Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

151–160 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#151

Post by FilterSweep »

da_chicken wrote: post #110
andrewstuart2 wrote: post #86

Earlier quoted context omitted.

Is it even comparable to an unlocked door, though? To me it seems a lot more like leaving something on the front of your house and trying to prosecute when someone takes a picture of it. Nothing is removed or destroyed, and nothing was hidden or publicly unavailable.

And, technically, you did essentially request access. An anonymous HTTP request doesn't have to be honored by the web server.

Yep, you two are correct. Like ct0 said, companies are currently saying "We are saying 'come in' to bots but we want to pursue them legally as well."

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#152

Post by talmand »

UncleEntity wrote: post #145
tomp wrote: post #136

Earlier quoted context omitted.

You mean, you're not allowed to distributed non-transformed copies of the photo?

Nope https://petapixel.com/2017/10/14/photos-eiffel-tower-night-i...

In that article, and the snopes article it links to, it is implied that it is illegal to even take the picture. But then I fail to actually see where it is implicitly stated that it is illegal to take the picture. I can understand the copyright claim on publishing said photos, because that's actually the case for lots of things that can be viewed in public, but not taking the photo itself.

I really wish articles would refrain from potentially untrue clickbait headlines, but oh well.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#153

Post by rblatz »

mrguyorama wrote: post #128
rblatz wrote: post #107

Earlier quoted context omitted.

How is that any different than walking up to a store entrance with automatic doors and a sign that says "Welcome" on it?

Those doors get turned off at night, just like a server can ignore an HTTP request

They can turn the servers off at night too. Some places still choose to do that. But that is unrelated to the point, if you are told that you are no longer welcome at a business, you can’t come in without it being considered trespassing. The doors automatically opening for you (200 Ok) doesn’t matter. If you wear a disguise (change ip) doesn’t matter. You can’t go in.

Also I would agree that absent a specific order to stop accessing publiclly available server resources, there is an explicit permission to do so. So I’m the case of Weev I think he did nothing wrong, AT&T were the ones in the wrong.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#154

Post by talmand »

PatientTrader wrote: post #5
FilterSweep wrote: post #3

> LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true Protect them from what, your unlocked front door ? [0][1] [0] "Hackers selling 117 million LinkedIn passwords" http://money.cnn.com/2016/05/19/technology/linkedin-hack/ind... [1] http…

> I'd also note that these companies are barely (if ever) held liable for life-compromising hacks on their platforms. You do know it is impossible to stop all cyber attacks? Its always a matter of when, not if. Zero day attacks are developed everyday with not even the best funded cyber security systems able to thwart them. The geniuses are on the offensive side, if they want in, they will get in.

Silly; it's impossible to stop all murders, therefore we shouldn't bother with making it a legal liability.

If the criteria is that it must be possible to stop all instances of an action to make it a legal issue, then we should just shut down all the prisons.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#155

Post by choward »

rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

Are you just trying to play devil's advocate or do you really believe this? With HTTP, you're requesting access and then the server gives you the some information. It's up to the server to decide to give you the information. If the server doesn't give you the info, you can try to hack it but you might be breaking the law.

Same with a cafe. You can request access and the cafe can turn you away or serve you. If they turn you away and you refuse to leave, then you are breaking the law (like hacking).

Basically if I request something from you and you give it to me, that's your problem, not mine.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#156

Post by talmand »

mnw21cam wrote: post #10
PatientTrader wrote: post #5

Earlier quoted context omitted.

> I'd also note that these companies are barely (if ever) held liable for life-compromising hacks on their platforms. You do know it is impossible to stop all cyber attacks? Its always a matter of when, not if. Zero day attacks are developed everyday with not even the best funded cyber security systems able to thwart them. The geniuses are on the offensive side, if they want in, they will get in.

From my random perusal of the various reports of compromises over the last few years, my impression is not that organisations tend to get hacked using the latest zero-day vulnerability, but rather that organisations get hacked because they have glaring security holes that you could drive a double-decker bus through. For example, bcrypt has been around for how long now? And don't almost all the reports of hacks report…

I keep plaintext passwords, but I reverse the string to prevent the hackers.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#157

Post by jstarfish »

ikeboy wrote: post #126
bambax wrote: post #89

Earlier quoted context omitted.

> I'm fine with robots.txt violations being considered hacking Really?? That would mean private corporations, or private citizens, can write laws.

You can put up a "no trespassing sign" on your property (although there's some debate as to how much that actually counts for - a quick search pulls up https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... )

Robots.txt is not a 'no-trespassing' sign. Robots.txt is a 'whites-only' sign.

The information is available to the public, just not for certain classes. This is and should be legally unenforceable.

If something is truly meant to be private it should not be referenced from a public-facing page or it should have access control enabled.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#158

Post by UncleEntity »

ynniv wrote: post #138
UncleEntity wrote: post #124

Earlier quoted context omitted.

No, but when they ask them to leave and they still take a coffee cup they are. But that's not the point, the point is it's possible to give something for free and also refuse to give it to everyone under any circumstance. They didn't give me a free cup of coffee and someone could reasonably mistake me for a homeless person based on my (lack of) fashion sense but that doesn't mean I could just reach over the counter a…

When a server sends you a response you aren't taking something, you are being given something. If the server thought you shouldn't have it, it wouldn't give it to you. How can you say that hiQ isn't allowed to have this, but everyone else is allowed to take as much as they like? All that will happen is hiQ will create a string of shell companies that accesses LinkedIn as their proxies, and you will be wasting the cou…

> When a server sends you a response you aren't taking something, you are being given something. If the server thought you shouldn't have it, it wouldn't give it to you.

That's not even a rational argument, ask some hacker sitting in prison how well that one went over.

> How can you say that hiQ isn't allowed to have this, but everyone else is allowed to take as much as they like?

Umm, private property? Terms of service? Take your pick...

> All that will happen is hiQ will create a string of shell companies that accesses LinkedIn as their proxies, and you will be wasting the court's time. Step zero is to establish that no one can have access unless authorized, and LinkedIn refuses to do this.

hiQ isn't fighting the validity of giving access to some people while denying them access to the very same data they are fighting a misapplication of a totally unrelated law (because it's the right thing to do).

This whole thing isn't about denying them access but "hiQ challenged LinkedIn’s attempt to use the CFAA as a tool to enforce its terms of use in court."

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#159

Post by ikeboy »

jstarfish wrote: post #157
ikeboy wrote: post #126

Earlier quoted context omitted.

You can put up a "no trespassing sign" on your property (although there's some debate as to how much that actually counts for - a quick search pulls up https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... )

Robots.txt is not a 'no-trespassing' sign. Robots.txt is a 'whites-only' sign. The information is available to the public, just not for certain classes. This is and should be legally unenforceable. If something is truly meant to be private it should not be referenced from a public-facing page or it should have access control enabled.

Except race /skin color is a legally protected class, and robots aren't (and why should they be? They can't enter into contracts, conduct business, etc. So it's perfectly legitimate to exclude them from a site where they cannot use it in the intended manner).

"If you truly didn't want trespassers you should've put up a gate."

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#160

Post by IncRnd »

jimktrains2 wrote: post #146
IncRnd wrote: post #144

Earlier quoted context omitted.

I'm not a lawyer, but I highly doubt that they could. It's also not what happened here.

Can you expand on the last part? I don't view a publicly accessible webpage as a protected private space, just as I do not view an ad posted in a (private) window as a protected public space.

Of course. My statement was predicated on the need for active network requests to obtain information. If the bot had passively listened to network traffic from LI, then I would argue for sameness with passively looking through a window.
Post reply on HN