> Or maybe universities and organizations could teach their employees to handle network security better. I don't think this is grounds for a criminal case.
Actually it is. If you try my car/house door and it's unlocked it doesn't mean you can enter it.
That being said, a fine would be appropriate in this case since minimal harm was done.
> If you try my car/house door and it's unlocked it doesn't
> mean you can enter it.
Think of it this way. It is reasonable to assume that a server which responds to http requests on the internet is intended for public browsing. However, a printer that responds to un-authenticated job requests over the internet much more likely to be a configuration error, then intended for public use.
I think a print server at a university is pretty obviously not fair game. If you forget to lock up your business overnight and someone walks in and prints off a couple thousand pages using your printer it's definitely illegal.
Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access.
Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"?
To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.
Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it.
It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.
I agree with you on the ethics/morality of it all.
That literally never happens. It's possible in theory, but in practice, if you encounter such a thing and send it a print job, you know you're accessing it without permission.
If you don't have permission and you know you don't have permission and you still do it, that's illegal. Analogies about librarians don't help.
The lack of technical enforcement of the permission is irrelevant.
I'd say breaking into a computer is more like breaking into someone's mind (something like inception if it exists) rather than breaking into their home. I know it sounds counterproductive to the case in hand but that's because I have no intention of defending weev. I just want us to get out of this idea that we have to somehow tie everything in computers with an analogy like breaking and entering a house.
Downvote away. And this will keep happening. Grats on that.
Keep fighting with reality, let's see how that goes.
The first time is a learning experience, the second time is a demonstration of incompetence.
If you can all your competent people the first time they make a mistake, suddenly you won't have competent people anymore in your misguided quest for perfection.
Specifically what law did he break?
If someone leaves you a voicemail with a message you don't agree with, is that a crime?
If someone sends you a fax with the same message, is that a crime? [1]
If someone sends you an email with the same message, is that a crime?
If you connect a printer to the internet and someone sends the printer a document with the same message, is that a crime?
I'm sure someone can find a way to apply the CFAA to this, but at the end of the day a printer is not a house. A printer connected to the internet is a server that turns files into paper documents. If you don't want people using your printer, don't place it on the internet with zero authentication or access controls.
[1] advertisements are illegal, not sure about arbitrary messages.
But we don't need to speculate about motivations. There is very little functional difference between a fax machine and an unsecured printer. The addressing scheme and transmission protocol are different, and the fax is limited to B&W, but those are the only differences of form or function. The differences are in the expectations that some people have. They'd shred obnoxious faxes without comment, but at least for now they won't do that for obnoxious printouts.