Hacker News Reader

Comment by hug | Hacker News Reader

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet.

So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files.

Turns out some of them were mislabeled, and were private information in the public information filing cabinet.

Not so weird, not so antisocial, not his fault, shouldn't be his problem.

View on HN

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out.

Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.

Also, the library was called the "Free Information" library.

IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.

It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.

A link is not someone giving you permission, it's merely telling you where something else is. I can't think of how you even came to this conclusion. It's like you have this incredibly restricted view of the internet, limited to people clicking on a browser, and think that's enough for protecting files. It's not.

You don't seem to realize how bad of an idea this is. You're talking about making criminals of people. You know, I think I remember once reading about how chrome would try the address you type while you typed it (i.e. before pressing enter, it'd make a request for every character you typed). Users of chrome could become criminals because their software would do this.

I have a view of the Internet where “protecting files” has nothing to do with whether access to files is authorized or not. I shouldn’t have to lock my door, and I shouldn’t have to lock down my web server. (It may be prudent to do those things, but a trespasser shouldn’t escape penalty just because I didn’t do those things.)

I agree that you shouldn't have to lock your door, but a web server is nothing like a house. You should be expected to put a fence around your playground equipment in a grassy field if you don't intend for people to use it as a public park. Even more to the point, you should lock the utilities shed at the public park you run lest someone mistake it for the public loo.

Your view of the internet only applies to things that aren't the internet. There exists no real governance or real ownership on the internet. These things do exist in some capacity, for the most part, in the physical world within national boundaries. Even still, if this were the physical world and some house existed, with an open door and outside the generally agreed upon distinction of what private property is, then you'd bet your ass I'd walk in and snoop around. If the owner came by and said "Hey! This is private propertay. I'll have you arrested!" then he'd certainly have the right to do so. I could then argue that there was no reason to think that this was private property because the door was open and it looked like public facility.

And I shouldn't have to pay an attorney to write legal contracts, while we're on the subject of fictional, idealized, romanticized, and imaginary realities.

This conversation has devolved into arguing against the analogy. This is the internet: everything on it is public unless care is taken to make it not so.

You may choose to argue whether or not that should be, but that's the way it is.

Yeah, but if you staple a note to a telephone pole you shouldn't get angry if people copy its contents. To portray a simple web crawler "trespasser" is a poor analogy. Do you have any proof that the owner of www.zombo.com has given anyone permission to view its contents? If not, should people be persecuted if they visit the site?

Elsewhere in this thread, people have pointed out that Google has crawled (and cached) at least some of the pages that were supposedly criminally accessed.

Think of it like so: you have a robot that anybody can ask anything and that will answer any and all questions truthfully. Whose fault is it if you deliberately tell the robot non-public information?

Still not a perfect analogy. If the robot spews copyrighted content, the robot, its owner and the content receiver are now in trouble.

Why the content receiver? That would be like a musician suing viewers for listening to their copyrighted music playing in the background of Youtube videos. It's the responsibility of people disseminating content to ensure they have the right to do so. That's why file sharing cases focus on the sharing, not the downloading per se.

I was under the idea that possession is still punishable, even if it is not given the same severity as infringeme

Edit: I mean not the act of listening, but the act of storing unlicensed material

There's understood conventions for when doors can/should be opened. There's also understood conventions for when it's OK to access a resource served over HTTP.

If the response code is 200, it's OK. The response code (not to mention the transmission of the file) is literally permission from the system to have the resource.

If you don't want someone to come in your door, don't put up a sign that says "come in."

If you don't want someone to see a resource at a URL, don't send them a 200 response code or serve the resource. That's the convention for the web.

Th website had "Freedom of Information" sign at the top....

Trespassing is generally not a crime unless there is a clear indication that the person committing it should not go there, such as a fence or a sign or some form of explicit communication from the property owner. The fence or sign doesn't have to make it impossible for the person to access the property, but it does have to be there so that it is clear that they shouldn't enter the property.

The Internet should be treated the same. Anything put on the Internet should be presumed to be public unless there is some indication to the contrary.

In this case, most of the information he accessed was clearly intended to be public, so there was no reasonable way for him to know that there was some private information improperly co-mingled with the public information, so he can't be faulted for not realizing that he shouldn't have accessed some of the information.

I mean you are making a request using a uniform resource locator, and the web server is responding to that request.

Best analogy I can think up is an automated free vending machine, with a row covered up by a piece of cardboard. If you don't want someone drinking the cokes on the hidden bottom row, why did you put them in the machine in the first place?

If the filing cabinet was labeled "public information" you bet I would.

I'm not saying that I agree with you, but I'm curious: does antisocial behavior mean it's illegal?

I completely agree with rayiner, and am a little concerned he’s being downvoted so heavily

But no, it shouldn’t be illegal. Yet what he said still completely applies to stuff like fiddling with ids on a site where you suspect it might lead to content you shouldn’t be able to access

Unless you’re whitehatting and plan to inform them of the security issue (probably anonymously because the world is fucked up and whitehatting can lead to jail time -_-)

Just because what you're doing is legal, doesn't mean you're not an asshole

Reply on news.ycombinator.com