Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

Post reply on HN
Print view View original

101–110 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#101

Post by jrockway »

SauciestGNU wrote: post #90
jrockway wrote: post #22

Earlier quoted context omitted.

Locks are a terrible analogy for what's going on here. This would be like the government publishing a newsletter, and then writing a bunch of teachers' social security numbers on it in invisible ink. Someone then noticed that you can still read the invisible ink, and then wrote an article about how incompetently the government managed the data. This is a simple case of an egotistical politician who wishes he was King…

I'd say even invisible ink is taking the analogy too far. It's like the government published a newsletter, printed the PII on the back of the paper, and now wants to prosecute the first person to look at the back of the page.

Yeah, that's fair. Comments are a little bit like invisible ink; they look like they're not there because the rendering engine doesn't display them, but they're still sent with every copy of the information.

It would be better if the SSNs were white text on a white background and we were here because someone highlighted the text, though.

Re: Reporter may be prosecuted for using “view source”

#102

Post by tshaddox »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

Another reason the lock analogy is ridiculous is that it’s illegal to trespass on or burglarize property even if there wasn’t a lock.

Re: Reporter may be prosecuted for using “view source”

#103

Post by Supermancho »

wvenable wrote: post #79
Supermancho wrote: post #59

Earlier quoted context omitted.

> With a sql injection, you have to willfully provide an input with the hope that it results in injection If I send you a link that happens to include arguments that happen to be a SQL injection (or my cat steps on my keyboard in just the right way), there was no intent.

Your intent by crafting such a link was clear.

Thats a third party. Youre mixing responsibility and ascribing it to an innocent party. That was the obvious point, with an incidental mention of another (random input) case where innocence is a reasonable deduction. Therefore, it is not necessary for an sql injection attack to be connected with the intent of the actor. Period.

From US caselaw, theres a little history about the not chasing after infected botnet hosts as bad actors.

Re: Reporter may be prosecuted for using “view source”

#104

Post by anigbrowl »

wolverine876 wrote: post #86

Someone - a particular political party - is attacking the free press and freedom generally. The only answer is to be heard, loudly, and vote them out of office. The cavalry isn't coming - nobody will save us but us. It's not a partisan statement. I'm not saying it to favor one party or another (though unavoidably the other party would benefit - we'd be better off with multiple parties committed to democracy). We agre…

I hope you'll give some thought to the scenario where one group in a polity rejects or modifies the electoral franchise as the ultimate mechanism of decision.

Re: Reporter may be prosecuted for using “view source”

#105

Post by [deleted] »

tshaddox wrote: post #94
nixpulvis wrote: post #87

Earlier quoted context omitted.

Still need to make illigal tricking the server into thinking it's OK. This area of law seems rather difficult to codify perfectly, but it's clear that "view source" shouldn't be a problem, since no trickery is involved. Generally, this should be called Honest but Curious behavior.

> This area of law seems rather difficult to codify perfectly Sure, but law doesn’t function by codifying things perfectly. There is no perfect codification of the physical ways one can move one’s fist, but clearly some such ways constitute an illegal act while others don’t.

[deleted]

Re: Reporter may be prosecuted for using “view source”

#106

Post by chrsig »

Supermancho wrote: post #103
wvenable wrote: post #79

Earlier quoted context omitted.

Your intent by crafting such a link was clear.

Thats a third party. Youre mixing responsibility and ascribing it to an innocent party. That was the obvious point, with an incidental mention of another (random input) case where innocence is a reasonable deduction. Therefore, it is not necessary for an sql injection attack to be connected with the intent of the actor. Period. From US caselaw, theres a little history about the not chasing after infected botnet hosts…

You're kind of just describing why it's hard to prosecute based on intent though.

For the purposes of distinguishing between if something is an exploit or not, it doesn't seem too relevant

Re: Reporter may be prosecuted for using “view source”

#107

Post by anigbrowl »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

In general, it's a mistake to operate with the metaphor chosen by someone with whom you have a strenuous disagreement, because the second image rarely has the same cognitive/emotional impact as the first. In this case, a better rejoinder might be 'the door was not locked, and there is no crime in looking through an open door.'

Re: Reporter may be prosecuted for using “view source”

#108

Post by smhenderson »

GuB-42 wrote: post #15

I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open…

The article stated that the prosecutor hasn't commented on any of this yet. Everything you're attributing to the prosecutor was said by Parsons. I'm assuming the prosecutor hasn't commented because he's embarrassed to be dragged into the whole ordeal.

I get that's not the point of your comment but I refuse to even acknowledge that using HTTP as intended without feeding a server a malicious request can ever be considered a crime.

The only crime here is the negligence on the part of the Missouri government and the obvious abuse of power being displayed by Parsons after the fact.

Re: Reporter may be prosecuted for using “view source”

#109

Post by trs8080 »

iypx wrote: post #84
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I believe what we've got today in most countries is pretty ok, maybe ambiguous but it does the job as far as an ethically concerned person would go. In my country they classify it as "unauthorized access". That's perfectly fine with me. In other words, if your server sends it, and you intended to send it, then I can have a look at it. If your server sends it, but you never intended (sysadmin, programmer error, bureau…

> If your server sends it, but you never intended (sysadmin, programmer error, bureaucracy, unsecured servers etc), and it's clear for me the information was never meant to be public, then I'm committing unauthorized access.

So if your server sends privileged data and I "View Source" to see how you implemented some unrelated part of your site and accidentally see that data, I'm now guilty of unauthorized access and should be prosecuted?

How about we shift the burden back to the people who have been entrusted to keep this data secure in the first place?

Re: Reporter may be prosecuted for using “view source”

#110

Post by anigbrowl »

tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

Prosecutors are politicians. Competency is often not the first concern of voters.
Post reply on HN