Hacker News Reader

Comment by clouddrover | Hacker News Reader

But the difference is that a website is built to be publicly accessible on the public internet.

Your car, presumably, is not offered as a public resource.

Except this data was obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

If you are just iterating through an archive, it would be impossible to know whether foo.php?id=24530 was linked to anywhere or not. It seems crazy to criminalize this sort of thing.

But it was, precisely, reachable from a public-facing portion of the site!

You’ve never heard of an API then?

This is silly. Your door analogies have no place at all.

A great many websites work this way.

Unless you’re injecting metacharacters into URLs, or requesting AAAAAAAA * 65535 followed by shellcode, changing paramter values is using HTTP exactly as designed, and a well-formed request has many possible error codes for the exact purpose of letting you know what you are allowed to access.

It’s perfectly normal for people to alter URLs. The fact that people who are unfamiliar with URLs don’t do that is irrelevant, and you could say the same for any subject. Just yesterday I changed lat= and lon= to get a NOAA forecast. Is that snooping or hacking? How about when we change the integer at the end of an XKCD comic to view another one without previously confirming there is a hyperlink somewhere?

At least in the Weev case, people could take his IRC logs out of context as well as argue the fact that it was plainly obvious that the server was misconfigured and he was seeing content that he should not. But getting a response when incrementing an integer, generally speaking, does not mean you are viewing something unintended for you. When you are downloading public documents, it would be entirely unreasonable to assume that the material was non-public.

Also, take a step back to really think about what you are advocating. Is society better off by ruining this kid’s life? It blows my mind that someone even remotely technical can think this particular case is a good use of the justice system, or can even compare it to someone snooping around their neighborhood and trying their doors.

Supporting your examples, in previous GIS work I have iterated through a series of public URLs with file ID integers in them (Corresponding with individual document IDs) to batch-mirror whole public GIS datasets from government websites. This was on a public server, no http authentication or username/password, just something that was presented with a terrible javascript user interface only designed to retrieve one file at a time, slowly. Exactly the sort of thing that got this guy arrested.

I agree, even if we assume what he did is illegal, its sort of like impounding someone's car and arresting them for dangerous driving because they went 1 mph over the speed limit. We don't do that even though it is technically illegal because that would not be a good use of the legal resources we have, which are finite. Same thing if we arrested and imprisoned everyone who fiddled with url parameter, it would be a waste of finite resources. Probably a phone call saying 'Hey can you please stop doing that would suffice in most cases.

> obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

Doesn't seem obvious to me. So now I have to check for a specific anchor to a URL to see if a URL is considered publicly accessible?

Reply on news.ycombinator.com