Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

441–450 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#441

Post by foldr »

gtlondon wrote: post #439
foldr wrote: post #424

Earlier quoted context omitted.

>Files don't "accidentally" become publicly accessible via HTTP Hmm? It's certainly possible to configure a web server incorrectly by accident.

That's true. But as the person knows they are configuring a web server, I would say this is more carelessness / incompetence rather than an "accident" in the same way as losing a Diamond Ring would be.

Sure, but your carelessness doesn't absolve me of my crime. If you lose your diamond ring out of carelessness, it's still not ok for me to steal it.

Re: Teenager facing prison for downloading unsecured files from government website

#442

Post by CalRobert »

dustingetz wrote: post #48
sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

It's more like leaving a bunch of manhole covers open on a public street and suing someone for falling in.

FFS if I go to https://www.booking.com/city/ie/cork.html it loads fine. Apparently I'm breaking the law if I use my criminal-mastermind hacking skills to ALSO go to https://www.booking.com/city/ie/dublin.html

It's just ridiculous.

Re: Teenager facing prison for downloading unsecured files from government website

#443

Post by spacemanmatt »

deGravity wrote: post #132
rayiner wrote: post #120

Earlier quoted context omitted.

That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

I think that's a bit harsh. The documents at that URL were understood to be freely available to the public. As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.

I have been arrested for taking too many straws.

Re: Teenager facing prison for downloading unsecured files from government website

#444

Post by chongli »

logicallee wrote: post #407
beobab wrote: post #381

Earlier quoted context omitted.

Because they want a phone line that they can talk to their spouse and children without having to field thousands of calls from well-meaning people who want to wish them a good day?

Sorry, I should have written >Federal Government ministers all have their phone bill summaries released as part of public record Why?

So that the public knows they aren't making secret phone calls to lobbyists or what have you. The purpose of transparency is always to reduce corruption.

Re: Teenager facing prison for downloading unsecured files from government website

#445

Post by foldr »

rootlocus wrote: post #440
foldr wrote: post #435

Earlier quoted context omitted.

You can describe what a webserver does in anthropomorphic terms if you like, but it's not the webserver's "intentions" that are relevant. It's the intentions of the people who control the website and the intentions of the person who accesses it. >There's no law moral or legal that stops me from asking for information. I wouldn't be so confident of that if you haven't read up on the relevant laws. Many countries have…

> You can describe what a webserver does in anthropomorphic terms if you like, but it's not the webserver's "intentions" that are relevant. It's the intentions of the people who control the website and the intentions of the person who accesses it. And how do you prove intent? This is a technical problem with technical protocols involved. Intent should be provided via the protocol. If the protocol says resources are p…

>And how do you prove intent?

I believe that’s something they teach you in law school. Lawyers have been working on that problem for a while! IANAL, but I don't think you are going to be able to find a concise answer to that question that goes beyond the immediately obvious.

>Intent should be provided via the protocol.

Sure, if you say so. That’s not how the law works, though.

Re: Teenager facing prison for downloading unsecured files from government website

#446

Post by spacemanmatt »

harryh wrote: post #309
cecilpl2 wrote: post #243

Earlier quoted context omitted.

Except this teenager was explicitly authorized to access all those files. He literally asked the web server "can I have these files" and it responded with "yes, you are authorized, here you go". If he wasn't authorized, the server should have responded with a 403 Forbidden! Web servers are built around authentication and access rights! It is not the teen's fault that the government doesn't know how to configure them…

Failure to properly secure one's private property does not make it legal for someone else to access it.

Putting it out on the curb with a "FREE INFORMATION" sign, however, does. And this kid is being thrown under the bus for taking it all because it was on a site labeled FREE INFORMATION.

Re: Teenager facing prison for downloading unsecured files from government website

#447

Post by spacemanmatt »

rayiner wrote: post #123
newfoundglory wrote: post #121

Earlier quoted context omitted.

> Ordinary law-abiding people don't go fiddling with URLs I’m an ordinary law-abiding person, and I fiddle with URLs. I know lots of people in that group.

You're not. Ordinary people don't even know that you can do that.

Now you're just trolling.

Re: Teenager facing prison for downloading unsecured files from government website

#448

Post by jessaustin »

rayiner wrote: post #429
jessaustin wrote: post #277

Earlier quoted context omitted.

Ordinary young people already laugh at this sort of ignorance. Ordinary old people will die soon.

Ordinary young people today are probably even less computer literate than ordinary people my age (mid 30s). They grew up being spoon fed the Internet through the FB and Snapchat apps on iPhones.

Your entire argument is based on this idiosyncratic theory of widespread ignorance. This theory is simply wrong, as a matter of fact. Even if it were true, no historical case ever turned on the unprovable notion that most people are too dumb to understand the truth.

Since you didn't respond when I raised it elsewhere in-thread, I would highlight again the fundamental imbalance between the rules you would impose on Facebook etc. and those you would impose on users. Firms that spend billions of dollars developing their systems only have to be as smart as the most ignorant person we can imagine. Their users, in contrast, must be geniuses to keep up with their many changes to TOS, interfaces, and functionality, while simultaneously those genius users aren't allowed to notice that numbers follow each other in sequence. This is nonsense on its face, but then again authoritarian maneuvers are their own justification, aren't they?

Re: Teenager facing prison for downloading unsecured files from government website

#449

Post by gnode »

tantanel wrote: post #405
PretzelPirate wrote: post #239

Earlier quoted context omitted.

When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".

Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle. I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access…

That analogy would be more accurate if you also operated a cafe out of your living room, with a big "open" sign on the front door, and someone accidentally used your personal bathroom because you failed to stick a "private" sign on it. In that case, it would be unreasonable to sue someone for trespass.

Re: Teenager facing prison for downloading unsecured files from government website

#450

Post by tremon »

harryh wrote: post #271
ljm wrote: post #256

Earlier quoted context omitted.

I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You hav…

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

Yet if you forget to lock your car doors or leave valuable items in plain sight on the back seat, the insurance company will not honor your claim.
Post reply on HN