Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

Post reply on HN
Print view View original

151–160 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#151

Post by Supermancho »

wvenable wrote: post #142
Supermancho wrote: post #103

Earlier quoted context omitted.

Thats a third party. Youre mixing responsibility and ascribing it to an innocent party. That was the obvious point, with an incidental mention of another (random input) case where innocence is a reasonable deduction. Therefore, it is not necessary for an sql injection attack to be connected with the intent of the actor. Period. From US caselaw, theres a little history about the not chasing after infected botnet hosts…

If you commit wire fraud through an innocent intermediary, you're still guilty of wire fraud. If you give someone a link that's an attack and they unknowingly run it, then you're the one at fault not the person clicking the link. I think it's pretty straight forward.

> an SQL injection could also be "just a query parameter" and the server would haply reply with a 200. (true)

> With a sql injection, you have to willfully provide an input with the hope that it results in injection (false)

> If I send you a link that happens to include arguments that happen to be a SQL injection (or my cat steps on my keyboard in just the right way), there was no intent. (true)

> Your intent by crafting such a link was clear. (irrelevant)

You can have SQL injection without intent, as I have adequately explained.

This redirection to an "original actor" is a bad faith argument toward finding if there is someone culpable. The poster I responded to, made a bad general assertion and I stand by it. GL with whatever.

Re: Reporter may be prosecuted for using “view source”

#152

Post by c1ccccc1 »

iypx wrote: post #84
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I believe what we've got today in most countries is pretty ok, maybe ambiguous but it does the job as far as an ethically concerned person would go. In my country they classify it as "unauthorized access". That's perfectly fine with me. In other words, if your server sends it, and you intended to send it, then I can have a look at it. If your server sends it, but you never intended (sysadmin, programmer error, bureau…

Let's say I'm viewing a webpage, and I'm curious about some aspect of how it's implemented. I click "view source", and see something that isn't supposed to be there. Is the conclusion "whoops, guess I'm a criminal now"? Shouldn't there be some way for people to avoid committing a crime besides knowing in advance that a website is going to send them private data?

You could say, "obviously stumbling across the data is fine, as long as you then responsibly report the issue, or ignore it and go on with your day. It's only illegal if you then go on to do nefarious things with it." But this is exactly what the current system is failing at by prosecuting this reporter.

Getting the hacking issue right should not be this hard. In practice, it's pretty obvious what's hacking/unauthorized access and what isn't.

In the hacking category: SQL injection. Breaking DES. Cross site scripting attacks. Tracking cookies and browser fingerprinting, arguably.

In the not-hacking category: Incrementing integers in the URL. "Breaking" rot13. Using "view source".

Re: Reporter may be prosecuted for using “view source”

#153

Post by sblom »

smhenderson wrote: post #85
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

Powerful Hacking Tool view source Even the FBI agent quoted in the article got it wrong, stating “allowed open source tools to be used to query data that should not be public.” - as if proprietary browsers don't provide a View Source feature, only "evil" open source tools. Maybe I'm reading too much into it and it's a minor mistake but given the context even a potentially innocuous statement like that rubs me the wro…

Totally possible that an FBI agent would be using the intelligence community sense of "open source" meaning "publicly available", rather than the sense of "open source" that's the mode around here.

Re: Reporter may be prosecuted for using “view source”

#154

Post by zenlf »

From Cuomo to this, I came to the realization that probably it’s not the governors really believed what they do or what they say, by shifting the public focus to something else more bizarrely, more outrageous, they will successfully quell any demands on accountability.

Re: Reporter may be prosecuted for using “view source”

#155

Post by _y5hn »

chii wrote: post #148
dtgriscom wrote: post #144

Earlier quoted context omitted.

You send a query string to a server with the hopes that the server will give you what you want. Isn't that the World Wide Web? Proving "intent" is much harder than proving action. And, to me it seems bad for the law to enforce based on whether the server's authors "wanted" to provide a specific piece of information.

Intent is something that is considered in murder homicide cases, so why not in these cases too?

Because murder is a crime, intent is not.

Re: Reporter may be prosecuted for using “view source”

#157

Post by chii »

_y5hn wrote: post #155
chii wrote: post #148

Earlier quoted context omitted.

Intent is something that is considered in murder homicide cases, so why not in these cases too?

Because murder is a crime, intent is not.

To differentiate between murder and manslaughter (say, due to negligence), the idea of intent (or state of mind) is taken into account.

Re: Reporter may be prosecuted for using “view source”

#158

Post by _y5hn »

vineyardmike wrote: post #97
nobleach wrote: post #62

Earlier quoted context omitted.

I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it co…

> wouldn't an expert be consulted?? All the prosecutes need is an expert that says "Base64 is an encryption. Sending data encrypted means they don't want you to read it.. they tried to break encryption and succeeded when they werent supposed to" And then just fear-monger the risk of broken encryption and government and how you have to try to break it and its dangerous or something. Lots of people claim to be experts,…

Base64 is a well-known plain-text encoding format. Using it as an encryption format violates privacy laws.

Re: Reporter may be prosecuted for using “view source”

#159

Post by _y5hn »

tomp wrote: post #138
wolverine876 wrote: post #134

Earlier quoted context omitted.

You'll have to back that up somehow. I strongly believe that that it is false - for generations, both parties supported the free press and put freedom and democracy first. Even in Watergate, it was a narrow attack on the press and the Republicans eventually turned on Nixon. That is no longer true. The world isn't equal, and both-sidism is a great way to try to divert people from taking action - nobody is wrong or evi…

Obama, Trump, Hillary, Biden - all conspiring against Assange & Snowden. All droning innocent civilians. Both parties seem quite content with cancelling people & banning them from social media (the only thing they cannot agree on, is which people). What more proof do you want? Also, I don't understand your point. If anything, "they're all bad" should motivate people to take more action.

They're all bad is something said in retarded countries like China and Russia. It becomes truth because action becomes oppressed.

Re: Reporter may be prosecuted for using “view source”

#160

Post by _y5hn »

chii wrote: post #157
_y5hn wrote: post #155

Earlier quoted context omitted.

Because murder is a crime, intent is not.

To differentiate between murder and manslaughter (say, due to negligence), the idea of intent (or state of mind) is taken into account.

There is nothing illegal about reading what was sent to you though.
Post reply on HN