i had the same reaction at first, omg everyone knows about view source, this is a non-issue it was PUBLIC! But then the argument about "even if your lock is bad, doesn't mean someone can break into your house and steal your stuff." And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl, they just know the normal view did not contain the info and someone did something "extra" and found it. I guess it comes down to how obvious and how "extra". Like what if I sent out a paper newsletter to all my neighbors but printed it on recycled paper that happen to have SSN info on the other side. Is it their fault for do something "extra" like turning the paper over and then seeing the other info?
Reporter may be prosecuted for using “view source”
21–30 of 168 posts
Re: Reporter may be prosecuted for using “view source”
#22> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…
Locks are a terrible analogy for what's going on here. This would be like the government publishing a newsletter, and then writing a bunch of teachers' social security numbers on it in invisible ink. Someone then noticed that you can still read the invisible ink, and then wrote an article about how incompetently the government managed the data.
This is a simple case of an egotistical politician who wishes he was King tussling with the media that is rightfully making him look incompetent. "Anyone who disagrees with me is a criminal" is a common pattern for wannabe dictators. Vote against him at the next opportunity.
Re: Reporter may be prosecuted for using “view source”
#23> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…
I'm not sure the lock analogy works at all.
The reporter asked for a page of information, it contained information that wasn't supposed to be there, and he's being blamed as if his eyes manifested it into existence.
Seems more akin to shining a UV light on a piece of paper. (Interesting how the sibling comment came to a similar example with invisible ink.)
Re: Reporter may be prosecuted for using “view source”
#24I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open…
Intent matters most. If the reporter had compiled a list of every teacher and their personal information by doing nothing more than "View Source", that would be a crime.
If a researcher breaks a few ciphers, and makes no effort to store the plaintext, and reports the flaw, that not a crime.
Re: Reporter may be prosecuted for using “view source”
#25The lock analogy fails. First, the viewer was given the data. Second, obfuscation is not a lock.
Re: Reporter may be prosecuted for using “view source”
#26"Don't look up" I watched it on Netflix last night and I can't get over how well it captures the insanity we witness on a daily basis. It's not a funny movie, it's painful to watch, but that's because it's a reflection of reality. Sure its over blown and silly in places, but it resonates so strongly with the idiocy of our time... It's a test with high specificity: If you don't get the resonance then you are part of t…
I have seen this movie referenced multiple times over the last several days and all I can say is, while I understand the points that McKay is trying to make, it's not funny because it's not funny and it's hardly insightful because it totally lacks any nuance and isn't particularly original. How long ago was Stephen Colbert synonymous with "dumb conservative"?
Trying to claim that if you don't resonate with a film then you're a bad person is a mistake imo.
Re: Reporter may be prosecuted for using “view source”
#27What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this:
I am totally mystified how a competent DA wouldn't have dropped this immediately.
Re: Reporter may be prosecuted for using “view source”
#28> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…
I'm not sure the lock analogy works at all. The reporter asked for a page of information, it contained information that wasn't supposed to be there, and he's being blamed as if his eyes manifested it into existence. Seems more akin to shining a UV light on a piece of paper. (Interesting how the sibling comment came to a similar example with invisible ink.)
I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think interestingly it's not a "definitely not" because 1) it's apparent to the reporter that the redacted information is intended to be private and 2) the reporter took some steps to uncover that information.
It's still not a perfect metaphor. It's not immediately clear that 1) is true here (the reporter probably was not trolling for private information) and it's highly questionable if 2) is true as it seems that this info was being sent along in HTTP responses. What is obvious to me is that that this guy had no malicious intent, took steps to do responsible disclosure (they didn't publish the article until the issue was fixed) and is being targeted by the political establishment as retribution for embarrassing them. Shameful stuff.
Re: Reporter may be prosecuted for using “view source”
#29> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…
I think a better analogy would be if someone looked through your window and saw something that shouldn’t be out in plain sight, called you to hide it, and then you prosecute them because they looked into your house.
Re: Reporter may be prosecuted for using “view source”
#30India also has this kind of stupid vague law that makes ethical hacking partly illegal:
> The contention is over Clause 7 of the Responsible Vulnerability Disclosure and Coordination Policy, released by CERT-In on September 3. According to the clause, the reporting party must “comply with all the extant laws” like the IT Act, Section 43, which bars unauthorised access to systems. while Section 66 prescribes the corresponding punishment (jail and/or fine).
> “Independent security experts may gain unauthorised access to a network when probing a system but they do so to study the vulnerabilities. So while their intent is not malicious, it could be seen as wrong under the IT Act, which is what this policy reinstates,” explains Rohin Garg of Internet Freedom Foundation (IFF), a New Delhi NGO that works to defend digital rights.
Source: https://www.deccanherald.com/metrolife/metrolife-on-the-move...
More here - https://internetfreedom.in/dont-penalise-cybersecurity-resea...