91–100 of 210 posts
Am I to understand that a state governer has the power to instruct some lacky-lawyer to charge someone with a crime, and to prosecute them for that crime? In the land of the free, this is not an independent process?
Earlier quoted context omitted.
It’s a good analogy in terms of how far the “breaking into” stuff you go. The journalist literally only saw what you legitimately see from the street, just as “view source” only shows you what you’re supposed to see anyway. As far as the technical analogy goes, I’d probably agree.
The technical analogy is the only correct one. The other analogies are just plain wrong. This data is what forms the page that is displayed and is accessible to anyone that can tap the server. This data is what they broadcast to the public You wouldn't be able to go and shout a bunch of SSNs in the middle of the street and then prosecute anyone who was listening
Shouting your information in public is not and should not be grounds to prosecute those who are listening.
I really hate the idea that trying to do the right thing (reporter telling MO DoE about SSNs being in their HTML) results in prosecution to save face instead of reflection and congratulations. This is how you get more crime.
Also, REALLY?!
That means that Google indexed those SSNs!
Earlier quoted context omitted.
> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1]. [1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...
Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.
Earlier quoted context omitted.
It’s a good analogy in terms of how far the “breaking into” stuff you go. The journalist literally only saw what you legitimately see from the street, just as “view source” only shows you what you’re supposed to see anyway. As far as the technical analogy goes, I’d probably agree.
The technical analogy is the only correct one. The other analogies are just plain wrong. This data is what forms the page that is displayed and is accessible to anyone that can tap the server. This data is what they broadcast to the public You wouldn't be able to go and shout a bunch of SSNs in the middle of the street and then prosecute anyone who was listening
That you focus on the technology side, fine, but don't dismiss people who say the "theft" is not in fact theft, regardless of "technology" involved.
2 birds, one stone. Politicians can get away doing what they want with whatever reason. And politicians are being used to make the internet more opaque. Since 'view source' is being made a scapegoat, expect it to disappear soon.
It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter…
What is this “encoded viewstate” of which you speak? It’s my impression that the reporter didn’t have to go so far as thumbing over to the network tab or otherwise open any envelopes, the social security numbers were instead embedded in HTML, just not visible in the painted layout. Kudos for attempting a framing for the prosecution, but I don’t think there are laws against opening mail addressed to me. Edit: just saw…
I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still tr…
I can't believe the defense wouldn't be able to present an expert witness / cross-examine the prosecution's on the distinctions between "encoding" and "encrypting."
If base64 is an encryption, then so is jpeg or *.docx .
Earlier quoted context omitted.
"A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?" This was only a few lines below that.
That's not a better analogy. The implication is that somehow the raw HTML is more valuable than the rendered webpage. You don't get to publish a "rendered webpage"; what you publish is raw HTML. If you didn't want people to read it, you didn't ought to have published it. [Edit] Also, taking a copy of the HTML isn't like taking keys and a purse. If you take keys and a purse, the owner has been deprived of them. That's…
I say the example is good.