But there’s a near infinite supply of straws and it didn’t damage the dispenser.
It did, however, damage the privacy of various Canadian citizens.
That may be so, but did he intend to damage their privacy? Probably not.
He can't be faulted for accidentally downloading some private information that was improperly mixed in with a bunch of public information that he was trying to download. He had no indication that the information he was retrieving was not supposed to be public.
This is absurd. This is not private property. Ordinary law-abiding people do walk into government offices and ask questions, and when they get answers, do continue asking questions and getting answers. Ordinary law abiding people to browse all the products on display at a store. Ordinary law abiding people do flip through all the pages of a catalog that is sent to their home. This Orwellian attitude that looking at a…
Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn'…
What literal or figurative signs were there that he should not have accessed the private information? By all accounts, most of the information he retrieved was clearly intended to be public so there would have been no way for him to know that he wasn't supposed to access the small portion that wasn't intended to be public.
> Ordinary law-abiding people don't go fiddling with URLs I’m an ordinary law-abiding person, and I fiddle with URLs. I know lots of people in that group.
You're not. Ordinary people don't even know that you can do that.
Ordinary people don't access Freedom of Information requests. The whole site exists solely for the use of people who are not ordinary.
It... it is accessible from a link That's what a url with an id in it is a link
A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.
You're right - a URL is an address, and a link is a sign saying 'go here'. The address still exists with or without the sign.
This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?
When somebody uses the "leave the window unlocked" comparison, I try to rephrase it as "imagine you have your satellite TV with thousands of channels. You browse through channels and realize that, on channel #12985 if you press the A button on your remote, the channel will broadcast you videos that were supposed to be private".
This is probably a closer analogy as you are not physically trespassing, you are "committing the crime" from your couch, you are not "stealing private property" (as, the docs are still on the owner's servers) and it's mostly on the broadcaster side to transmit sensitive information on a channel that is for everyone to see.
That's true. But as the person knows they are configuring a web server, I would say this is more carelessness / incompetence rather than an "accident" in the same way as losing a Diamond Ring would be.
Sure, but your carelessness doesn't absolve me of my crime. If you lose your diamond ring out of carelessness, it's still not ok for me to steal it.
These analogies involving valuable physical items are way off base. If I'm walking along the street and see a diamond ring lying there, I can only assume that it belongs to someone else and they've misplaced it (because it's very valuable and, crucially, there is no way for the owner to make use of its value if they've lost possession of it). I may not have any way to locate the owner, but I still recognize that it belongs to someone else and that for me to take it and keep it would deprive them of their property (probably, I should take it to the police).
If you insist on analogies involving lost rings, this situation is more like taking a picture of a ring someone lost in the street than it is like taking the ring.
I've been thinking I wanted a router with two wi-fi networks. One that goes through the ISP and one that goes out over a proxy. I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.
I have just set this up a week ago at my apartment. I use hostapd and dnsmasq on a raspberry pi to make it a wireless AP. It is connected to the primary router via ethernet and uses iptables to route wifi traffic via ethernet. Then I just installed OpenVPN to route traffic via a VPN. I haven't tested for DNS leaks yet as this is an ongoing project. There are a couple of other things on my todo list still. Such as eas…
Neat,
I considers using a raspberry pi, but I'm not sure the range is ideal.
I've been thinking I wanted a router with two wi-fi networks. One that goes through the ISP and one that goes out over a proxy. I haven't found a solution just yet. I guess a raspberry pi with iptables and routing based on device ID could do the trick too.
I use the following configuration: I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD). With this setup, traffic goes by default di…
Won't this leak DNS and won't lots of system process go avoid the HTTP_PROXY settings?
I've contacted the reporter to see if we can setup a legal fund for this guy. It sounds like he's being bullied. This could also get a very bad precedent in Canada as this is totally absurd.
I would love to help out if possible. I'm a Canadian citizen but not in Halifax, so I guess I can write my MP but I don't think they have much authority to look into a provincial matter like this.
I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.
> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
Imagine a government information bureau.
The employees who work there have access to all information. Why wouldn't they? They work at the information bureau.
They also answer all questions. Why wouldn't they? They work at the information bureau.
You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets.
Do you see a possible problem with this arrangement?