Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reporter may be prosecuted for using “view source”

stltoday.com

Post reply on HN
Print view View original

61–70 of 168 posts

Re: Reporter may be prosecuted for using “view source”

#61

Post by ensignavenger »

tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

The county prosecutor just got the case from the MSHP. It awaits to be seen what the prosecutor does with it- I imagine there are some political pressures at this point. But if prosecution proceeds, it will be a waste of taxpayer money, as it highly unlikely it succeeds.

Re: Reporter may be prosecuted for using “view source”

#62

Post by nobleach »

Bud wrote: post #56
tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

This is Missouri. It might be hard to find a competent DA in the entire state.

I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it comes to prosecution, wouldn't an expert be consulted??

Re: Reporter may be prosecuted for using “view source”

#63

Post by ZoomerCretin »

tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

>I am totally mystified how a competent DA wouldn't have dropped this immediately.

Competence and morality aren't the most important factors here. Some people want to advance their career, even if it means screwing over someone like this. The governor probably wanted to shift blame away from himself and his administration, and is likely willing to make promises or exchange favors to further that goal.

Re: Reporter may be prosecuted for using “view source”

#64

Post by dfxm12 »

tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

Missouri Gov. Mike Parson on Dec. 29, 2021, talks about possible charges against the Post-Dispatch from the Cole County prosecuting attorney after the paper in October alerted officials to a data vulnerability on a state website.

Whistleblowers getting punished is just a feature of an authoritarian regime. It has little to do with competency.

Re: Reporter may be prosecuted for using “view source”

#65

Post by tyingq »

Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

I'd say it's like you left one piece of paper, from a pad, that was just under a handwritten "secret document" out on a table in a public park.

Then a reporter came along and rubbed a pencil on it, revealing the writing from the sheet above it.

Re: Reporter may be prosecuted for using “view source”

#66

Post by tyingq »

ZoomerCretin wrote: post #63
tyingq wrote: post #27

What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.

>I am totally mystified how a competent DA wouldn't have dropped this immediately. Competence and morality aren't the most important factors here. Some people want to advance their career, even if it means screwing over someone like this. The governor probably wanted to shift blame away from himself and his administration, and is likely willing to make promises or exchange favors to further that goal.

Seems risky though. A judge or jury could then publicly hand you your ass making you look incompetent.

Re: Reporter may be prosecuted for using “view source”

#67

Post by dfxm12 »

akersten wrote: post #10

We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…

I think existing laws are OK, if not enforced properly (laws are different jurisdiction to jurisdiction, so I don't know what exact law this guy is being accused of breaking). Usually, though, in court, you do have to prove intent in a criminal case. That this case is against the state, though, is probably unlucky. The governor doesn't want to appear to have egg on his face, even if it would be better for the good people of Missouri if he would just say "thank you" and delegate the responsibility of fixing the issue to the right person.

Re: Reporter may be prosecuted for using “view source”

#68

Post by 908B64B197 »

ljm wrote: post #23
Buttons840 wrote: post #18

> “If somebody picks your lock on your house — for whatever reason, it’s not a good lock, it’s a cheap lock or whatever problem you might have — they do not have the right to go into your house and take anything that belongs to you,” Parson said. The reporter did the equivalent of noticing a lock was rusted through and barely hanging on. He poked the lock and it crumbled to pieces. He didn't take anything, he reporte…

I'm not sure the lock analogy works at all. The reporter asked for a page of information, it contained information that wasn't supposed to be there, and he's being blamed as if his eyes manifested it into existence. Seems more akin to shining a UV light on a piece of paper. (Interesting how the sibling comment came to a similar example with invisible ink.)

At least the invisible ink is an attempt at hiding the information. A comically bad attempt but still an attempt.

A better analogy would be that the state sent the journalist a document with everything readable in regular light, and a separate sheet that tells him which words he must redact. There was no attempt to conceal information, and worse, the redaction list would have been promptly ignored by anyone using a screen reader or other accessibility devices.

Re: Reporter may be prosecuted for using “view source”

#69

Post by ozfive »

nobleach wrote: post #62
Bud wrote: post #56

Earlier quoted context omitted.

This is Missouri. It might be hard to find a competent DA in the entire state.

I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it co…

It's really not though. Even my parents know and understand what view source is in the browser. A browser is simply a way to render information sent. Once it was wilfully sent and in your browser you are not accessing a machine in a criminal way. I hope that if they even try to bring charges the reporter and the newspaper counter sue for violation of rights. Mozilla and the Chrome team need to weigh in on the defendant side. Anyone here from those teams willing to stand up for this guy?

Re: Reporter may be prosecuted for using “view source”

#70

Post by mikojan »

andrewfromx wrote: post #21

i had the same reaction at first, omg everyone knows about view source, this is a non-issue it was PUBLIC! But then the argument about "even if your lock is bad, doesn't mean someone can break into your house and steal your stuff." And I tried to look at that from the point of view of a normal non-tech person who doesn't know about view source or curl, they just know the normal view did not contain the info and someo…

I don't see no extra in either of these situations.

I am living in an apartment complex and I wouldn't mind if someone noticed my keys in my front door, opened that door, took a look and called out for me.

This cannot possibly register as breaking in?

I am not even talking about motive here. The actual event in my mind is clearly benign.

Post reply on HN