Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

491–500 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#491

Post by asfasgasg »

fenomas wrote: post #370
asfasgasg wrote: post #183

Earlier quoted context omitted.

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Agreed. There is no inherent or intrinsic reason to expect that any given document or any given URL ought to be restricted. However, a look at the documents could have provided some extrinsic reason to stop looking. For example, if I find a filing cabinet full of classified documents, I will not…

> if they saw the first classified document, then pulled down the rest of the trove hunting for more.. Per the articles: nothing was "classified", it was an archive of public documents that the government published periodically. The issue is that a small subset weren't redacted properly - but there's no apparent reason the teen would have known that. It appears that someone simply archived a bunch of documents they r…

In that case, hopefully, and probably, justice will be served.

Re: Teenager facing prison for downloading unsecured files from government website

#492

Post by pdonis »

harryh wrote: post #348
pdonis wrote: post #344

Earlier quoted context omitted.

> It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard d…

Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.

So you think this teen was sending the data he downloaded to all his Facebook friends, or what? Do you have any evidence at all to support this?

Re: Teenager facing prison for downloading unsecured files from government website

#493

Post by hunter2_ »

EamonnMR wrote: post #351
hunter2_ wrote: post #218

Earlier quoted context omitted.

I agree with you but I don't think the law does. The CFAA says that if access isn't authorized, it's no good. Now we can say that if the system was programmed to give it up (200) instead of telling you you aren't authorized (403/401) then you are authorized, but I think the law is more about whether a human intended to authorize you. Accidentally programming the authorization is (however stupid it may be) not what it…

How is someone supposed to determine that one unauthorized thing is hidden among many authorized, similarly named things?

I guess because the unauthorized thing isn't linked. Giving you the link is like giving you a password... They're both just strings although one is considered to be more secret than the other. Guessing at links is like guessing at passwords: it's overcoming the fact that you weren't provided with the string that gets the server to respond with the stuff.

I don't like this but I think it's how it legally could play out.

Re: Teenager facing prison for downloading unsecured files from government website

#494

Post by foldr »

iak8god wrote: post #486
foldr wrote: post #441

Earlier quoted context omitted.

Sure, but your carelessness doesn't absolve me of my crime. If you lose your diamond ring out of carelessness, it's still not ok for me to steal it.

These analogies involving valuable physical items are way off base. If I'm walking along the street and see a diamond ring lying there, I can only assume that it belongs to someone else and they've misplaced it (because it's very valuable and, crucially, there is no way for the owner to make use of its value if they've lost possession of it). I may not have any way to locate the owner, but I still recognize that it b…

No, that's a terrible analogy, because a picture of a diamond ring is worth much less than the ring. A copy of valuable information is generally worth just as much as the original. And while no-one would care if someone else had a picture of their diamond ring, they would care if someone else had a copy of their private information.

Re: Teenager facing prison for downloading unsecured files from government website

#495

Post by vageli »

chongli wrote: post #444
logicallee wrote: post #407

Earlier quoted context omitted.

Sorry, I should have written >Federal Government ministers all have their phone bill summaries released as part of public record Why?

So that the public knows they aren't making secret phone calls to lobbyists or what have you. The purpose of transparency is always to reduce corruption.

But they redact the phone numbers so how can you do that?

Re: Teenager facing prison for downloading unsecured files from government website

#496

Post by astrodust »

ExactoKnight wrote: post #319
astrodust wrote: post #66

Earlier quoted context omitted.

It really needs one. Cory Doctorow went to work for the EFF despite being Canadian probably because the Canadian analogues are pretty weak and disorganized by comparison.

Open Media is pretty good at social media and pressure campaigns. The BCCLA is top notch if you actually need to win a court case. When they take on a case they don't fuck around, and they have high powered lawyers working pro-bono for them.

The great thing about the EFF is they're not as narrowly focused. Open Media is pretty good, but they pick their fights more carefully and don't tackle social or ethical issues the same was the EFF does.

Re: Teenager facing prison for downloading unsecured files from government website

#497

Post by cecilpl2 »

harryh wrote: post #330
bwbw223 wrote: post #329

Earlier quoted context omitted.

Except they’ve been given access. The server should represent its owners in its sharing of data.

Failure to properly secure one's private property does not make it legal for someone else to access it. It doesn't matter if we're talking about physical property in the real world or virtual property on a server.

It does if that other person has a reasonable expectation that you intended for it to be public.

Leaving your property on the curb is a good example. If someone takes it, you would be hard pressed to get it back from a legal standpoint.

This is very similar. The government left all those documents on the curb.

Re: Teenager facing prison for downloading unsecured files from government website

#498

Post by mlazowik »

WestCoastJustin wrote: post #89

I've contacted the reporter to see if we can setup a legal fund for this guy. It sounds like he's being bullied. This could also get a very bad precedent in Canada as this is totally absurd.

https://www.gofundme.com/ns-teen-railroaded-by-government

Re: Teenager facing prison for downloading unsecured files from government website

#499

Post by FundThrowaway »

hazeii wrote: post #379
FundThrowaway wrote: post #318

From the article: "When he was around eight, he remembered playing around with the HTML of the Google search page, making the coloured letters spell out his name." Isn't the Google logo an image? Smells a bit fishy to me.

I make that about 11 years ago - the page was rather different then.

It was an image 11 years ago also.

http://web.archive.org/web/20070106132559/http://www.google....

Re: Teenager facing prison for downloading unsecured files from government website

#500

Post by kuon »

jopsen wrote: post #488
kuon wrote: post #432

Earlier quoted context omitted.

I use the following configuration: I run two tinyproxy instances on my home server and I point all browser traffic to the first instance. The first instance run with the default routing table on port 8888 and has entries like upstream localhost:8889 ".somesite.com" the second instance, which run on port 8889 is run with the vpn as default route (I use setfib under FreeBSD). With this setup, traffic goes by default di…

Won't this leak DNS and won't lots of system process go avoid the HTTP_PROXY settings?

I have my own DNS server on my local network. And yes, this is only for my browser. But this is intended.

If you want to route all traffic to a vpn for a specific machine, you can use pf rules to forward an ip through another routing table.

Post reply on HN