Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

241–250 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#241

Post by shkkmo »

rayiner wrote: post #220
ShroudedNight wrote: post #208

Earlier quoted context omitted.

At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will? The answer, even in the realm of physical property, is clearly not 'never', so where is it, and what leads you to believe its threshold was not crossed here?

> At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will? The law is that the onus falls on the owner or their agents at the point where a reasonable person would not be able to infer the scope of the implied license from the circumstances. I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL t…

And I posit you are wrong.

An ordinary person would infer from accessing a url and receiving information, that the information was intended to be public

Re: Teenager facing prison for downloading unsecured files from government website

#242

Post by ShroudedNight »

rayiner wrote: post #220
ShroudedNight wrote: post #208

Earlier quoted context omitted.

At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will? The answer, even in the realm of physical property, is clearly not 'never', so where is it, and what leads you to believe its threshold was not crossed here?

> At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will? The law is that the onus falls on the owner or their agents at the point where a reasonable person would not be able to infer the scope of the implied license from the circumstances. I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL t…

>I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible.

Do you view 'a HN reader' as a reasonable representation of someone skilled in the art [of creating and serving websites]?

Unless I'm missing something, the only conclusion that I can see following this line of reasoning is that skill in the art is inversely proportional to a person's 'reasonableness' in this matter.

If a quorum of experts are coherently proposing that certain actions are reasonable, even if you find them distasteful, at what point is 'reasonable' no longer reasonable?

For what it's worth, despite sounding like a rhetorical question, I am truly interested to know your thoughts on that last matter.

Re: Teenager facing prison for downloading unsecured files from government website

#243

Post by cecilpl2 »

rayiner wrote: post #198
gowld wrote: post #127

Earlier quoted context omitted.

This is absurd. This is not private property. Ordinary law-abiding people do walk into government offices and ask questions, and when they get answers, do continue asking questions and getting answers. Ordinary law abiding people to browse all the products on display at a store. Ordinary law abiding people do flip through all the pages of a catalog that is sent to their home. This Orwellian attitude that looking at a…

Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn'…

Except this teenager was explicitly authorized to access all those files.

He literally asked the web server "can I have these files" and it responded with "yes, you are authorized, here you go".

If he wasn't authorized, the server should have responded with a 403 Forbidden!

Web servers are built around authentication and access rights! It is not the teen's fault that the government doesn't know how to configure them properly.

Re: Teenager facing prison for downloading unsecured files from government website

#244

Post by jessaustin »

rayiner wrote: post #229
jessaustin wrote: post #180

Earlier quoted context omitted.

Phones, bullhorns, billboards, postcards, bumper stickers, guitars, TV transmitters, etc. are dumb pieces of property that people use to communicate. (Why don't I have to get permission to look at your billboard?) Computing devices are different from most of these in a single respect: they can act autonomously, as their operators intend. In fact it is customary that they do so, just as it is customary that billboards…

> There's nothing anthropomorphic about recognizing that intent may be coded in such a way that a computer obeys that intent. What a computer does may be evidence of intent, just as a lock (or lack thereof) may be evidence of intent. But just like an unlocked door is not evidence of intent to make something accessible, neither is an unlocked computer. > Consider, if you will, whether your preferred position is one th…

Sending a packet in response to some other packet is something "a computer does". Back when "ordinary people" thought that witch-dunking was an "ordinary" security measure, "ordinary people" were wrong. Improvements came not when the courts surrendered to ignorance, but when they corrected it.

Very few "ordinary people" would describe websites as "places", anyway. They don't say they're "at" Facebook, they say they're "on" it, much like they could be "on the phone" or "on TV". Maybe this hasn't always been the case, but the courts aren't tied to 1990s-era metaphors. No one on a jury remembers those silly "Welcome to the BatCave, Come on in if you Dare" geocities pages.

Incidentally, Facebook and its ilk hold ordinary people to much more complicated standards of behavior than those to which you and they would hold sites, all the time. Oh, you didn't read all 50 pages of TOS and then update the (hidden) configuration, every week? Silly user, that's why we gave all your data to the English!

Meanwhile, you don't think Facebook should have to understand how HTTP works, just because one person working at the company might not. Interesting, that the benefits go one direction and the duties go the other.

Re: Teenager facing prison for downloading unsecured files from government website

#245

Post by shkkmo »

rayiner wrote: post #207
jessaustin wrote: post #194

Earlier quoted context omitted.

If your car runs me over, I'm going to sue you.

If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the comp…

The web server sends a response code with each response.

The best, and most accurate, way of determining if the resource you requested is meant to be accessible, is to check to see if you got a 200 OK response or a 403 Forbidden response.

Re: Teenager facing prison for downloading unsecured files from government website

#246

Post by c22 »

jopsen wrote: post #173
XorNot wrote: post #19

And this is why I'm going to route all my kids traffic through an offshore VPN by default and whitelist low latency stuff.

I've been thinking I wanted a router with two wi-fi networks. One that goes through the ISP and one that goes out over a proxy. I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.

Why not just set up two wifi routers? This is surely also the best solution for ensuring data compartmentalization.

Re: Teenager facing prison for downloading unsecured files from government website

#247

Post by jolmg »

rayiner wrote: post #175
hug wrote: post #151

Earlier quoted context omitted.

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, si…

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

A link is not someone giving you permission, it's merely telling you where something else is. I can't think of how you even came to this conclusion. It's like you have this incredibly restricted view of the internet, limited to people clicking on a browser, and think that's enough for protecting files. It's not.

You don't seem to realize how bad of an idea this is. You're talking about making criminals of people. You know, I think I remember once reading about how chrome would try the address you type while you typed it (i.e. before pressing enter, it'd make a request for every character you typed). Users of chrome could become criminals because their software would do this.

Re: Teenager facing prison for downloading unsecured files from government website

#248

Post by jonathanwallace »

If you're frustrated by this story and live in Georgia, USA, you should immediately contact the Governor's office and express your concern and share that he veto a similar bill sitting on his desk, SB 315.

https://action.eff.org/o/9042/p/dia/action4/common/public/?a...

Re: Teenager facing prison for downloading unsecured files from government website

#249

Post by [deleted] »

prophesi wrote: post #188
rayiner wrote: post #178

Earlier quoted context omitted.

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.

[deleted]

Re: Teenager facing prison for downloading unsecured files from government website

#250

Post by kps »

rayiner wrote: post #178
gitgud wrote: post #174

Earlier quoted context omitted.

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

Sequential numbers are not obscure. They're commonly used for pagination and collections, to the point where popular browsers have extensions to simplify navigating them.

https://addons.mozilla.org/en-US/firefox/addon/nextprev-page...

https://chrome.google.com/webstore/detail/urlnext/emepkgfiam...

Post reply on HN