Accessing Publicly Available Information on the Internet Is Not a Crime • Hacker News Board

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#291

Post by serpentstar » Fri, Dec 15, 2017, 9:09 PM UTC

laderach wrote: post #43

This is incredibly important. If you dig deep into why LinkedIn is behaving the way it is, it is definitely not an attempt into protecting users' privacy. It's all about maintaining and expanding the ways it can monetize the data that users provide. This is the type of thing that we risk loosing as the internet matures and internet companies with vested interests gain more power. Setting this type of precedents will…

This isn't so much about red tape stifling innovation--that's the capitalist take on things, typical of HN. The real concern is that they're trying to criminalize the legitimate exercise of personal freedom. LinkedIn should be labeled as an enemy of the people, for trying to corrupt the laws of the land to this purpose.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#292

Post by azernik » Fri, Dec 15, 2017, 10:12 PM UTC

gwbas1c wrote: post #168

ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

In general, the law is capable of dealing with this kind of issue - it can look at the intent of the owner of the service.

cf. for example the law on trade secrets. If you take "reasonable steps" to safeguard the secret, and impose NDAs on the people you do grant access, then courts will punish competitors who steal them, even if your security happens to suck.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#293

Post by fjsolwmv » Sat, Dec 16, 2017, 4:03 AM UTC

ben_w wrote: post #272

alexdoma wrote: post #210

Earlier quoted context omitted.

What would be a better solution, IP address check to allow only known google crawlers perhaps?

That practically invites them to present a different page to google as to a normal user, the former pure SEO, the latter perhaps pure advertising.

And Google will happily deindex the site as soon as they find out

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#294

Post by k3a » Sat, Dec 16, 2017, 11:40 AM UTC

I think scraping for personal use (not honorig robots.txt) should always be legal unless you are attempting DOS. You are accessing public information, the server is returning HTTP200 and it doesn't matter if you do so using a browser, phantomjs or curl with -A parameter.

A different situation would be scraping a website to make business. Worst being directly using the data - for example those StackOverflow clones with original data doesn't sound ok to me. I am not sure what to think about bots doing various derived work like stats and analysis. I think that if they are part of a business, making money, it shouldn't be legal unless those request are permitted by robots.txt.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#295

Post by ProdigalXiao » Sat, Dec 16, 2017, 6:11 PM UTC

Yes, it's not a crime previously for both the providers and the viewers; however, viewers unofficially announce or utility public information is plagiarism

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#296

Post by scooble » Sat, Dec 16, 2017, 9:46 PM UTC

MereInterest wrote: post #251

rtpg wrote: post #243

Earlier quoted context omitted.

The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?" I would definitely want some intent provisions in, but saying something is accessible therefore free game seems too wide.

> The real life equivalent of this is "if I leave my door unlocked, should someone be allowed to walk in anyways?" The problem with analogies is that many equally valid analogies that can be made, but with many different points. I would argue that the real life equivalent is "Have this free book, but you may not read Chapter 4."

Or putting up a poster that only some people are allowed to look at (or that the google maps car isn't allowed to photograph).

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#297

Post by ben_w » Sun, Dec 17, 2017, 1:55 AM UTC

fjsolwmv wrote: post #293

ben_w wrote: post #272

Earlier quoted context omitted.

That practically invites them to present a different page to google as to a normal user, the former pure SEO, the latter perhaps pure advertising.

And Google will happily deindex the site as soon as they find out

Raising an interesting question: can a website owner (use the law to) ban google from accessing their website by any mechanism other than their crawler in order that google doesn’t find out?

Sure, obviously limited utility just like “the right to be forgotten”s flaw of diffing USA internet from EU internet to find specifically what people want forgotten, but shenanigans interest me.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#298

Post by tonyarkles » Sun, Dec 17, 2017, 3:15 PM UTC

shkkmo wrote: post #185

gwbas1c wrote: post #168

Earlier quoted context omitted.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

> Careful, this could legitimize things like accidental denial of service. Are you saying that the writers of a bot that causes accidental issues with a site due to poor development standards on that site should spend years in prison with a federal felony conviction?

A while ago I was introduced to a client whose site "was the target of hackers that were deleting all of the content from the CMS". Here's what I discovered:

- the password verification form to access the admin area did the verification check in JavaScript, not on the backend. So if you have JS disabled and click "Submit" on the Admin login form, you're into the admin area.

- the "delete" button in the admin area was implemented as an that simply did a GET request (violating the idempotent nature of GET requests).

Looking at the logs, it was pretty clear who the "hacker" was: Google. They'd come, follow all of the links, make their way into the admin site, and follow all of the delete content links.

I consider the work that the original developers did to be grossly negligent, and I certainly don't fault Google for anything.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#299

Post by posterboy » Thu, Dec 21, 2017, 9:00 AM UTC

buttcoinslol wrote: post #130

ColanR wrote: post #95

Earlier quoted context omitted.

well, 'breaking and entering' in the US requires that something (i.e., the door) actually be broken in the process of entering the house...otherwise that charge doesn't apply.

Fun aside: breaking and entering is referred to as such in English Common Law because criminals used to bust through the wattle and daub walls to break in, thus housebreaking, or breaking and entering. [1] [1] https://books.google.com/books?id=77y2AgAAQBAJ&pg=PA229&lpg=...

The more you know!