Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

181–190 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#181

Post by odorousrex »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

>A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect, caused a major problem!

This is a failure on the part of the developers at that "major internet site". Using a guid instead of consecutive IDs, a rate limiter, hell even just a cache...or all of the above. There are lots of solutions here.

You have to take robot scraping and indexing into consideration, and assume people will ignore robots.txt. (Certain bots, i.e. msnbot/bingbot are quite aggressive!)

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#182

Post by jimktrains2 »

IncRnd wrote: post #171
jimktrains2 wrote: post #166

Earlier quoted context omitted.

What if it's dark and I shine a light on your ad in the window? (The issue at hand isn't DOS or resource-based, but permission.)

I agree with your premise. I'm just reaching a different conclusion. As a permission issue, the bot _may_ have been authorized and authenticated, however the company was sent a C&D letter that revoked all authorizations. That is why I say that logging in and accessing the resources did not constitute authorizations. If a C&D letter would not have been sent, I think I'd agree with you.

You can't prevent me from looking in your window though, at a sign you put up for people to look at none-the-less, with a C&D.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#183

Post by borplk »

da_chicken wrote: post #110
andrewstuart2 wrote: post #86

Earlier quoted context omitted.

Is it even comparable to an unlocked door, though? To me it seems a lot more like leaving something on the front of your house and trying to prosecute when someone takes a picture of it. Nothing is removed or destroyed, and nothing was hidden or publicly unavailable.

And, technically, you did essentially request access. An anonymous HTTP request doesn't have to be honored by the web server.

Exactly.

The bot says "GET /blah" and LinkedIn says "200 OK".

Not bot's fault.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#184

Post by Chickenosaurus »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Accidental denials of service are indeed a common occurrence. By the way, it's "etc" from latin et cetera - I assume you didn't want to refer to electro-convulsive therapy :-)

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#185

Post by shkkmo »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

> Careful, this could legitimize things like accidental denial of service.

Are you saying that the writers of a bot that causes accidental issues with a site due to poor development standards on that site should spend years in prison with a federal felony conviction?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#186

Post by pdpi »

timthorn wrote: post #176
pdpi wrote: post #99

Earlier quoted context omitted.

Still illegal, just not a crime.

No, it's unlawful, not illegal.

Definition of illegal: not according to or authorized by law : unlawful, illicit; also : not sanctioned by official rules (as of a game)

(https://www.merriam-webster.com/dictionary/illegal)

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#187

Post by icebraining »

Miner49er wrote: post #75

weev went to jail for accessing publicly available information from AT&T. There's not a great precedent here for the EFF, unfortunately.

It was only a jury decision by a lower court, it doesn't mean much in terms of precedent.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#188

Post by us0r »

mirimir wrote: post #26

So why didn't hiQ just operate from some jurisdiction where scraping is legal? And use VPN services to prevent blocking. I mean, the Internet is global. So why should US laws matter everywhere?

spamhaus did this and the spammer who sued them got a default judgement. when he went to seize their domain they suddenly cared about us laws.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#189

Post by megamindbrian2 »

So doing QA is a crime now?

Edit: adding context.

I'm doing QA to validate information collected by my recruiting company, both acting within Linkedin's terms of service for a paid subscription, and violating their terms of server by improving my own company's process. Like the article said: Linkedin wants to participate in an open internet and also abuse CFAA.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#190

Post by ikeboy »

FRex wrote: post #174
ikeboy wrote: post #132

Earlier quoted context omitted.

It contains User-agent: * Disallow: / I am pretty sure none of the standard libraries/ tools that respect robots.txt would continue after being fed that file. >throwing away information This is entirely irrelevant. If they receive data from someone they have no obligation to discard it because of the current status of robots.txt. The question would be if they should continue to actively scrape that website. It seems…

So we have an unclear "standard" that is only a de facto standard (and still varies in more advances directives between few big bots) that you're "pretty sure" about but that's seemingly not written down in its entirety anywhere and it'd also be enforced selectively depending on whether or not "someone particularly cares". Truly perfect and foolproof law that would be. And all this to protect some corp's business mod…

I disagree that laws that can only be enforced against US companies / people are worthless.

Requiring a human would increase costs and it doesn't seem like a good argument against anything.

Post reply on HN