Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

641–650 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#641

Post by soylentnewsorg »

sbarre wrote: post #429
soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate…

> Changing a URL is not "malicious use"

the law disagrees

as far as your doctor's office strawman - it's a strawman. To see those files, you don't have to actively do anything, if they are left at the desk. Now, if you pick up one of those closed folders, open it, then start looking through it - you have an equivalent comparison. You also have an arrest record.

But don't argue with me. What he did is literally illegal.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#642

Post by soylentnewsorg »

gwd wrote: post #451
plainnoodles wrote: post #419

Earlier quoted context omitted.

I think that's a PRETTY uncharitable analogy and interpretation of the OP's actions. I would say it's more like: You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. So,…

> You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. Or perhaps, "Here's a binder with numbered pages; turn to page 345 for your information." You wonder what's on pag…

Which as I said would be perfectly fine. You then tell the owner of the binder that confidential information for other people is in the binder, and you get gratitude.

If once you find the information on page 346, you then keep flipping and looking at people's private information on the next hundred pages like the OP did, you have now committed a crime. The fact that you can easily access something, does not give you the right to access it. If you think otherwise, you think malware that steals your contact and banking info is legal. No, not the one that hacks into your computer. The solitaire game you download and install that has a trojan in it.

After all, you gave the solitaire game access to your hard drive to save and read its own games. Perfectly fine for it to scan the rest of your files. You gave it access to your network card so you can upload your scores. Perfectly fine for it to capture all other network traffic. All trojans are now legal as long as they're packaged with software you voluntarily install.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#643

Post by closeparen »

Spivak wrote: post #628
zentiggr wrote: post #522

Earlier quoted context omitted.

Which works great when there's some kind of access restriction in place. If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else. That's the proper analogy for what happened in the original article.

This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff. Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.

Content you're serving on a public URL is content you have published. It's not your house and you didn't extend anyone any trust or limited access. You put it in The New York Times. Maybe you hoped no one would find it because it's on page B30 and most people only read A1. But people are allowed to read page B30 if they want to.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#644

Post by closeparen »

Spivak wrote: post #432
tomrod wrote: post #316

Earlier quoted context omitted.

This is 100% the correct analogy.

But this is assuming that the server has more agency than it does. Servers don't have minds and they don't make authorization decisions. This is more like someone giving you key to a filing cabinet in order to retrieve some documents and while you're there you snoop on the ones next to yours. Is this system more trusting of people than it should be? Probably. Does that mean you're allowed to snoop on other people's d…

The humans who administer the server have agency. They went and purchased an apparatus for publishing information to the world. They connected it to the world. They pointed it at that information. They turned it on.

A printing press also isn’t sentient and can’t guess whether its operators really mean to share every sentence on the plate. But browsers and readers of printed materials (that are left in public places) have no obligations to the publisher’s state of mind. Why should browsers of digital materials?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#645

Post by soylentnewsorg »

throwaway09223 wrote: post #470
sbarre wrote: post #429

Earlier quoted context omitted.

This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate…

It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user si…

> instead the doctor ships you his entire filing cabinet with your folder taped to the top

and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law.

>pushed

you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information.

so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#646

Post by jessaustin »

e40 wrote: post #374
0xBA5ED wrote: post #89

Earlier quoted context omitted.

The funny thing is, the reporter successfully embarrassed the state, then the state embarrassed itself further in response.

Streisand effect, too. None of us would have heard about this otherwise.

I had already heard about it on a local security mailing list, but most of us on the list would have preferred to be spared the international embarrassment.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#647

Post by closeparen »

kelnos wrote: post #400
klyrs wrote: post #166

Earlier quoted context omitted.

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Accessing data that you are not authorized to view is still wrong. The fact that someone has misconfigured the access controls doesn't change that. I might forget to lock my front door one day, but that doesn't make it ok for you to wander into my house and look at all my stuff.

A public web service is not the threshold of your home. If you want to make a domestic analogy, it's the box you drop off at Goodwill. You put something in there that you didn't mean to, and you understandably feel violated now that people are browsing it on Goodwill's shelves, but you can hardly blame the shoppers for that.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#648

Post by roguecoder »

Okay, but it is hilarious that the governor is accusing the person here of “converting” and “decoding” “the code”, when what they actually did was decline to convert or decode the document the government delivered & just read it instead.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#649

Post by Buttons840 »

suzzer99 wrote: post #291
mminer237 wrote: post #114

Earlier quoted context omitted.

Step one: Press Ctrl Step two: Press U

1. Click View in menu bar 2. Hover over developer menu item 3. Click View Source Three-step process - even more nefarious!

1. Rest finger softly on the F12 key

2. Press finger downward

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#650

Post by roguecoder »

somebehemoth wrote: post #370
NoGravitas wrote: post #274

Earlier quoted context omitted.

Yeah, even leaving aside the T-word; there's a broad swath of the US population who are willing to believe anything that is expected of them by their chosen authorities (mainstream Democrats are as guilty of this as Republicans, they just chose different authority figures). Sometimes, insanity is the only sane response to an insane world.

> Democrats are as guilty as Republicans No they aren't. Not even remotely close. I'm exhausted by "both sides". "Both sides" arguments cause apathy in people because what is even the point in voting if, "both sides".

Yep. It is explicit propaganda to try to keep people from resisting their attempts to guarantee permanent minority rule.
Post reply on HN