Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#81

Post by angersock »

rayiner wrote: post #74
msandford wrote: post #45

Earlier quoted context omitted.

You totally nailed it. 100% right. Distilled it down to the essentials of how the internet works and the nature of a protocol as a contract. Bravo.

His whole analogy only works because the librarian is a human, and if a human with some apparent authority lets you do something, you can reasonably infer that you have permission to do it. But you can't anthropomorphize a server like that. It's not a gatekeeper, capable of granting permission, just a dumb lock which may be flawed. Only humans can consent. To repurpose his analogy, if you sneak into the staff room an…

People boil down to dumb locks--if presented with the correct context and input, if they are rational they should by definition grant access.

This library analogy was the best way I've seen the issue put, and one that is actually accurate.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#82

Post by victorf »

nonce42 wrote: post #30

It's worth reading the criminal complaint and indictment ( https://www.eff.org/cases/us-v-auernheimer ) to get some background. In particular: the discussions of using the email addresses for a phishing scheme, using them for spam, shorting AT&T stock and profiting off the data release, setting up WiFi routers so they can blame it on a third party, discussing how this was a federal crime, and how to spin themselves a…

So because there was some thoughtcrime regarding actual criminal activity we should accept the prosecution for scraping the website? No. Prosecute him for identity theft if and after he commits it.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#83

Post by jrockway »

patio11 wrote: post #69
mintplant wrote: post #60

Earlier quoted context omitted.

So if I ask the librarian for a copy of the book with ISBN 1; DROP TABLE books; -- is that okay because, technically, the server let my request through?

This is currently downmodded because people don't like the implication. And they shouldn't, because it quickly forces someone into either a) agreeing with the law or b) saying that SQL injections must be, ipso facto, legal. Including ones like: 1 AND ("1" = SUBSTRING(select social_security_number from employees where employee_name = 'Angela Smith', 1, 1)) You can use variations on this to... a) Ask our librarian for…

I approach this from a different angle. If someone broke into my web app by injecting SQL, I'd be mad that I allowed them to do so. If someone broke into my apartment by smashing the window with a brick, I wouldn't be mad at myself for not using thicker glass.

Therefore, I see SQL injections as sloppy programming, but physical break-ins as sloppy ethics. IMHO YMMV IANAL KTHXBYE.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#84

Post by rayiner »

angersock wrote: post #81
rayiner wrote: post #74

Earlier quoted context omitted.

His whole analogy only works because the librarian is a human, and if a human with some apparent authority lets you do something, you can reasonably infer that you have permission to do it. But you can't anthropomorphize a server like that. It's not a gatekeeper, capable of granting permission, just a dumb lock which may be flawed. Only humans can consent. To repurpose his analogy, if you sneak into the staff room an…

People boil down to dumb locks--if presented with the correct context and input, if they are rational they should by definition grant access. This library analogy was the best way I've seen the issue put, and one that is actually accurate.

I totally didn't understand where you were going with that.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#85

Post by jrockway »

PhasmaFelis wrote: post #34
sneak wrote: post #16

Earlier quoted context omitted.

Weev's a right shithead, you're absolutely right. I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending: "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundr…

By "unpopular speech", do you mean the AT&T bit, or the harassment bit? If the latter, I disagree. A free and fair society can certainly draw a line between "unpopular speech" and "criminal harassment." If I were to threaten to murder you, you wouldn't expect the police to say "Eh, nothing we can do, he's got a right to free speech. Call us back after he shoots you, you'll have a case then."

If I were to threaten to murder you, you wouldn't expect the police to say "Eh, nothing we can do, he's got a right to free speech. Call us back after he shoots you, you'll have a case then."

This is the problem with thought experiments regarding crime: they always make the facts 100% certain, when in real life, the facts are never 100% certain. If we were to rephrase your thought experiment, it would be:

"Some guy said some other guy was going to kill him. Let's throw that some other guy in prison for a while, just in case."

Not quite as clear-cut as you think, is it?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#86

Post by marshray »

gliese1337 wrote: post #13
nym wrote: post #6

Earlier quoted context omitted.

I was with you up until wishing another human dead.

To be fair, there is an important difference between wishing someone got hit by a bus and simply not caring if they did get hit by a bus. I, for one, would not want him dead, as death is rather an overly severe punishment for his actual crimes. I would probably even think it somewhat unfortunate if he actually did get hit by a bus, simply because humans dying in general is unfortunate. But, were it to happen, an hone…

We could also wish that Weev or people like him did not exist, without actually wishing that anyone now alive become dead, or predicting what our feelings might be were such a thing to happen.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#87

Post by bigiain »

cortesoft wrote: post #19
derleth wrote: post #17

Earlier quoted context omitted.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

I don't think it is like walking into a private home because the door is unlocked... this is more like someone walking into a store, looking around, and then getting in trouble for looking at a specific display shelf that was in the back corner. The shelf wasn't labeled as off limits, you just were wondering around where you were supposed to and happen to see it. The store can't get mad and say "well yeah, but we put…

If we want to stretch analogies beyond sense, how about this.

You walk into a cake shop that has cupcakes with names written on the icing:

You say "Can I have a cupcake with 'Iain' written on it?" They say "200 OK, here's a cupcake with Iain on it."

You say "Can I have that wedding cake?" They say "401 Unauthorized, Sorry that's someone elses' cake." You don't get a wedding cake.

You say "Can I have a cupcake with 'Alice' written on it?" They say "200 OK, here's a cupcake with "Alice' written on it."

You say "Can I have a birthday cake?" They say "402 Payment required, That'll be $15" You don't get a birthday cake.

You say "Can I have a cupcake with 'Bob' written on it?" They say "404 Not Found, sorry we don't have any cupcakes with 'Bob'."

You say "Can I have a cupcake with 'Carol' written on it?" They say "200 OK, here's a cupcake with 'Carol' in it."

You say "Can I have a cupcake with 'Dave' written on it?" They say "200 OK, here's a cupcake with 'Dave' on it."

You walk out with 4 cupcakes. Then the cake shop owner comes out and says "You stole the three cupcakes! I didn't intend for you to have them!"

Did you do anything wrong? Do you deserve to go to jail for it?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#88

Post by jebblue »

gwu78 wrote: post #65

Kudos to the WP for ongoing coverage of this case. There are important issues being litigated here that could affect everyone, and I'd argue they are worth discussing without regard to this particular defendant and the sheer stupidity of his actions. However, I find WP's use of Poulson's activities as an example of "legitimate" automated HTML retrieval ("scraping") to be an odd one. It seems an awkward a comparison t…

>> The irony of this has always intrigued me: Google may crawl your servers, but under Google's policies, you may not crawl Google's servers.

It looks like some of their site can be crawled and some not, that's how robots.txt has worked for a long time:

http://www.google.com/robots.txt

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#89

Post by biot »

rayiner wrote: post #74
msandford wrote: post #45

Earlier quoted context omitted.

You totally nailed it. 100% right. Distilled it down to the essentials of how the internet works and the nature of a protocol as a contract. Bravo.

His whole analogy only works because the librarian is a human, and if a human with some apparent authority lets you do something, you can reasonably infer that you have permission to do it. But you can't anthropomorphize a server like that. It's not a gatekeeper, capable of granting permission, just a dumb lock which may be flawed. Only humans can consent. To repurpose his analogy, if you sneak into the staff room an…

Both are gatekeepers. One has been configured with an employee handbook. The other is configured using .htaccess or similar. When making requests of either, how do you know whether you have permission to make the request you're about to make?

If a server cannot consent, does issuing "GET /" to a web server mean you snuck into the homepage and are not authorized to view what the web server was configured to provide to you?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#90

Post by mylorse »

msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime.

That can be construed as impersonation without unauthorized access, which is in some jurisdictions is illegal.

But that is not what AT&T did, which is more like a open brothel with conference rooms and private bedrooms. They just let in anyone that looked in one type of attire, and had some numbered badge come into one of the reserved conference rooms. IoW, the security person did not ask for ID, or a password to enter. The fault lies on the brothel, not the visitor. For all we know, anyone could have come in looking with that attire, and a matching badge out of coincidence (maybe there was a costume party, who knows, still the brothel did not do a good job of securing the reserved conference rooms).

> No password, no HTTPS, no access controls at all. Who is responsible for the security breach? You or the bank?

The bank, they are not complying with the legal statues, and more than likely violating their own privacy policy, if any exist.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access"

That is correct. In that analogy, it would be an open business, like store or malls. It follows jurisdictions of private properties, with some business statues, but overall, since it is an open-doors business, there are no authorization requirements.

> They're prosecuting him for the digital equivalent of walking down a street and taking pictures of houses which don't display numbers on their mailbox.

No. Like in the example above, they are charging him of wearing an attire with a numbered badge, and coming into the reserved conference room, and learning the attendants names or addresses (which should not be there in the first place, esp. with no security protocols). The worst they can charge him is for impersonation. However, what can incriminate him is if the pages he visited clearly displayed or linked the Term of Services or EULA, which does detail this scenario, and he violated it in some way.

Post reply on HN