Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

401–410 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#401

Post by rootlocus »

rayiner wrote: post #251
defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

> The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit t…

> The Internet is for ordinary people

If we're at the topic of wishful thinking, I wished ordinary people would understand basic things about the internet. The purpose of humanity as a whole shouldn't be to dumb things down for "ordinary people". It should be to better teach and educate new generations, so we won't be able to assume ordinary people are dumb.

Re: Teenager facing prison for downloading unsecured files from government website

#402

Post by quickthrower2 »

pluma wrote: post #389
scrumption wrote: post #179

Earlier quoted context omitted.

Obscurity is not a security layer.

What is a UUID if not a fairly predictable object-based shared authorization token? EDIT: I'm mostly kidding.

Just call it an object-specific API key, that forms part of the URI instead of being a header value. Since we are using https it's all good.

Re: Teenager facing prison for downloading unsecured files from government website

#403

Post by swebs »

jstarfish wrote: post #268
hnaccy wrote: post #260

Earlier quoted context omitted.

If his archive was automated it's basically guaranteed he's saved a fair bit of loli content. Not sure of the legality in Canada, but this is seems like a case where they'd railroad you for something they normally don't enforce, e.g., Chris Handley in the states. CP would not be unlikely even if he just archived "safe" boards like /a/, /tv/, and /g/.

If he's scraping the softcore or hardcore boards (because nobody's archiving 4chan for its intellectual discussions), he's absolutely going to have more than a few under-18 subjects in there doing sexually explicit things. If the state can verify the age and identity of any of them, he's toast.

>because nobody's archiving 4chan for its intellectual discussions

There's plenty of good discussion as long as you stay away from /b/, /v/, and the porn boards.

/diy/ always has interesting projects. /g/ seems to be the one tech board on the internet that takes consumer privacy seriously (Even HackerNews seems to give Microsoft a free pass in this regard)

Re: Teenager facing prison for downloading unsecured files from government website

#404

Post by dSpect »

rayiner wrote: post #251
defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

> The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit t…

Web scraping is a normal occurence on the internet not just limited to curious teenage hackers. When I grew up we didn't lock our doors because we knew and trusted our neighborhood. It's like you're asking 4chan to use polite vocabulary.

Re: Teenager facing prison for downloading unsecured files from government website

#405

Post by tantanel »

PretzelPirate wrote: post #239
rayiner wrote: post #192

Earlier quoted context omitted.

The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.

When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".

Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle.

I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access the data once they understood it (e.g. did they close the door and leave)?

Re: Teenager facing prison for downloading unsecured files from government website

#407

Post by logicallee »

beobab wrote: post #381
logicallee wrote: post #378

Earlier quoted context omitted.

>Federal Government ministers all have their phone bill summaries released as part of public record with private information removed Why?

Because they want a phone line that they can talk to their spouse and children without having to field thousands of calls from well-meaning people who want to wish them a good day?

Sorry, I should have written

>Federal Government ministers all have their phone bill summaries released as part of public record

Why?

Re: Teenager facing prison for downloading unsecured files from government website

#408

Post by Lewton »

sandebert wrote: post #371
rayiner wrote: post #175

Earlier quoted context omitted.

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

I'm not saying that I agree with you, but I'm curious: does antisocial behavior mean it's illegal?

I completely agree with rayiner, and am a little concerned he’s being downvoted so heavily

But no, it shouldn’t be illegal. Yet what he said still completely applies to stuff like fiddling with ids on a site where you suspect it might lead to content you shouldn’t be able to access

Unless you’re whitehatting and plan to inform them of the security issue (probably anonymously because the world is fucked up and whitehatting can lead to jail time -_-)

Just because what you're doing is legal, doesn't mean you're not an asshole

Re: Teenager facing prison for downloading unsecured files from government website

#409

Post by Firadeoclus »

rayiner wrote: post #267
ShroudedNight wrote: post #242

Earlier quoted context omitted.

>I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible. Do you view 'a HN reader' as a reasonable representation of someone skilled in the art [of creating and serving websites]? Unless I'm missing something, the only conclusion that I can see following this line of reasoning is that skill in the art is…

Except in certain limited areas (e.g. “the reasonable doctor” standard for medical malpractice), the standard is the “reasonable person,” not the “reasonable person skilled in the art.” People on HN are not representative, because they know about computer security and HTTP access codes. We don’t live in a world where those people get to make the rules. We live in a world where the rules are set by reference to ordina…

> My point is that a reasonable layman would assume that if a document was not linked or indexed from a public portion of the site, it was not meant to be accessed.

And others point out that editing a URL to increment an ID which is obviously sequential is absolutely a reasonable way of browsing the web. That doesn't mean a lay person has to know how to do it, but that they wouldn't think anything criminal was happening if they watched someone else do it.

Re: Teenager facing prison for downloading unsecured files from government website

#410

Post by gtlondon »

brandon272 wrote: post #56

I am absolutely incensed reading this. The government made no reasonable effort to conceal the information and put it on a _publicly accessible_ web server. They made the information available to the public whether or not that was their intention. How can any reasonable person conclude that typing in an HTTP url qualifies as an illegal breach?

They've made the information publicly accessible via HTTP, yet react like this when someone then views in. Scary stuff.

I just can't comprehend this at all. To even describe it as a "breach" is inaccurate -- the real headline is "government publishes data they hadn't intended to".

Post reply on HN