Teenager facing prison for downloading unsecured files from government website • Hacker News Board

Re: Teenager facing prison for downloading unsecured files from government website

#251

Post by rayiner » Tue, Apr 17, 2018, 1:22 AM UTC

defined wrote: post #222

rayiner wrote: post #186

Earlier quoted context omitted.

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

> The onus for keeping computerized material private is on the owner

I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit themselves.

Re: Teenager facing prison for downloading unsecured files from government website

#252

Post by kodablah » Tue, Apr 17, 2018, 1:22 AM UTC

rayiner wrote: post #111

clouddrover wrote: post #107

Earlier quoted context omitted.

But the difference is that a website is built to be publicly accessible on the public internet. Your car, presumably, is not offered as a public resource.

Except this data was obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

> obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

Doesn't seem obvious to me. So now I have to check for a specific anchor to a URL to see if a URL is considered publicly accessible?

Re: Teenager facing prison for downloading unsecured files from government website

#253

Post by ersh » Tue, Apr 17, 2018, 1:24 AM UTC

This is really funny to see people comparing downloading a file to breaking into an unlocked window.

You guys don't really have a clue on what Internet is.

Re: Teenager facing prison for downloading unsecured files from government website

#254

Post by walrus01 » Tue, Apr 17, 2018, 1:24 AM UTC

sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

For those who haven't read it, The Hacker Crackdown was released by Sterling as freeware:

http://www.mit.edu/hacker/hacker.html

there are also PDF and epub versions if you google for it.

Re: Teenager facing prison for downloading unsecured files from government website

#255

Post by bcheung » Tue, Apr 17, 2018, 1:25 AM UTC

The levels of security:

1) Formal methods and cryptography

2) Obfuscation

3) Litigation

Looks like they chose the latter.

Re: Teenager facing prison for downloading unsecured files from government website

#256

Post by ljm » Tue, Apr 17, 2018, 1:25 AM UTC

rayiner wrote: post #169

jopsen wrote: post #155

Earlier quoted context omitted.

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn'…

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable pe…

I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You have to be accountable. The guy who found the problem or abused it is not accountable.

Re: Teenager facing prison for downloading unsecured files from government website

#257

Post by rayiner » Tue, Apr 17, 2018, 1:25 AM UTC

shkkmo wrote: post #245

rayiner wrote: post #207

Earlier quoted context omitted.

If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the comp…

The web server sends a response code with each response. The best, and most accurate, way of determining if the resource you requested is meant to be accessible, is to check to see if you got a 200 OK response or a 403 Forbidden response.

Given the numerous articles about documents inadvertently being exposed through URL ID incrementing, clearly response codes do not accurately convey what people meant.

Re: Teenager facing prison for downloading unsecured files from government website

#258

Post by shkkmo » Tue, Apr 17, 2018, 1:27 AM UTC

rayiner wrote: post #257

shkkmo wrote: post #245

Earlier quoted context omitted.

The web server sends a response code with each response. The best, and most accurate, way of determining if the resource you requested is meant to be accessible, is to check to see if you got a 200 OK response or a 403 Forbidden response.

Given the numerous articles about documents inadvertently being exposed through URL ID incrementing, clearly response codes do not accurately convey what people meant.

I didn't say it was perfectly accurate, just that it was the best.

So your argument is that a better way to check this is to crawl the entire web looking for links to a resource to determine if it was meant to be publicly accessible?

Re: Teenager facing prison for downloading unsecured files from government website

#259

Post by rayiner » Tue, Apr 17, 2018, 1:28 AM UTC

jolmg wrote: post #247

rayiner wrote: post #175

Earlier quoted context omitted.

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

A link is not someone giving you permission, it's merely telling you where something else is. I can't think of how you even came to this conclusion. It's like you have this incredibly restricted view of the internet, limited to people clicking on a browser, and think that's enough for protecting files. It's not. You don't seem to realize how bad of an idea this is. You're talking about making criminals of people. You…

I have a view of the Internet where “protecting files” has nothing to do with whether access to files is authorized or not. I shouldn’t have to lock my door, and I shouldn’t have to lock down my web server. (It may be prudent to do those things, but a trespasser shouldn’t escape penalty just because I didn’t do those things.)

Re: Teenager facing prison for downloading unsecured files from government website

#260

Post by hnaccy » Tue, Apr 17, 2018, 1:28 AM UTC

Anon1096 wrote: post #161

astrodust wrote: post #69

Earlier quoted context omitted.

As the amount of 4chan material you've archived increases the probability of not archiving something illegal quickly diminishes to zero.

Depending on the boards archived there's a pretty good chance he doesn't have CP. Only /b/ (and I hear /sp/ as well but I never go there) really ever have child porn, and then very very rarely and quickly deleted to the point that an archiver might not pick it up. Due to the sheer size and uselessness of a possible /b/ archive I kind of doubt there's anything bad.

If his archive was automated it's basically guaranteed he's saved a fair bit of loli content. Not sure of the legality in Canada, but this is seems like a case where they'd railroad you for something they normally don't enforce, e.g., Chris Handley in the states.

CP would not be unlikely even if he just archived "safe" boards like /a/, /tv/, and /g/.