111–120 of 210 posts
Earlier quoted context omitted.
Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.
To be fair, leaving a SQL injection hole makes it pretty dynamic.
Earlier quoted context omitted.
"A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?" This was only a few lines below that.
You're going down dicey waters there. Say your neighbor has an atrium and gets medication delivered. Said medication is clearly labeled as light/heat sensitive, and the package is left by the delivery person in direct sunlight. Their front door is unlocked. You open the door and tuck the package safely inside. Breaking and entering? Anyone telling me that qualifies has some serious thinking on Mens Rea to do.
https://www.law.cornell.edu/wex/breaking_and_entering
Breaking and entering is the entering of a building through force without authorization. The slightest force including pushing open a door is all that is necessary. Breaking also includes entering a building through fraud, threats, or collusion. To constitute entering, it is sufficient if any part of the accused’s body is introduced within a building. It is not considered breaking and entering if the premises are at the time open to the public or the person is licensed or privileged to enter.
I completely agree though that nobody in their right mind should want to prosecute you for this. This is the differences between the actual letter of the law as it would be applied by a computer algorithm automatically and a good judge / jury that interprets the law and the facts.
Earlier quoted context omitted.
It probably won’t even get to jury. It might get dismissed with prejudice before it goes to trial.
For a case that could potentially embarrass the state, I'd think the prosecution would try hard to make sure the case appears on the right judge's docket.
Earlier quoted context omitted.
Has I said in another comment, it is not about education or intelligence. Read the article. The politicians trying to intimidate the St Louis Post Dispatch have a history of intimidation against journalists. Demagoguery is unfortunately a chronic condition of democracy.
Any thoughts on how to tailor political systems to work around demagoguery but maintain functioning democracy?
Executive presidency/governor systems, like those used in the US, have a generally higher dependency on individuals behaving properly.
> The reporter discovered that the source code of the website contained Social Security numbers of educators. The reporter alerted the state about the social security numbers. After the state removed the numbers from the web page, the Post-Dispatch reported the vulnerability. I really hate the idea that trying to do the right thing (reporter telling MO DoE about SSNs being in their HTML) results in prosecution to sav…
Not necessarily. The SSNs were returned in search results from an HTML form. Last I checked, google's crawlers don't POST forms.
> If somebody picks your lock on your house It's not like picking a lock. It's more like turning over a sheet of paper to read what's on the other side. If this guy gets convicted, I'll eat my hat (I wear a fedora). "Thy just thow their fedora wherever the floor is And start doing horas and taps".
"A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?" This was only a few lines below that.
It's more like if the New York Times dropped a newspaper at your house with the answers to next week's crossword puzzle included on the page.
Earlier quoted context omitted.
I don't know why you're surprised. The courts have shown time and again that they are part of the establishment (that includes the civil service and government), and will act in accordance with government wishes most of the time. "Yes, Minister" was documentary not fiction (also, since we seem to be remaking/rebooting everything good, can we have an updated version of this, please?)
They did remake Yes Minister. It was Not Very Good. This, incidentally, is precisely the sort of thing that Humphrey would stop Hacker doing, if Hacker had the ability, which he didn’t. The only times Humphrey lets Hacker indulge in overreach are to put him in a situation that Humphrey can then save him from.
Thanks, I must have missed it. I'll check it out (even if it's crap).
I agree with your take on it, I was more indicating that the way Things Are Supposed To Work is almost not How They Actually Work, and usually that's How The Old Boy Network Want Them To Work.
Earlier quoted context omitted.
That's not a better analogy. The implication is that somehow the raw HTML is more valuable than the rendered webpage. You don't get to publish a "rendered webpage"; what you publish is raw HTML. If you didn't want people to read it, you didn't ought to have published it. [Edit] Also, taking a copy of the HTML isn't like taking keys and a purse. If you take keys and a purse, the owner has been deprived of them. That's…
The keys and purse don’t represent the raw html, they represent the social security numbers that were visible in the raw html. The front door was wide open in that this information should have been kept in the backend, not the frontend. It's a good analogy.
The "open front door" analogy works in some instances of "hacking," like enumerating an ID field in a URL. But in those cases you are making an active request to "enter the door" for each ID. That's not the case here – you downloaded a page you have access to, and the server included more data in the page than it should have, without you asking for it.
It's like somebody tossed a phone book into your open door, and then prosecuted you for reading it.