Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

201–210 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#201

Post by __jal »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

Unless I'm missing something, you're proposing criminal penalties for tort liabilities.

Yes, if my crappy software costs you money by knocking your site offline by accident, I should make you whole.

I think it has to be something substantially more impactful, clearly intentionally malicious, or in some other way much worse than aggressive timeouts before we start thinking criminal penalties.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#202

Post by [deleted] »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#203

Post by feelin_googley »

Here is an example of the "good bot"/"bad bot" nonsense in action.

This is an article about the LinkedIn v hiQ case at AdWeek.

  curl --user-agent INSERT_ANYTHING_HERE http://www.adweek.com/digital/rami-essaid-distil-networks-guest-post-linkedin-hiq-labs/
It seems AdWeek can distinguish a "good bot" from a "bad bot" irrespective of the behavior of the user^W bot, i.e., whether it is one single HTTP request or 10,000 consecutive requests is irrelevant.

How do they do it?

Pattern match against the User-Agent string.

Effective shibboleth.^W engineering.

Clarification: If a user, not a "bot", makes the "wrong" choice of user-agent string (e.g. in the browser settings), then they will be labeled a "bad bot", even if their behavior is no different than other users who are not labeled "bad bots". For example, they make one HTTP GET request just like any other user. There are databases of "acceptable" user-agent strings available to anyone. If still unsure about the point I am making, see this post from several days ago: https://www.sigbus.info/software-compatibility-and-our-own-u...

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#204

Post by ouid »

__jal wrote: post #201
da_chicken wrote: post #198

Earlier quoted context omitted.

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

Unless I'm missing something, you're proposing criminal penalties for tort liabilities. Yes, if my crappy software costs you money by knocking your site offline by accident, I should make you whole. I think it has to be something substantially more impactful, clearly intentionally malicious, or in some other way much worse than aggressive timeouts before we start thinking criminal penalties.

either I read it wrong the first time as well, or he edited it, but reading it now it clearly says "while opening it" which is a criminal act, in context.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#205

Post by ouid »

ikeboy wrote: post #14
diggan wrote: post #12

Earlier quoted context omitted.

> robots.txt violations being considered hacking Hm, I disagree. Either information is public, no matter for who. Or the information is private, and you should have ACL for accessing the information. I don't think it's fair to say that information is public if you're a human but private if you're a machine, or vice versa. It's not about if it's difficult to build but rather the principle behind if you can just allow…

Why is discriminating against robots unfair? There are valid reasons (for instance, robots take a lot of resources to serve and don't lead to revenue).

my browser is a robot that renders your page.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#206

Post by dec0dedab0de »

odorousrex wrote: post #181
gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

>A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect, caused a major problem! This is a failure on the part of the developers at that "major internet site". Using a guid instead of consecutive IDs, a rate limiter, hell even just a cache...or all of the above. There are lots of solutions here. You have to take ro…

No, that is a failure of the developer of the scraper. I am definitely pro scraping, but you have to be a good neighbor.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#207

Post by dec0dedab0de »

cmiles74 wrote: post #200
ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

Honoring the robots.txt file is voluntary and ignoring it should in no way be considered hacking. I would go so far as to say that any activity that someone could engage in, simply by loading a URL, should in no way be considered hacking. Not only does it make it way too easy to prosecute software developers, it really devalues the term "hacking".

Sometimes you can do SQL injections just by loading a URL

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#208

Post by timthorn »

pdpi wrote: post #186
timthorn wrote: post #176

Earlier quoted context omitted.

No, it's unlawful, not illegal.

Definition of illegal: not according to or authorized by law : unlawful, illicit; also : not sanctioned by official rules (as of a game) ( https://www.merriam-webster.com/dictionary/illegal )

In legal terms, illegal and unlawful are not synonymous. In the UK, trespass is only illegal in certain circumstances: https://cps.gov.uk/legal-guidance/trespass-and-nuisance-land

Beyond that, it's only unlawful.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#209

Post by cmiles74 »

dec0dedab0de wrote: post #207
cmiles74 wrote: post #200

Earlier quoted context omitted.

Honoring the robots.txt file is voluntary and ignoring it should in no way be considered hacking. I would go so far as to say that any activity that someone could engage in, simply by loading a URL, should in no way be considered hacking. Not only does it make it way too easy to prosecute software developers, it really devalues the term "hacking".

Sometimes you can do SQL injections just by loading a URL

Perhaps that shouldn't be construed as hacking either. If I send a link to someone via email, they shouldn't need to worry about breaking the law if they click it.

I do think that a company who has been victim of a SQL injection attack will have a better chance in court then, say, LinkedIn in this specific case. At least this theoretical company has made some small effort to protect their data, however inept.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#210

Post by alexdoma »

feelin_googley wrote: post #203

Here is an example of the "good bot"/"bad bot" nonsense in action. This is an article about the LinkedIn v hiQ case at AdWeek. curl --user-agent INSERT_ANYTHING_HERE http://www.adweek.com/digital/rami-essaid-distil-networks-guest-post-linkedin-hiq-labs/ It seems AdWeek can distinguish a "good bot" from a "bad bot" irrespective of the behavior of the user^W bot, i.e., whether it is one single HTTP request or 10,000 co…

What would be a better solution, IP address check to allow only known google crawlers perhaps?
Post reply on HN