provide.

This is the type of thing that we risk loosing as the internet matures and internet companies with vested interests gain more power. Setting this type of precedents will absolutely curtail innovation and freedom in the future. Think about it, would Google have been created in an environment that is overwhelmingly siloed and filled with red tape?

I see parallels to the net neutrality discussion in this.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#44

Post by joshuamorton »

interfixus wrote: post #41
rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

Fine. I hereby forbid access by any entity owned, operated, or otherwise controlled by Microsoft Corporation to any internet server or service operated by me. Disregard of this interdiction shall be considered a crime, the digital equivalent of trespassing.

And this is why we have judges and juries.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#45

Post by kodablah »

rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

I think this is a poor analogy. An argument/analogy like yours would allow me to say you trespassed with your eyeballs. That light travels one way or bytes another doesn't affect the spirit that you are looking at something that was made available to look at. Can I outlaw window shopping? My cafe is going to have a sign that says "If you are employed by a competing cafe and you don't close your eyes when walking by, I will attempt to have you jailed". Or I'll wait until they show a price comparison between their coffee and ours, then send a cease and desist to have them not look at my billboard anymore.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#46

Post by [deleted] »

cmiles74 wrote: post #32
rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

I find this argument to be a poor fit for the actual situation. The person that owns a coffee shop needs to let people physically enter their coffee shop in order to purchase coffee, snacks, etc. LinkedIn has no such requirement, they can easily require people establish and log into registered accounts in order to access their data. As you have said, their servers are their property and they have the ability to block…

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#47

Post by jasonlotito »

jimktrains2 wrote: post #30
rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

Sure, but if you're never told to leave the coffee shop or no action is taken to prevent you from entering again, say being told your banned, and you continue to walk in and use the coffee shop with no one saying anything, has your permission to enter really been revoked, even if the owner thinks, and only thinks, it has been?

FTA: "LinkedIn sent hiQ cease and desist letters warning that any future access of its website, even the public portions, were “without permission and without authorization” and thus violations of the CFAA."

They were formally told to leave the coffee shop and not return.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#48

Post by cmiles74 »

rayiner wrote: post #36
cybwraith wrote: post #28

Earlier quoted context omitted.

That's not a great analogy. The store owner can't just get your arrested/charged with a crime if they don't tell you that you aren't allowed first. Http lacks such a human mechanism. The closest thing I can think of in the standard is the response code. So your server replying 200 OK should implicitly be considered permission to access that resource legally until it stops replying with that code.

But that's exactly what happened here: > LinkedIn sent hiQ cease and desist letters warning that any future access of its website, even the public portions, were “without permission and without authorization” and thus violations of the CFAA. The EFF's point about terms of service is a good one, but also irrelevant. Terms of service don't provide adequate notice that someone's implied license to access a website has b…

The poster is arguing that if you make a request from LinkedIn's website and it returns a "200" along with data, then you've accessed that data lawfully and LinkedIn has agreed to serve it to you; I tend to agree. If they don't want to provide data to hiQ, they should, well, stop providing data to hiQ.

There are many ways to do this short of claiming that hiQ doesn't have permission or authorization, an argument strikes me as wholly without merit. If the data is publicly available on the internet then how is permission or authorization required?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#49

Post by gkya »

mnw21cam wrote: post #10
PatientTrader wrote: post #5

Earlier quoted context omitted.

> I'd also note that these companies are barely (if ever) held liable for life-compromising hacks on their platforms. You do know it is impossible to stop all cyber attacks? Its always a matter of when, not if. Zero day attacks are developed everyday with not even the best funded cyber security systems able to thwart them. The geniuses are on the offensive side, if they want in, they will get in.

From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through. For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report…

I wish there was a "web security checklist" where if you ticked all the boxes, you can be pretty sure you have the well-known holes covered. This is why web frameworks are really useful, the decent ones get you way ahead in securing your application from the most common attacks. But if you self-bake, then you have to manage the entire complexity of the web platform.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#50

Post by jimktrains2 »

rayiner wrote: post #36
cybwraith wrote: post #28

Earlier quoted context omitted.

That's not a great analogy. The store owner can't just get your arrested/charged with a crime if they don't tell you that you aren't allowed first. Http lacks such a human mechanism. The closest thing I can think of in the standard is the response code. So your server replying 200 OK should implicitly be considered permission to access that resource legally until it stops replying with that code.

But that's exactly what happened here: > LinkedIn sent hiQ cease and desist letters warning that any future access of its website, even the public portions, were “without permission and without authorization” and thus violations of the CFAA. The EFF's point about terms of service is a good one, but also irrelevant. Terms of service don't provide adequate notice that someone's implied license to access a website has b…

In the coffee shop example, would this be like trying to sue someone who is banned from your shop from looking in the window at your price list? In this case, it's more like LinkedIn is attempting to get a PFA order, but I think they need to show abuse, not just looking in the window at the menu you posted on the window?
Post reply on HN