Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

91–100 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#91

Post by remir »

whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

You can find some documents from https://foipop.novascotia.ca in Google cache, so should Google be sued too?

Re: Teenager facing prison for downloading unsecured files from government website

#92

Post by itronitron »

pasbesoin wrote: post #31
sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Instead of effectively designing and administrating their systems, "the powers that be" are taking the "rubber hose, lead pipe" approach. Creating in "law", what they are too distracted and incompetent and egotistical and tight-fisted (tech is a "cost center") to create in fact and systems. They are, in essence, trying to redesign the nature of the Internet by fiat. Historically, accessible resources are accessible.…

^^^^^^^ [edit] clarifying to point out that I fully agree and have nothing more to add

Re: Teenager facing prison for downloading unsecured files from government website

#93

Post by UncleEntity »

eboyjr wrote: post #64
dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

More like finding a classified FBI interrogation manual in the Library of Congress...

Ok, not actually a metaphor -- https://www.motherjones.com/politics/2013/12/fbi-copyrighted...

Re: Teenager facing prison for downloading unsecured files from government website

#94

Post by rayiner »

sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

This seems more like a failure to develop proper social norms with regard to Internet information.

> If the information is not supposed to be public, it should not be reachable without authorization or authentication.

I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property. It is obvious what parts you're supposed to see and what parts you're not supposed to see. You should be able to prosecute snoops as an alternative to locking things down, as you would with any other private property.

Re: Teenager facing prison for downloading unsecured files from government website

#95

Post by zupa-hu »

Couldn't it be argued that clicking links on a web page are no different from changing an ID in the URL?

Web pages contain loads of URLs. You can't tell if you have the right to access the content behind it. The URL itself is simply an address to something - or nothing (404).

Having an ID in the URL is a compact way of signaling a huge list of URLs.

Thus, the kid simply followed links published on the website.

Re: Teenager facing prison for downloading unsecured files from government website

#96

Post by whack »

gcommer wrote: post #61
whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

That analogy assumes a lot about how hard/hidden obvious id numbers in URLs are. I'd counter that this situation is more like "putting your stuff on the curb and being mad when people take it". Rather than scapegoat the kid, the government should be investigating themselves for criminal negligence.

> "That analogy assumes a lot about how hard/hidden obvious id numbers in URLs are"

Well, I did give 2 different analogies, and without knowing more specifics, I'm not taking a stand on which analogy better fits this case. Depending on the specific design the government used, and the steps the teenager took to access the content, either analogy could be applicable.

> "Rather than scapegoat the kid, the government should be investigating themselves for criminal negligence."

That's a false dichotomy. Investigating government officials for negligence shouldn't preclude prosecuting a (hypothetical) malicious hacker.

Re: Teenager facing prison for downloading unsecured files from government website

#97

Post by ddingus »

dustingetz wrote: post #48
sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

It is not quite like that though.

More like, All items on this table are free.

So far, so good.

Then someone included a couple that aren't free.

Writing a line of code to fetch a batch of info is ordinary to a literate user.

Putting some burden on him to understand that has happened is a very hard sell to me.

Re: Teenager facing prison for downloading unsecured files from government website

#98

Post by [deleted] »

whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

[deleted]

Re: Teenager facing prison for downloading unsecured files from government website

#99

Post by slavik81 »

dv_dt wrote: post #40
sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?

A couple years ago, I asked Michael Geist[1] a similar question.

Me: I am a Canadian citizen and am rather concerned by what appears to be increasing online censorship and erosion of privacy rights in Australia and the UK. If it can happen there, it can happen here. I'd like to do my part to ensure that we can effectively oppose bad public policy when it's proposed in Canada. I deeply respect both the EFF and the ACLU for their work in the United States, but I'm not familiar with equivalent organizations for Canada. Do you have any suggestions as to where should I be sending my holiday donations?

Michael Geist: Thanks for your note. There are several groups in Canada that do great work on these issues:

1. CIPPIC - the Canadian Internet Policy and Public Interest Clinic (cippic.ca). I founded this tech law clinic at the University of Ottawa, the only one of its kind in Canada.

2. Open Media - based in Vancouver

3. CCLA - the Canadian Civil Liberties Association

4. CJFE - Canadian Journalists for Freedom of Expression

5. BCCLA - BC Civil Liberties Association

All do great work with limited resources.

[1]: http://www.michaelgeist.ca/

Re: Teenager facing prison for downloading unsecured files from government website

#100

Post by gruez »

Someone1234 wrote: post #29
politician wrote: post #18

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

>Many UUIDs aren't secure either and can be trivially enumerated.

uuidv4

Post reply on HN