Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

211–220 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#211

Post by jstarfish »

ikeboy wrote: post #159
jstarfish wrote: post #157

Earlier quoted context omitted.

Robots.txt is not a 'no-trespassing' sign. Robots.txt is a 'whites-only' sign. The information is available to the public, just not for certain classes. This is and should be legally unenforceable. If something is truly meant to be private it should not be referenced from a public-facing page or it should have access control enabled.

Except race /skin color is a legally protected class, and robots aren't (and why should they be? They can't enter into contracts, conduct business, etc. So it's perfectly legitimate to exclude them from a site where they cannot use it in the intended manner). "If you truly didn't want trespassers you should've put up a gate."

Bots being legally protected as a class or not, using robots.txt as the ultimate test of what distinguishes normal traffic from CFAA violations is a very flawed mechanism. It turns your website into a minefield.

As a property owner, a no-trespassing sign won't protect you from the lawsuits that result when a toddler drowns in your pool. You're expected to do more (like putting up that gate).

Equifax's systems are peppered with "no-trespassing" motds at login. They also have a robots.txt file. We expected them to do more.

Same for leaving keys in your ignition, guns unlocked on your nightstand, etc. "Don't touch" signs won't absolve you of responsibility when either gets stolen and used in a spree killing.

So yes, as the owner of any sort of asset, in most contexts it is your responsibility to implement access controls to keep unauthorized traffic out.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#212

Post by sp332 »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

I think you could be sued for damages, but that's not the same as a criminal case.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#213

Post by mirimir »

us0r wrote: post #188
mirimir wrote: post #26

So why didn't hiQ just operate from some jurisdiction where scraping is legal? And use VPN services to prevent blocking. I mean, the Internet is global. So why should US laws matter everywhere?

spamhaus did this and the spammer who sued them got a default judgement. when he went to seize their domain they suddenly cared about us laws.

Well, some domain registries are not under US control. Consider that TPB and Sci-Hub still have domain names.

And, if push comes to shove, one doesn't really need a domain.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#214

Post by granitosaurus »

us0r wrote: post #193

What makes this extra ridiculous is the fact LinkedIn built its business on scraping not publicly available information but private address books of unsuspecting users.

Not to mention the fact that linkedin was scraping private data in the case of contact scraping.

Linkedin is the biggest case of "we've got ours fuck everyone else" I've seen.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#215

Post by granitosaurus »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

lol, that's ridiculous. Then you could charge anybody for anything really.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#216

Post by paulus_magnus2 »

How about: if you want me not to scrape it, keep it off my internet??

Actually I'm considering building "API-fication" of websites with bindings for major languages (Java, Python, JS). With luck websites could participate by providing & maintaining a parseable API-sitemap.

This would open door to my 2nd project: orchestration a-la BPEL on top of websites. visual editor, macros, scripting. Call this PIPES 2.0

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#217

Post by yeukhon »

How do you draw a line between accessing disturbing contents such as child porn vs accessing a leaked document? It seems the former requires some additional moral take - what if the click was accidental and it was an attack? What if the person onlu watched but doesn’t possess the content?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#218

Post by jstarfish »

dec0dedab0de wrote: post #206
odorousrex wrote: post #181

Earlier quoted context omitted.

>A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect, caused a major problem! This is a failure on the part of the developers at that "major internet site". Using a guid instead of consecutive IDs, a rate limiter, hell even just a cache...or all of the above. There are lots of solutions here. You have to take ro…

No, that is a failure of the developer of the scraper. I am definitely pro scraping, but you have to be a good neighbor.

How the hell is the scraper dev supposed to anticipate how poorly-written these particular views are with no backend knowledge? If not an automated scraper, a thundering herd from content gone viral would trigger the same result.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#219

Post by exolymph »

cmiles74 wrote: post #199
gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email address. He supplied a range of valid ICC-IDs and scraped the returned addresses. He was eventually convicted[1]. [0]: https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-... [1]: https://www.wired.com/2013/03/att-hacker-gets-3-years/

And while Weev totally sucks as a person, IMO, it was wrong for him to be convicted in this case. He was punished from AT&T's negligence.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#220

Post by oh_sigh »

jimktrains2 wrote: post #39
UncleEntity wrote: post #25

How does a website put reasonable limits on access? I'm not saying what Linkedin is trying to do is right but it seems to me there needs to be a way to say "Dude, that's not cool." A regular B&M store can refuse service to disruptive people and trespass people who don't comply, why not servers? --edit-- Pretty much what rayiner is saying, they posted while I was typing.

> How does a website put reasonable limits on access? 1) Blocking TCP connections 2) Returning a 4XX error, perhaps even "401 Authorization Required", "402 Payment Required", "403 Forbidden", or "429 Too Many Requests" > A regular B&M store can refuse service to disruptive people and trespass people who don't comply, why not servers? A Brick and Mortar store has to _tell_ you you're being banned. The mechanisms I lis…

Looking in a window from a public place doesn't use any resources of the company being looked-upon.
Post reply on HN