Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

171–180 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#171

Post by IncRnd »

jimktrains2 wrote: post #166
IncRnd wrote: post #160

Earlier quoted context omitted.

Of course. My statement was predicated on the need for active network requests to obtain information. If the bot had passively listened to network traffic from LI, then I would argue for sameness with passively looking through a window.

What if it's dark and I shine a light on your ad in the window? (The issue at hand isn't DOS or resource-based, but permission.)

I agree with your premise. I'm just reaching a different conclusion.

As a permission issue, the bot _may_ have been authorized and authenticated, however the company was sent a C&D letter that revoked all authorizations. That is why I say that logging in and accessing the resources did not constitute authorizations.

If a C&D letter would not have been sent, I think I'd agree with you.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#172

Post by bo1024 »

Analemma_ wrote: post #125

I mentioned this before in a previous thread on this topic, but I can't support the EFF on this. This is, at the end, an argument against control over ones own data: LinkedIn might be doing sketchy things with your data, but it's all stuff you voluntarily agreed to in exchange for their service. If any shady data aggregator can vacuum it up and do whatever, I didn't consent to that and I'm not getting any benefit fro…

But the EFF isn't arguing that any shady aggregator should be able to vacuum up anything. LinkedIn would still have the full right and ability to implement limits, blocks, or so on to prevent this. LinkedIn could still make it against their terms of service and pursue a civil suit. It just would stop LinkedIn from being able to pursue felony hacking prosecutions against people for accessing a public webpage with a script.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#173

Post by bdamm »

gehwartzen wrote: post #165
da_chicken wrote: post #108

Earlier quoted context omitted.

Yes, it is. If you don't have a legal right to be on a piece of property, in a given structure, or in a vehicle, you're trespassing. If you used force to gain access to the property, vehicle or structure, it will often be considered breaking and entering. Typically, these laws use a very loose definition of "force" which includes opening an unlocked door. If you leave your door ajar, it's just trespassing. If you had…

What about walking up to someone's door and knocking to see whos home? What if there is a picket fence around the yard with a latched gate that you have to open to get to the front door?

In the only jurisdiction where I've actually read the trespass law, it stated that a "legal fence" was sufficient to indicate no trespass, and that a "legal fence" was any number of acceptable structures that were at least 4 feet high.

In that context, a wall of a house being at least four feet high, would carry an implicit "No Trespassing" sign on it, but the picket fence would not. However, if the property had an obvious path to an entryway, then walking up that path to the entryway was not trespass. So walking through a picket fence with a low-latch would not be trespass, unless the pickets were four feet high, or if the latch was locked.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#174

Post by FRex »

ikeboy wrote: post #132
FRex wrote: post #113

Earlier quoted context omitted.

That file includes at least two non-standard syntax extensions[0]. Robots is just a de facto standard and respect of some directives varies[1]. So much for it being 'not difficult' while the task is not even clear because there isn't even a clear standard. Archive.org also dislikes how robots.txt is being used mainly for search engines and goes against their mission in particular[2]. Are they now hackers for not thro…

It contains User-agent: * Disallow: / I am pretty sure none of the standard libraries/ tools that respect robots.txt would continue after being fed that file. >throwing away information This is entirely irrelevant. If they receive data from someone they have no obligation to discard it because of the current status of robots.txt. The question would be if they should continue to actively scrape that website. It seems…

So we have an unclear "standard" that is only a de facto standard (and still varies in more advances directives between few big bots) that you're "pretty sure" about but that's seemingly not written down in its entirety anywhere and it'd also be enforced selectively depending on whether or not "someone particularly cares". Truly perfect and foolproof law that would be.

And all this to protect some corp's business model of not letting others collect automatically the public information they provide, while they are free to use outdated or buggy software, store passwords in plaintext, etc. and get away with leaking data of millions of customers that should never be public.

And it'd fail to stop anyone except benign, private and low fund actors because instantly Indian (or other low wage country) services for "scraping by human thus not a bot ignoring robots.txt" would pop up, just like there are captcha solving services that employ humans already, and malicious bots wouldn't care anyway just like they make 0 effort to respect it now and run from servers in some country that isn't friendly towards USA so there is 0 potential for catching the perpetrators.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#175

Post by bdamm »

gkya wrote: post #38
PatientTrader wrote: post #5

Earlier quoted context omitted.

> I'd also note that these companies are barely (if ever) held liable for life-compromising hacks on their platforms. You do know it is impossible to stop all cyber attacks? Its always a matter of when, not if. Zero day attacks are developed everyday with not even the best funded cyber security systems able to thwart them. The geniuses are on the offensive side, if they want in, they will get in.

The industry is held to no standards at all. You can keep plain-text passwords in your databases, do no tests at all, and be incompetent in a million other ways. I usually get downvotes when I say this, but by now there needs to exist certain regulation on commercial software and software-based services. It should be ensured that certain practices are followed in security and ethics (do you take the basic, well known…

Certain industries are regulated, although the regulations are not consistent. It is not uncommon for jurisdictions to require by law protections on electric grid control equipment. For example, in some places in the US, servers that can ultimately affect a large scale change in power generation equipment (such as switching the configuration of a power plant) must have anti-virus installed on them (NERC-CIP).

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#176

Post by timthorn »

pdpi wrote: post #99
webignition wrote: post #83

Earlier quoted context omitted.

Under UK law, trespassing is a civil not criminal matter and so by some definition it is not illegal.

Still illegal, just not a crime.

No, it's unlawful, not illegal.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#177

Post by bdamm »

bambax wrote: post #89
ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

> I'm fine with robots.txt violations being considered hacking Really?? That would mean private corporations, or private citizens, can write laws.

They can anyway. That's what contracts are.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#180

Post by abpavel »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?
Post reply on HN