Governor vows criminal prosecution of reporter who found flaw in state website

Post by alpaca128 » Thu, Oct 14, 2021, 11:26 PM UTC

askvictor wrote: post #582

jameshart wrote: post #512

Earlier quoted context omitted.

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…

On the other hand, to a non-techie person, where do you draw the line? Accessing the HTML of a public webpage is trivial to you and me. But what about decompiling or extracting strings from an .apk? Almost exactly the same thing as pressing F12 in the browser, but a tad more 'active'. It is relevant to this article, as it asks what hacking is OK, and what isn't

Post by jameshart » Thu, Oct 14, 2021, 11:38 PM UTC

askvictor wrote: post #582

jameshart wrote: post #512

Earlier quoted context omitted.

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…

On the other hand, to a non-techie person, where do you draw the line? Accessing the HTML of a public webpage is trivial to you and me. But what about decompiling or extracting strings from an .apk? Almost exactly the same thing as pressing F12 in the browser, but a tad more 'active'. It is relevant to this article, as it asks what hacking is OK, and what isn't

Post by lethoso » Thu, Oct 14, 2021, 11:45 PM UTC

airstrike wrote: post #262

MrPatan wrote: post #238

Earlier quoted context omitted.

You left out the best bit: "through a multi-step process"

Nice catch... Unbelievable. What isn't a multi-step process, really? The first thing I do in the morning is to make coffee and though I've distilled that process down to its bare minimum so I can do it while still half asleep, it is still very much a multi-step process...

Post by alpaca128 » Thu, Oct 14, 2021, 11:49 PM UTC

Spivak wrote: post #432

tomrod wrote: post #316

Earlier quoted context omitted.

This is 100% the correct analogy.

But this is assuming that the server has more agency than it does. Servers don't have minds and they don't make authorization decisions. This is more like someone giving you key to a filing cabinet in order to retrieve some documents and while you're there you snoop on the ones next to yours. Is this system more trusting of people than it should be? Probably. Does that mean you're allowed to snoop on other people's d…

Post by ajmurmann » Thu, Oct 14, 2021, 11:56 PM UTC

ajmurmann wrote: post #511

photochemsyn wrote: post #373

Earlier quoted context omitted.

The analogy is going up to a house and checking all the doors and windows to see if they are locked. That's rather like port scanning, a form of 'poking'. If you go to a state government web site and do that, even if you don't exfiltrate data or load it up with ransomware, it's definitely very shady behavior, although it seems there are no laws against it in the USA (some ISPs will ban users caught doing this however…

The data was send to my browser. The more fitting analogy to me is that I get a letter and a huge pile of documents in a giant binder. Some of the documents are referenced in the letter. Now the sender gets upset because I started looking at the documents in the binder that weren't referenced in their cover letter.