Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

Post reply on HN
Print view View original

31–40 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#31

Post by kuroguro »

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

Re: Reporter may be prosecuted for using “view source”

#32

Post by hitpointdrew »

dead_alchemy wrote: post #29
Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

I think a better analogy would be if someone looked through your window and saw something that shouldn’t be out in plain sight, called you to hide it, and then you prosecute them because they looked into your house.

Exactly! It's like if someone was not trespassing (they are on a public road/sidewalk) and looked in your windows and saw you standing there naked. Then you get upset and demand they be arrested. It's YOUR responsibility to draw the shades, or only walk around naked in front of windows that do not have a clear view to a public space.

Re: Reporter may be prosecuted for using “view source”

#33

Post by TT-392 »

tschwimmer wrote: post #28
ljm wrote: post #23

Earlier quoted context omitted.

I'm not sure the lock analogy works at all. The reporter asked for a page of information, it contained information that wasn't supposed to be there, and he's being blamed as if his eyes manifested it into existence. Seems more akin to shining a UV light on a piece of paper. (Interesting how the sibling comment came to a similar example with invisible ink.)

I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think int…

If it was just in the html the website served to you, and it just basically has it written in a way that tells the browser to not display that part of the html. Wouldn't that be closer to handing a journalist a government document with some text, then a line saying: "don't read the stuff below this line", and then a bunch of sensitive stuff below that in plain text?

Re: Reporter may be prosecuted for using “view source”

#34

Post by CPLX »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

A better analogy would be if you sent a letter asking the government for specific public personnel records and they just Xeroxed their entire private file and sent it to you without reading it.

Re: Reporter may be prosecuted for using “view source”

#35

Post by andrewflnr »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

There was no lock. The door was open with an "open house" sign and the owners were just hoping you wouldn't notice the sensitive documents lying on the table.

Re: Reporter may be prosecuted for using “view source”

#37

Post by BeetleB »

GuB-42 wrote: post #15

I think that it is a bit far fetched here but where do you draw the line between what is an intrusion and what is not? To continue with the prosecutor analogy of the lock, having a shitty lock doesn't allow others to enter your house, but what if there is no lock, and what if the door is wide open? If you write "do not look" on top of your source code, can you prosecute someone who looked at it? If not, can you open…

As mentioned in another thread, the lock analogy/trespassing analogy makes no sense here.

This is a case of A requesting something from B, and B giving A stuff they shouldn't have, and prosecuting A for noticing it.

At no point did the journalist go into anyone's property/territory. The site simply handed out the confidential stuff.

Re: Reporter may be prosecuted for using “view source”

#38

Post by jdavis703 »

kuroguro wrote: post #31
akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

SQL injection is probably malformed input in lots of cases and should return a 400 Bad Request. If you are returning a 200 maybe you really did want to take SQL (think of Mode or PHPMyAdmin).

Re: Reporter may be prosecuted for using “view source”

#39

Post by riffic »

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

Context on the AT&T thing (which was overturned on an appeal):

https://www.wired.com/2014/04/att-hacker-conviction-vacated/

https://arstechnica.com/tech-policy/2013/03/auernheimer-aka-...

Re: Reporter may be prosecuted for using “view source”

#40

Post by jdavis703 »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

This lock analogy is terrible. It’s like a business putting the wrong price tag on a product and then claiming people who bought a smartphone for $1 instead of $500 were stealing because they didn’t halt the transaction for what’s obviously a bogus price.
Post reply on HN