Reporter may be prosecuted for using “view source” • Hacker News Board

Re: Reporter may be prosecuted for using “view source”

#41

Post by paulhart » Thu, Dec 30, 2021, 6:09 PM UTC

tschwimmer wrote: post #28

ljm wrote: post #23

Earlier quoted context omitted.

I'm not sure the lock analogy works at all. The reporter asked for a page of information, it contained information that wasn't supposed to be there, and he's being blamed as if his eyes manifested it into existence. Seems more akin to shining a UV light on a piece of paper. (Interesting how the sibling comment came to a similar example with invisible ink.)

I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think int…

There have been many instances where PDFs have been "redacted" by painting black rectangles over the text, but keeping the text intact. I can't think of anyone who has been prosecuted for unredacting those documents - the people who did their jobs poorly are considered liable.

Re: Reporter may be prosecuted for using “view source”

#42

Post by milkytron » Thu, Dec 30, 2021, 6:10 PM UTC

kuroguro wrote: post #31

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

That would make a lot of companies responsible for the data they keep and should be responsible for protecting.

SQL injection can be (and probably is) malicious though, so I suppose it becomes a unclear line for that example. Maybe punishment of both parties would be appropriate but I'm not a lawyer so don't have expertise in law punishments. But I could see this as incentivizing data security. Even if a 0 day is discovered, companies will be less inclined to drag their feet for a patch when one becomes available.

Re: Reporter may be prosecuted for using “view source”

#43

Post by Buttons840 » Thu, Dec 30, 2021, 6:14 PM UTC

TT-392 wrote: post #33

tschwimmer wrote: post #28

Earlier quoted context omitted.

I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think int…

If it was just in the html the website served to you, and it just basically has it written in a way that tells the browser to not display that part of the html. Wouldn't that be closer to handing a journalist a government document with some text, then a line saying: "don't read the stuff below this line", and then a bunch of sensitive stuff below that in plain text?

All analogies are flawed. My main point was that, in terms of the Governor's own analogy, and also literally, the reporter didn't "take" anything.

All analogies aside, intent matters, and the reporters intent was to report a vulnerability and then to report the Government's actions to the public once the vulnerability was fixed. Neither of which are illegal.

Re: Reporter may be prosecuted for using “view source”

#44

Post by OJFord » Thu, Dec 30, 2021, 6:16 PM UTC

paulhart wrote: post #41

tschwimmer wrote: post #28

Earlier quoted context omitted.

I actually like the paper analogy a lot, let's extend it: Say the journalist was instead freely handed a redacted government document on sheets of paper. The reporter notes that it was redacted poorly and the redacting can be peeled off or a bright light can be shined on it to reveal the text underneath. By doing this, is the reporter committing a crime? I have no idea. My intuition says probably not, but I think int…

There have been many instances where PDFs have been "redacted" by painting black rectangles over the text, but keeping the text intact. I can't think of anyone who has been prosecuted for unredacting those documents - the people who did their jobs poorly are considered liable.

A barebones PDF reader implementation would/could not render that 'layer' anyway, so I can't imagine you'd actually lose such a case. (As distinct from not having the will/funds to fight it long enough...)

Re: Reporter may be prosecuted for using “view source”

#45

Post by chrsig » Thu, Dec 30, 2021, 6:23 PM UTC

kuroguro wrote: post #31

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

With a sql injection, you have to willfully provide an input with the hope that it results in injection

my understanding is that the reporter looked at the source that was being sent as intended -- no manipulation of input by the client

Re: Reporter may be prosecuted for using “view source”

#46

Post by mindslight » Thu, Dec 30, 2021, 6:26 PM UTC

kuroguro wrote: post #31

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.

It would make the most sense to define software as a legal agent of those who deploy it.

If an HTTPS server prints OK and returns a document for a straightforward request, then it's manifestly obvious that the owner's agent intended to give you that information. If the owner did not intend that to happen, the issue is between them and their agent. (Think: a customer service rep who didn't follow policy)

Supplying a SQL injection to an HTTPS server would be akin to fraud or false pretenses - like if you walked up to a customer service rep, showed them a fake ID, and asked for information about your account.

(Furthermore, copyright trolls wouldn't be able to wriggle out of their fraudulent DMCA requests by blaming it on software that they themselves deployed)

Re: Reporter may be prosecuted for using “view source”

#47

Post by tyingq » Thu, Dec 30, 2021, 6:31 PM UTC

I'd love to be an "expert witness" and decode a small snippet of base64 on a whiteboard for the jury. Just to show that the lock analogy is bullshit.

Re: Reporter may be prosecuted for using “view source”

#48

Post by trhway » Thu, Dec 30, 2021, 6:35 PM UTC

That is another attack on general computing. Until now an "encryption" has been required to limit your legal ability to handle information legally residing on your computer. Now even the "encryption" isn't needed, just a post-factum statement from the information sender that you used unapproved (according to post-factum given definition of approved) viewer for that information. One can see how MS may for example decide that using an old version of Word or accessing MS site by Firefox instead of Bing or from a Linux computer may be qualified as such a hacking.

Re: Reporter may be prosecuted for using “view source”

#49

Post by crispyambulance » Thu, Dec 30, 2021, 6:35 PM UTC

encryptluks2 wrote: post #6

magikaram wrote: post #4

Alas, yet another article that displays the incompetence of my state's governing body.

Incompetence would mean they have no clue. I genuinely believe that is not the case, and opportunity is really what this looks like here. I've found many politicians and legal professionals to really just use whatever they can to get what they want and throw as much at the wall to see what sticks.. Incompetence at least means some good faith that they do not know better, but I believe in most instances they do but th…

Yes, IMHO, this is very much about governor Mike Parson using the court system as a "weapon" against the reporter (or more likely the newspaper).

It actually doesn't matter that there's no way the prosecution will "win" nor does this have anything to do with caring about information security.

Folks are wasting their breath if they explain why "view source" isn't hacking. The prosecution DOESN'T EVEN CARE.

Hopefully the Post-Dispatch has the resources to aggressively retaliate and take a pound of flesh in return. The charges were likely brought simply because the newspaper is stretched thin and they're either being told to "shut-up" or the governor is trying to pull "a Peter Thiel style" maneuver for some past grievance.

Re: Reporter may be prosecuted for using “view source”

#50

Post by indigodaddy » Thu, Dec 30, 2021, 6:38 PM UTC

lucasyvas wrote: post #17

If this isn't immediately thrown out, there are much worse things to start worrying about.

I would love to also somehow see Parson penalized for egregious waste of government resources and monies on this charade that will go nowhere immediately at trial.

Also the fact that the prosecutors didn’t laugh in his face immediately is rather disappointing. I can I guess understand the Highway Patrol being forced into investigating, but there’s no excuse for the prosecutor not immediately slapping this down.