Comment by gerdesj | Hacker News Reader

Comment by gerdesj | Hacker News Reader

Parent Full thread

"but you're still potentially doing something worth criminalizing."

I had a bit of a think about this. We have an input field, something that invites anything that one might type into it. The input field might constrain what is typed in and the programme behind it might decide to believe the content or not.

Does the input field make it clear that it considers some sorts of input as invalid? I can't recall seeing any login related field that specified its input requirements - that is sometimes part of the "security"(through obscurity) of such things.

IT related security as it relates to logins might be unfairly compared to a front door and keys and other physical security devices. However, few of us have access to enough steel and concrete and other fancy materials for physical security to make this comparison stand. We do have access to wealth of IT security which is freely available. It is bloody complicated but freely available. You do need to be able to sift the good advice from the bad but it is available.

The final bit of the puzzle revolves around responsible disclosure. This is not something you see in the world of safes and front doors. It is an established industry practice in IT, in an industry that is very, very young but one which moves very, very quickly.

Even if the login fields specify that unauth. access is naughty I would argue that given that the tools are freely available and that any reasonably competent developer should be able to sanitise input, then you can't complain if someone types in complete crap.

IT is still discovering Engineering but it has so many more resources for instruction and guidance than bridge builders and boiler makers had in the early days and it moves so fast. Do you have any idea how dangerous steam trains were in the early days? Steam is a bloody powerful thing under pressure. Do you have any idea about resonance and concrete cancer? IT is still having its Tacoma Narrows and ... hah ... Millenium Bridge (hard found lessons can be ignored to this day) things happen.

I'm no lawyer but I suspect the world of m'learned friends will catch up eventually. Until then we will read of silliness like this.

To play the pointy-haired advocate:

However, few of us have access to enough engineers and security experts and other fancy computer wizards for digital security to make this comparison not stand. We do have access to the legal system which is freely available.

"We do have access to the legal system which is freely available."

It is readily available but sadly we have to disagree on what "freely" really means.

If a person is alive, and invites people over, but does not frisk them. Is he not invited someone to stab him to death?

At some point there is reasonable expectation. On all websites worth their salt, input fields are labeled. An input field is not an open invitation to hack the system and bypass it's actual use.

Also, haven't people learned by now that debugging other people's systems can either be rewarded or punished? It's not worth it unless the company has very publicly stated a hack me invitation and reward system.

The analogy to front doors and keys is much more fair than you give it credit for. Do you walk around the neighborhood trying doorknobs to see if they're open? So don't try to exploit a site uninvited.

It was just that: an analogy, and a bad one. In the physical world you don't have Google knocking on the door and taking copies of your photo albums and the contents of your address books, filing cabinets and in return making you look at adverts. You can of course deploy a baseball bat (uBlock etc) for some small, conciliatory, relief at the ads but your data is no longer yours. Its not even the commons, to benefit us all. Your data is simply part of a bloody great marketing machine. Quite an efficient one.

Is https://www.shodan.io/ criminal? They twiddle the doorknobs in everyone's neighbourhood but at least they tell you what they are up to.

Typically the main thing in anti-hacking laws is intent more than actual actions. So if a person by accident causes the system to fail, then they are not guilty, but if they intentionally input something that breaks things then they are guilty. These can be technically very similar events, but legally worlds apart. And if your input is 'or 1 = 1 then that is fairly strong indicator about your intent.

Your intent could be simply to find out whether you want to trust the website with your own information. Merely attempting an SQLI or an IDOR doesn't mean you have intent to download other users' information for your personal gain.

The question of intent would be about the access only (i.e. "did you intend to access data without authorization"), and does not extend to further motives of why you would be doing such access.

What I didn't put in my comment above was that a sufficiently competent engineer might be considered negligent if they failed to allow for say people typing any old rubbish in.

Have you ever jumped up and down on a bridge or other structure? You probably weren't deliberately testing its strength, just idly messing around. You certainly didn't want it to fail (but what if it did?) I'll put money on it that you have done this at some point in your life because we all have at some point.

Were you a hacker? Are you a criminal? What makes adding 'or 1=1' a hack/crack and mucking about? and at what point is it criminal to not be able to filter out crap on input?

The difference between jumping on bridges and SQLi is that at least in these parts of the world I would find it absurd to think that bridge would really fall by jumping on it; on the other hand anyone trying out SQLi knows that it can actually succeed, even with a quite high chance.

Also we have building codes etc that regulate construction work, which gives me such confidence on bridges etc, but there is not equivalent for computers. Maybe there should be (that is another discussion) but that does not affect people doing things today.

Furthermore, even in case of criminal negligence (/lack of due diligence or something along those lines) two wrongs do not make a right; abusing such negligence can still be illegal too.

"Also we have building codes etc that regulate construction work" by that statement I'll assume American.

Are you familiar with this: https://en.wikipedia.org/wiki/Millennium_Bridge,_London ? (also see Tacoma Narrows for the classic example - wind loading, rather than people but resonance is resonance). Bridges do fail when people jump up and down on them or at least cause resonance based effects by simply walking in lock step.

You might be unfamiliar with resonance, which is a right bugger to deal with but Sir NF and co designed a bridge which was a suspension(ish) job but looked flat. It looks lovely but I recall looking at it and having misgivings (easy to say now). To me it screamed transverse loading, which isn't the normal thing that an IT bod shouts about.

He (Sir Norman Foster) had a part to play in this beauty amongst others: https://en.wikipedia.org/wiki/Millau_Viaduct#/media/File:Via... - the WP article does not really do it justice at a glance.

"Also we have building codes etc that regulate construction work ... but there is not equivalent for computers." - My point exactly. There should be, and then perhaps m'learned friends could then get involved to debate the matter with something to work with. At the moment it is bollocks.

I don't understand where you fall on this. Where will the burden of responsibility fall (the 1=1 troll or the people who created the software)? Are you saying that in the same way there are licensed steam union people and inspectors the same will be true of software?

Reply on news.ycombinator.com