Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

251–260 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#251

Post by MereInterest »

rtpg wrote: post #243
diggan wrote: post #12

Earlier quoted context omitted.

> robots.txt violations being considered hacking Hm, I disagree. Either information is public, no matter for who. Or the information is private, and you should have ACL for accessing the information. I don't think it's fair to say that information is public if you're a human but private if you're a machine, or vice versa. It's not about if it's difficult to build but rather the principle behind if you can just allow…

The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?" I would definitely want some intent provisions in, but saying something is accessible therefore free game seems too wide.

> The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?"

The problem with analogies is that many equally valid analogies that can be made, but with many different points. I would argue that the real life equivalent is "Have this free book, but you may not read Chapter 4."

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#252

Post by decasteve »

ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

Do Not Track compliance is even easier to build. Does the same logic apply?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#253

Post by [deleted] »

cmiles74 wrote: post #199
gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email address. He supplied a range of valid ICC-IDs and scraped the returned addresses. He was eventually convicted[1]. [0]: https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-... [1]: https://www.wired.com/2013/03/att-hacker-gets-3-years/

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#254

Post by sgtmas2006 »

chii wrote: post #248
diggan wrote: post #12

Earlier quoted context omitted.

> robots.txt violations being considered hacking Hm, I disagree. Either information is public, no matter for who. Or the information is private, and you should have ACL for accessing the information. I don't think it's fair to say that information is public if you're a human but private if you're a machine, or vice versa. It's not about if it's difficult to build but rather the principle behind if you can just allow…

> ACL for accessing the information the ACL is the robots.txt. A door with or without a lock doesn't determine whether the place is public or not.

if my bot is actually my cat actuating a switch for it to load a page, does it have to follow robots.txt?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#255

Post by rtpg »

MereInterest wrote: post #251
rtpg wrote: post #243

Earlier quoted context omitted.

The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?" I would definitely want some intent provisions in, but saying something is accessible therefore free game seems too wide.

> The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?" The problem with analogies is that many equally valid analogies that can be made, but with many different points. I would argue that the real life equivalent is "Have this free book, but you may not read Chapter 4."

Well I suppose both are possible, and it's on a case by case basis.

If I put on my website terms of service "please don't try to go everywhere" , and then you do... seems like you did _something_.

I don't really get what sort of stuff is enforceable, though.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#256

Post by [deleted] »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#257

Post by carterehsmith »

odorousrex wrote: post #181
gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

>A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect, caused a major problem! This is a failure on the part of the developers at that "major internet site". Using a guid instead of consecutive IDs, a rate limiter, hell even just a cache...or all of the above. There are lots of solutions here. You have to take ro…

>> This is a failure on the part of the developers at that "major internet site". Using a guid instead of consecutive IDs, a rate limiter, hell even just a cache...or all of the above. There are lots of solutions here.

You are right, but few organizations are sophisticated.. or wealthy enough to employ all of that. I mean, a couple years ago there was a thing that Google's Docs could be enumerated.

And that's Google, they can obiously afford to get competent people working on that, yet they made a mistake (and who doesn't?).

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#258

Post by askvictor »

Let us remember here that Microsoft owns LinkedIn. There's been a lot of love for Microsoft here recently (I'm among the many who are liking the 'new' MS). No doubt, this is quite a separate group to those doing OSS/Linux/Python/Jupyter/etc, but it's worth pausing to think about what a move like this says about their overarching corporate strategies.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#259

Post by euske »

Question. How this principle can coexist with the idea of "surveillance is bad"? Because that's mostly to collect publicly available information. Is it bad because it's done by a government? It's possible to set up a bunch of privately owned cameras in a city and keep filming people. Is it the association of infos that makes it bad and not mere collection? Is it okay if it doesn't have a personally identifiable information (but who knows what one can make out of them)? I don't know what I should think of this.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#260

Post by paulie_a »

FilterSweep wrote: post #3

> LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true Protect them from what, your unlocked front door ? [0][1] [0] "Hackers selling 117 million LinkedIn passwords" http://money.cnn.com/2016/05/19/technology/linkedin-hack/ind... [1] http…

My account was probably in that password dump. LinkedIn has yet to reach out to me, but will still spam me with people that are not on linkedin

Side rant: LinkedIn is a piece of crap in societal concept and implementation. Recently I was so frustrated by removing old connections I just simply deleted my account.

Warning: I am going to be crude at this point: linkedin is an HR circle jerk of pointlessness

Post reply on HN