Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

191–200 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#191

Post by cabaalis »

ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

I was about to agree that robots.txt prohibitions should be considered a form of authorization.

But I think what is being argued is that "if it's publicly available on a URL, it's available for any client to download and use." I think the latter argument holds more water, as since they are making it publicly available it is implicit authorization.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#192

Post by IncRnd »

jimktrains2 wrote: post #182
IncRnd wrote: post #171

Earlier quoted context omitted.

I agree with your premise. I'm just reaching a different conclusion. As a permission issue, the bot _may_ have been authorized and authenticated, however the company was sent a C&D letter that revoked all authorizations. That is why I say that logging in and accessing the resources did not constitute authorizations. If a C&D letter would not have been sent, I think I'd agree with you.

You can't prevent me from looking in your window though, at a sign you put up for people to look at none-the-less, with a C&D.

Agreed. That's why I made my earlier comment, that this is closer to your entering a store (not just looking in the window) and examininb the merchandise after you already had been sent away for trespassing, revoking all authorization.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#194

Post by jasonlotito »

jimktrains2 wrote: post #56
jasonlotito wrote: post #47

Earlier quoted context omitted.

FTA: "LinkedIn sent hiQ cease and desist letters warning that any future access of its website, even the public portions, were “without permission and without authorization” and thus violations of the CFAA." They were formally told to leave the coffee shop and not return.

No, they were told to stop looking in the window. Can you ask someone not to look at the menu you posted in your sidewalk window? I don't think that'd hold up in court.

Now you are just changing your analogies because you didn't read the article.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#196

Post by 33W »

jstarfish wrote: post #157
ikeboy wrote: post #126

Earlier quoted context omitted.

You can put up a "no trespassing sign" on your property (although there's some debate as to how much that actually counts for - a quick search pulls up https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... )

Robots.txt is not a 'no-trespassing' sign. Robots.txt is a 'whites-only' sign. The information is available to the public, just not for certain classes. This is and should be legally unenforceable. If something is truly meant to be private it should not be referenced from a public-facing page or it should have access control enabled.

Maybe it's closer to a No Trespassing sign, written in a language that only certain classes will understand.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#197

Post by cmiles74 »

rblatz wrote: post #107
cmiles74 wrote: post #48

Earlier quoted context omitted.

The poster is arguing that if you make a request from LinkedIn's website and it returns a "200" along with data, then you've accessed that data lawfully and LinkedIn has agreed to serve it to you; I tend to agree. If they don't want to provide data to hiQ, they should, well, stop providing data to hiQ. There are many ways to do this short of claiming that hiQ doesn't have permission or authorization, an argument stri…

How is that any different than walking up to a store entrance with automatic doors and a sign that says "Welcome" on it?

Well, for one it's not a physical store nor a physical entrance and there is no sign that says "Welcome". I don't think the analogy is helping to make anything more clear... It's possible it's making things more confusing.

In my opinion, the bottom line is that if LinkedIn doesn't want to serve data to this company, then they should immediately cease doing so using the many well established means available to them.

For LinkedIn to claim that following a URL and downloading the data is somehow "hacking their website" is entirely ludicrous. I understand they had a lawyer tell this company that they didn't want them to visit the URL, but I don't see how that somehow turns lawful web browsing into illegal hacking.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#198

Post by da_chicken »

abpavel wrote: post #180
gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes.

You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#199

Post by cmiles74 »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email address. He supplied a range of valid ICC-IDs and scraped the returned addresses. He was eventually convicted[1].

[0]: https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-...

[1]: https://www.wired.com/2013/03/att-hacker-gets-3-years/

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#200

Post by cmiles74 »

ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

Honoring the robots.txt file is voluntary and ignoring it should in no way be considered hacking. I would go so far as to say that any activity that someone could engage in, simply by loading a URL, should in no way be considered hacking.

Not only does it make it way too easy to prosecute software developers, it really devalues the term "hacking".

Post reply on HN