Accessing Publicly Available Information on the Internet Is Not a Crime

Post by cmiles74 » Thu, Dec 14, 2017, 4:57 PM UTC

ikeboy wrote: post #58

cmiles74 wrote: post #51

Earlier quoted context omitted.

I don't believe there's a law requiring the honoring of the robots.txt file. People and services honor the file out of a sense of good manners, not a legal requirement.

It doesn't have to be a specific law. It is a rebuttal to a claim of "I had no idea I shouldn't have requested millions of pages from that site". If you scrape a site that prohibits it in robots.txt, that should be considered notice that they don't want that, for whatever relevant law. (I don't know if this argument would hold up in court, IANAL.)

Post by mcguire » Thu, Dec 14, 2017, 5:00 PM UTC

UncleEntity wrote: post #79

jimktrains2 wrote: post #39

Earlier quoted context omitted.

> How does a website put reasonable limits on access? 1) Blocking TCP connections 2) Returning a 4XX error, perhaps even "401 Authorization Required", "402 Payment Required", "403 Forbidden", or "429 Too Many Requests" > A regular B&M store can refuse service to disruptive people and trespass people who don't comply, why not servers? A Brick and Mortar store has to _tell_ you you're being banned. The mechanisms I lis…

> In this case, it's more like someone was looking in the store window from the public sidewalk and asked to stop. I think it's more like calling the store and asking them what their prices are 20 times a minute.

Post by ynniv » Thu, Dec 14, 2017, 5:01 PM UTC

UncleEntity wrote: post #93

ynniv wrote: post #70

Earlier quoted context omitted.

It is legal until you inform them they are trespassing and ask them to leave.

Where I live it is 100% legal to shoot them with no questions asked. 100% legal (castle doctrine) to shoot them, think about that for a minute, not generally legal to shoot someone engaging in a legal activity. --edit-- Also legal to shoot them through the door but probably not such a good plan...

   An intruder must be making (or have made) an attempt to unlawfully or forcibly enter an occupied 
     residence, business, or vehicle.
   The intruder must be acting unlawfully (the castle doctrine does not allow a right to use force 
     against officers of the law, acting in the course of their legal duties).
   The occupant(s) of the home must reasonably believe the intruder intends to inflict serious bodily 
     harm or death upon an occupant of the home. Some states apply the Castle Doctrine if the occupant(s) of the home 
     reasonably believe the intruder intends to commit a lesser felony such as arson or burglary.
   The occupant(s) of the home must not have provoked or instigated an intrusion; or, provoked/instigated 
     an intruder's threat or use of deadly force.

Post by deejaybog » Thu, Dec 14, 2017, 5:02 PM UTC

gkya wrote: post #49

mnw21cam wrote: post #10

Earlier quoted context omitted.

From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through. For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report…

I wish there was a "web security checklist" where if you ticked all the boxes, you can be pretty sure you have the well-known holes covered. This is why web frameworks are really useful, the decent ones get you way ahead in securing your application from the most common attacks. But if you self-bake, then you have to manage the entire complexity of the web platform.

Post by npsimons » Thu, Dec 14, 2017, 5:04 PM UTC

gkya wrote: post #49

mnw21cam wrote: post #10

Earlier quoted context omitted.

From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through. For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report…

I wish there was a "web security checklist" where if you ticked all the boxes, you can be pretty sure you have the well-known holes covered. This is why web frameworks are really useful, the decent ones get you way ahead in securing your application from the most common attacks. But if you self-bake, then you have to manage the entire complexity of the web platform.