Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

181–190 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#181

Post by ljm »

rayiner wrote: post #140
samatman wrote: post #138

Earlier quoted context omitted.

It... it is accessible from a link That's what a url with an id in it is a link

A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.

A link is nothing of the sort, it's a colloquial term that connects one point to another. It is not unique to HTML or programming in the slightest. In those terms a URL is always a link because the only practical reason for inventing the concept of a universal resource locator is to link one thing to another without them coming into conflict. There is no reason for a URL to exist except for it to be a link and it has nothing to do with the DOM.

Re: Teenager facing prison for downloading unsecured files from government website

#182

Post by prophesi »

rayiner wrote: post #175
hug wrote: post #151

Earlier quoted context omitted.

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, si…

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out.

Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.

Re: Teenager facing prison for downloading unsecured files from government website

#183

Post by asfasgasg »

jopsen wrote: post #155
Declanomous wrote: post #126

Earlier quoted context omitted.

It's not necessarily a problem that the older generation can only think about technology in a metaphorical sense, the problem is that the metaphors they are using are idiotic. I think, by and large, people are constrained to thinking about things they can describe. To that extent, being able to accurately describe something is meaningful, and is therefore a linguistic issue. Semantics are very important when you are…

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn'…

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong.

Agreed. There is no inherent or intrinsic reason to expect that any given document or any given URL ought to be restricted. However, a look at the documents could have provided some extrinsic reason to stop looking. For example, if I find a filing cabinet full of classified documents, I will not continue leafing through them after I see the first one. I will stop immediately and notify someone appropriate (after contacting my lawyer). I do not intend to access classified documents.

The question is one of intent. Did the individual intend to access documents that they knew or should have known that they ought not access. If the kid pulled down one classified document, took a look, realized what he was looking at, and deleted it and notified the authorities, then I'm with the crowd. Likewise if they pulled down the entire archive without looking at any of them. I'll be on the front lines with my pitchfork.

On the other hand, if they saw the first classified document, then pulled down the rest of the trove hunting for more, some amount of punishment is probably warranted. Even then, I would say fifteen years is too much. Maybe a few months of time and probation, depending on exactly how much willfulness was on display.

I imagine these are the kinds of questions that will be resolved during the trial.

Re: Teenager facing prison for downloading unsecured files from government website

#184

Post by mistermann »

pasbesoin wrote: post #31
sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Instead of effectively designing and administrating their systems, "the powers that be" are taking the "rubber hose, lead pipe" approach. Creating in "law", what they are too distracted and incompetent and egotistical and tight-fisted (tech is a "cost center") to create in fact and systems. They are, in essence, trying to redesign the nature of the Internet by fiat. Historically, accessible resources are accessible.…

Don't forget to mention: the absolutely do not have a democratic mandate from the Canadian public to behave in this manner. Our government in many ways is getting to the point where it can legitimately be considered a rogue, adversarial actor in our country, and unlike in America, we don't have a second amendment as a last resort to protect us.

Re: Teenager facing prison for downloading unsecured files from government website

#185

Post by komali2 »

>Officers took her 13-year-old daughter to question her in a police car.

Why are the cops allowed to do this? Why do you have to be "rescued" by your lawyer in order to not be questioned by the police without legal representation? Not sure how it works elsewhere but the cops badgered the fuck out of me until my lawyer finally got to the station and chased them out. So, if I was a 13 year old on the way to school and thrown into the police car, they could just do that until I crack?

Re: Teenager facing prison for downloading unsecured files from government website

#186

Post by rayiner »

iak8god wrote: post #149
rayiner wrote: post #120

Earlier quoted context omitted.

That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended.

As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed?

I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.

Re: Teenager facing prison for downloading unsecured files from government website

#187

Post by outworlder »

lurker456 wrote: post #15

perhaps we need an RFC that defines this type of approach (pages "secured" behind easily guessable urls) as public information.

As if the brilliant minds behind this website would even know what a RFC is.

Re: Teenager facing prison for downloading unsecured files from government website

#188

Post by prophesi »

rayiner wrote: post #178
gitgud wrote: post #174

Earlier quoted context omitted.

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.

Re: Teenager facing prison for downloading unsecured files from government website

#189

Post by rayiner »

jessaustin wrote: post #143
eboyjr wrote: post #64

Earlier quoted context omitted.

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

No, it's much more like calling the government on the phone and asking a series of questions. Or like sending them a series of letters. Or entering a government office during business hours and conducting business there. We don't need a metaphor, there are already laws in place governing how we speak to our public servants and how they respond.

Computers are dumb machines. They have no free will, and cannot serve as agents whose actions bind humans.

Re: Teenager facing prison for downloading unsecured files from government website

#190

Post by doomtop »

rayiner wrote: post #111
clouddrover wrote: post #107

Earlier quoted context omitted.

But the difference is that a website is built to be publicly accessible on the public internet. Your car, presumably, is not offered as a public resource.

Except this data was obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

But it was, precisely, reachable from a public-facing portion of the site!
Post reply on HN