Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

231–240 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#231

Post by tokenizerrr »

gwbas1c wrote: post #168
ynniv wrote: post #60

Access that does not require authentication should never be a crime. If LinkedIn wants the courts to intervene, they must require authentication for their data. If they also want Google to scrape their site, they must require Googlebot to authenticate itself.

> Access that does not require authentication should never be a crime. Careful, this could legitimize things like accidental denial of service. Depending on circumstances, even basic scraping could cause problems. (I need to be vague to avoid violating an NDA.) A major internet site had a URL that went something like somedomain/group?id=xxxxx. It turns out that a simple scraper, that called id=1, id=2, id=3, ect, ect…

Honestly that just means the website sucked and it went down because it sucked. Making it not suck is the solution, persecuting the people who stumbled into your suckiness is not.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#232

Post by [deleted] »

da_chicken wrote: post #198
abpavel wrote: post #180

Earlier quoted context omitted.

Are you suggesting that someone should do time for running a script that happen to stumble on one of your bugs?

If the activity caused actual damages and was outside the scope of normal usage? Yes. You're still culpable if your actions break your neighbor's window, even if it was accidentally while you were opening it.

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#233

Post by guywaffle »

rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

Not true. When you make a HTTP REQUEST, you’re not accessing a piece of private property. You are requesting information. Just because it is requested doesn’t mean it has to be served.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#234

Post by leggomylibro »

exolymph wrote: post #219
cmiles74 wrote: post #199

Earlier quoted context omitted.

Weev went to jail for exploiting a similar flaw in AT&T's website[0]. They had a page that, when provided an ICC-ID, would return the matching customer's email address. He supplied a range of valid ICC-IDs and scraped the returned addresses. He was eventually convicted[1]. [0]: https://arstechnica.com/gadgets/2010/06/ipad-3g-user-e-mail-... [1]: https://www.wired.com/2013/03/att-hacker-gets-3-years/

And while Weev totally sucks as a person, IMO, it was wrong for him to be convicted in this case. He was punished from AT&T's negligence.

Although, not purposefully exfiltrating loads of data after you've found a vulnerability is like, ethical reporting 101.

Otherwise you get situations like Uber paying out an enormous "bug bounty" totally-not-in-exchange for having their stolen data destroyed. If that person had simply pointed out that they had credentials published in a public repository, how much would they have been paid? Probably somewhere within an order of magnitude of the program's stated maximum payout.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#235

Post by marcosdumay »

alexdoma wrote: post #210
feelin_googley wrote: post #203

Here is an example of the "good bot"/"bad bot" nonsense in action. This is an article about the LinkedIn v hiQ case at AdWeek. curl --user-agent INSERT_ANYTHING_HERE http://www.adweek.com/digital/rami-essaid-distil-networks-guest-post-linkedin-hiq-labs/ It seems AdWeek can distinguish a "good bot" from a "bad bot" irrespective of the behavior of the user^W bot, i.e., whether it is one single HTTP request or 10,000 co…

What would be a better solution, IP address check to allow only known google crawlers perhaps?

The real solution is disallowing behaviors, instead of shibboleths.

It's surprising that malicious bots aren't exploiting those things already.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#236

Post by marcosdumay »

ikeboy wrote: post #14
diggan wrote: post #12

Earlier quoted context omitted.

> robots.txt violations being considered hacking Hm, I disagree. Either information is public, no matter for who. Or the information is private, and you should have ACL for accessing the information. I don't think it's fair to say that information is public if you're a human but private if you're a machine, or vice versa. It's not about if it's difficult to build but rather the principle behind if you can just allow…

Why is discriminating against robots unfair? There are valid reasons (for instance, robots take a lot of resources to serve and don't lead to revenue).

What is exactly the difference between a robot and a person using a browser?

Does an ad-blocking browser counts as a bot or as a human? And what is something that concatenates all of your infinite scrolling to represent a paginated view? What is something that changes the structure of your page? What is something that concatenates different pages before displaying?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#237

Post by jacquesm »

us0r wrote: post #193

What makes this extra ridiculous is the fact LinkedIn built its business on scraping not publicly available information but private address books of unsuspecting users.

And spamming those contacts with requests to join that looked as if they originated from your business relations when that definitely wasn't the case.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#238

Post by Frqy3 »

jstarfish wrote: post #157
ikeboy wrote: post #126

Earlier quoted context omitted.

You can put up a "no trespassing sign" on your property (although there's some debate as to how much that actually counts for - a quick search pulls up https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... )

Robots.txt is not a 'no-trespassing' sign. Robots.txt is a 'whites-only' sign. The information is available to the public, just not for certain classes. This is and should be legally unenforceable. If something is truly meant to be private it should not be referenced from a public-facing page or it should have access control enabled.

In this case it is a "white bots only" sign, as it allows some bots but wants to block the rest.

Even for those who think that robots.txt should be enforceable, allowing some bots but not others makes it difficult for a new player to have the same equitable access to information as the big players.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#239

Post by hardtke »

ikeboy wrote: post #9

>good bots You mean, bots that obey robots.txt? https://www.linkedin.com/robots.txt very specifically prohibits scraping by any bot besides a small whitelist. robots.txt compliance is not difficult to build. I'm fine with robots.txt violations being considered hacking.

If robots.txt allows Google and Bing but nobody else, it should be ignored. If it blocks everyone, then I agree. We need to make sure that the next Google has a chance to succeed.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#240

Post by andreareina »

alexdoma wrote: post #210
feelin_googley wrote: post #203

Here is an example of the "good bot"/"bad bot" nonsense in action. This is an article about the LinkedIn v hiQ case at AdWeek. curl --user-agent INSERT_ANYTHING_HERE http://www.adweek.com/digital/rami-essaid-distil-networks-guest-post-linkedin-hiq-labs/ It seems AdWeek can distinguish a "good bot" from a "bad bot" irrespective of the behavior of the user^W bot, i.e., whether it is one single HTTP request or 10,000 co…

What would be a better solution, IP address check to allow only known google crawlers perhaps?

Classify IPs based on their recent behavior[2]. Most bots behave very differently from the median user, along many different dimensions -- volume of requests, time between requests, visit length, which links are followed, etc.

And if this means that bots are altered to become indistinguishable from users, and therefore have a minimal impact on a site's loading? Well, mission accomplished[1].

[1] https://xkcd.com/810/

ETA: [2] Recent behavior (as opposed to all historical behavior) is used so that someone inheriting a "bad" IP isn't completely screwed over.

Post reply on HN