Governor vows criminal prosecution of reporter who found flaw in state website • Hacker News Board

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#651

Post by throwaway09223 » Fri, Oct 15, 2021, 4:56 AM UTC

soylentnewsorg wrote: post #645

throwaway09223 wrote: post #470

Earlier quoted context omitted.

It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user si…

> instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the d…

> and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime.

There's no such crime. If you disagree, by all means cite a statute.

> you should look up how http works.

I'm intimately familiar with http. Upon issuing a request for your records (the request, GET or otherwise), you receive a response, pushed to you, with records you did not request.

I think you may want to re-read my comment, this time more carefully and thoughtfully.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#652

Post by roguecoder » Fri, Oct 15, 2021, 5:09 AM UTC

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

I think The Good Place really nailed this one on the head: as our world has become more connected, it no longer fits in our heads. It becomes impossible to know for sure what impact we are having, or even what we might want to change.

Basically, we are living inside a spaghetti mess of a civilisation.

But I’ve also spent twenty years working in various big balls o’ mud codebases, at companies that had big systematic problems that got them that way, and in that time I’ve found some strategies that can make positive changes, even under conditions of extreme chaos & status-obsessed executives. And they all start the same way:

Find a coworker, ask them how their work is going, and then really listen.

Don’t go in with any agenda except building a relationship with you coworker. If the have stuff they are proud of, tell them what you like about it. If they have stuff they are struggling with, you can commiserate. You might be able to help, but probably not: you are both living in a giant mess of a disaster world full of incentive systems that push people to behave the ways they are behaving.

But by setting that aside, by prioritizing your relationship with even just one other person over that perverse system that exists today, you are resisting. Authentic, caring conversations that prioritize people over process are radical acts.

Maybe the first person or the first dozen aren’t interested. That’s okay. Eventually you’ll have a second genuine conversation, and now you have two relationships. You can introduce those two people to each other, and suddenly you have a community.

A community can get things done none of us could do alone.

I learned these techniques from the grouchiest, grumpiest old grey beards I worked with, because they were how they built support for the infrastructure they wanted to use. I’ve use the technique for different purposes (livable code, low alert volumes, sufficient time & space to mentor junior engineers into being the mentors of junior engineers, not selling contracts to Palentir, more than two weeks vacation time, fixing user problems before adding shiny new whistles to get the PM promoted, not planning two years of work at once, etc), but fundamentally it is the same. Positive changes start with building a tiny little corner where we set aside our doubt, gather up our courage and build a community rooted in sufficiency and willing to trust.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#653

Post by soylentnewsorg » Fri, Oct 15, 2021, 5:31 AM UTC

throwaway09223 wrote: post #651

soylentnewsorg wrote: post #645

Earlier quoted context omitted.

> instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the d…

> and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. There's no such crime. If you disagree, by all means cite a statute. > you should look up how http works. I'm intimately familiar with http. Upon issuing a request for your records (the request, GET or otherwise), you receive a response, pushed to you,…

"push" means the data is pushed. as in without a request from you. it's mind boggling how you are not getting this. exchange is an example of this - you get email pushed to a listener on your mail client, without requesting that data. if you use pop3 however, you request the data and receive a response. you are arguing a request - a GET - the literal opposite of a push, is a push. this is something anyone who has used email would know, so you are being purposely dense, and this conversation is done - I will not read your reply.

as far as the crime, it's called unauthorized access to a computer system, and many people are in jail for it. whether that system is password protected or not makes absolutely zero legal difference.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#654

Post by soylentnewsorg » Fri, Oct 15, 2021, 5:35 AM UTC

Talanes wrote: post #468

Spivak wrote: post #408

Earlier quoted context omitted.

Yeah you still can't just walk into the Mayor's office just because it's unlocked. Access isn't authorization.

And yet if I do just open the door to the Mayor's office and it's unlocked and I wander in, that's still not the same sort of trespass as entering someone's home. And, if I'm in City Hall, the mechanism that keeps me from entering the Mayor's office should be the security guards and key-cards, not my disinclination to open a door.

And if you walk in there, realize it's a restricted area, and start opening up file cabinets and reading confidential documents, you're now in jail. the security guard being there or not makes zero legal difference - things not being locked or blocked does not give you rights to them. thank you for proving yourself wrong.

you mistakenly wandering in is not illegal. however your strawman is not what the OP did. it's a paragraph of text for crying out loud. please at least read the story before commenting.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#655

Post by soylentnewsorg » Fri, Oct 15, 2021, 5:39 AM UTC

MrOrelliOReilly wrote: post #398

soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

Wow. The parent comment did not state they then sifted around for personal data. They checked if there was a bug and found it. For all we know the personal data is front and center, so this rudimentary check also revealed personal information. It’s not like they said they downloaded the SSNs. Good job a miming the ignorance and bad faith of the nameless bureaucrat the parent comment mentioned though, maybe this is ju…

Wow. You are missing it. You are missing where they explicitly stated they sifted around for personal data, numerous times, and you are missing that sifting being what the company was complaining about. Personal as in insurance plans other people have. He explicitly states he did that after he found the bug. You're missing reading most of the post actually.

If that company decided to file charges against him, this HN post is an admission of guilt for a crime.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#656

Post by bob_roberts » Fri, Oct 15, 2021, 6:21 AM UTC

michael_michael wrote: post #559

jameshart wrote: post #512

Earlier quoted context omitted.

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…

I am now questioning the wisdom of having shared this story, and I apologize for derailing the discussion.

fwiw, I found it relevant. It's obviously not _exactly_ the same thing, but "sending an HTTP GET request to a URL" is similar to "viewing HTML source" in that both are totally normally things to expect from a user, so it's hard to see how either could count as "hacking".

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#657

Post by Throwaway43654 » Fri, Oct 15, 2021, 6:54 AM UTC

_dain_ wrote: post #544

victorhooi wrote: post #536

Earlier quoted context omitted.

Yes, but "weev" is also a well-renowned internet "troll". Basically - he appears to take joy out of denigrating, humiliating, insulting and doxxing other people. https://en.wikipedia.org/wiki/Weev He's also a neo-Nazi and white supremacist. I do believe in free speech, but some of the things he does seem to take it way too far. And he famously doxed Kathy Sierra, a female technical writer who created the Head First s…

Bad laws and a corrupt justice system are infinitely more dangerous than a single man, however unpleasant he may be. People pointed out at the time, that the CFAA is totally broken, but nobody listened because the victim was unsympathetic. Well, now we see in TFA how nothing has changed. "Yes, I'd give the Devil benefit of law, for my own safety's sake!" And it should be noted, that weev's turn towards overt neonazis…

Weev was very much a neo-nazi even before he was imprisoned, but I suspect he limited it to private channels.

I once infiltrated some of the IRC channels he used in 2010 or so and have logs of him saying extremely antisemitic things in earnest.

(The groups I infiltrated also doxxed people and used that information in smear campaigns, which is why I'm using a throwaway for this comment. I checked HN's rules and guidelines and couldn't see anything against this; if I'm wrong about this, I apologise.)

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#658

Post by dredmorbius » Fri, Oct 15, 2021, 7:25 AM UTC

SamPatt wrote: post #335

kmlx wrote: post #307

Earlier quoted context omitted.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

Yes. Most online discourse about politics will eventually have someone claim fascism or make a Hilter reference. If you aren't among one of the two sides it can be humorous to watch at times.

"The creator of Godwin’s Law explains why some Nazi comparisons don’t break his famous Internet rule"

https://www.washingtonpost.com/news/the-intersect/wp/2017/08...

"It’s Time to Call Nazis ‘Nazis’"

https://www.thedailybeast.com/its-time-to-call-nazis-nazis

Chap behind Godwin's law suspends his own rule for Charlottesville fascists: 'By all means, compare them to Nazis'

https://www.theregister.com/2017/08/14/godwins_law_creator_r...

And there's the law itself. Mike Godwin takes pains to clarify that it's not about valid or invalid comparison, or who's "winning" or "losing" the discussion, as it is an observation that productive discussion within the thread is over.

Specifically:

  So - *WHAT DOES IT MEAN*? 

   Fine, fine - it means that somebody's eventually going to say
  something about the Nazis in any thread that lasts very long.  When it
  happens, the thread is going to start either degenerating into a long
  flamewar over Nazi Germany or about Godwin's Law.  Either way, the thread
  is effectively over, and you can safely killfile the thread and move on.

...

  2.  What happens if we're actually talking about Nazis?
 
   Then you've already invoked Godwin's Law, and the chances are that
  your thread isn't going to last all that much longer as a sane discussion.
  Them's the breaks.
  
  3.  What about arguing with Neo-Nazis?

   Arguing with Neo-Nazis is probably the quickest path to getting
  Nazi invocations, because, well, they're actually accurate.  Still, trying
  to invoke Godwin's Law near a Neo-Nazi isn't really a good idea because
  it's not terribly original and they'll probably get off on it anyway.
  Just ignore them and occasionally publish a FAQ detailing what actually
  happened during the Holocaust and such; arguing probably isn't going to
  help you.

http://wiki.killfile.org/projects/usenet/faqs/godwin/

This thread has reached the discussion-of-Godwin's-law stage, so there's that.

And remember that "it can't happen here" is also a fallacy.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#659

Post by dredmorbius » Fri, Oct 15, 2021, 7:33 AM UTC

jaywalk wrote: post #380

allemagne wrote: post #323

>Republican state Rep. Tony Lovasco, who according to his legislative biography has worked in software deployment and maintenance, tweeted Thursday that “it’s clear the Governor’s Office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities. >“Journalists responsibly sounding an alarm on data privacy is not criminal hacking,” he said. I worry…

The fact that it happened here should calm your worries at least a little bit.

The fact that it happening is a notable exception to recent political practice should jangle those worries right back up.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#660

Post by soylentnewsorg » Fri, Oct 15, 2021, 7:38 AM UTC

lsaferite wrote: post #437

soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

Asking the web server to give you information without lying or falsifying any of your request data should in no way equate to walking into random houses that are unlocked.

you are falsifying what customer you are. the guy literally said he put in different customer IDs into the URL after he discovered what part of the string was a customer ID. It would equate to a guy walking to your door, saying he's from the electric company, then reading the medical documents on your desk after you let him in.