421–430 of 502 posts
And this is why I'm going to route all my kids traffic through an offshore VPN by default and whitelist low latency stuff.
I'm starting a proxy project that can be used in countries where VPN is illegal. I'm looking for collaborators. https://github.com/UncleGrape/UncleGrape
Earlier quoted context omitted.
Sure, and the fact that HN has a note to that effect on its website is evidence that all of these items are intended to be publicly accessible. It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. In the case we're talking about here, it was far less obvious that the relevant documents were intended to be publicly available.
> It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. > it was far less obvious that the relevant documents were intended to be publicly available My browser and the respective HTTP servers consider them equally obvious publicly available.
This is really funny to see people comparing downloading a file to breaking into an unlocked window. You guys don't really have a clue on what Internet is.
Anyone could have viewed the posts on the board one by one; he just copied them all at once for later viewing.
Earlier quoted context omitted.
Dumpster diving is legal (in most places but not all) because the owners has, by putting something in the trash, expressed their intent to not own the item in question anymore. A website isn't a trash can though. If I accidentally leave a diamond ring (or personal files) in public somewhere and you take them that is absolutely theft.
But...you would have left the diamond ring by accident. Files don't "accidentally" become publicly accessible via HTTP. i.e. you don't return to your computer one day to find everything is public. Someone specifically took the steps to make this data public. The fact they didn't realize what they were doing isn't the fault of people that then view the data.
Hmm? It's certainly possible to configure a web server incorrectly by accident.
Earlier quoted context omitted.
When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle. I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access…
Earlier quoted context omitted.
If your car runs me over, I'm going to sue you.
If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the comp…
Or you failed to follow the rules, were careless, and hit him by mistake. Was your intention to kill him? No. Was it your fault? Yes.
Earlier quoted context omitted.
The web server sends a response code with each response. The best, and most accurate, way of determining if the resource you requested is meant to be accessible, is to check to see if you got a 200 OK response or a 403 Forbidden response.
Given the numerous articles about documents inadvertently being exposed through URL ID incrementing, clearly response codes do not accurately convey what people meant.
Your intent argument is really shallow. People do bad things with good intentions all the time. Doesn't mean their actions are good or legal.
Earlier quoted context omitted.
And the cries by old geezers in charge, yet clueless of what it is they’re “in-charge of”, that he stole it are eye rolling It’s ageism but at this point I’m pretty convinced old people should be term limited from office The problems we seem to be facing are almost entirely due to their inability to move on Youth shouldn’t spend their lives kowtowing to geezers that quit thinking and are simply peddling what’s become…
> It’s ageism but at this point I’m pretty convinced old people should be term limited from office Resource depletion from overpopulation aside, the lack of social progress we will see once we manage to extend life to the point of immortality is one of the more depressing outlooks I can imagine. Old ideas will never die.
Earlier quoted context omitted.
> The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit t…
Ordinary young people already laugh at this sort of ignorance. Ordinary old people will die soon.
Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?