Hacker News Reader

Comment by rayiner | Hacker News Reader

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical.

The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly accessible? Would a reasonable person have assumed that those documents were not intended to be publicly accessible, because they could only be accessed by editing a URL?

View on HN

Phones, bullhorns, billboards, postcards, bumper stickers, guitars, TV transmitters, etc. are dumb pieces of property that people use to communicate. (Why don't I have to get permission to look at your billboard?) Computing devices are different from most of these in a single respect: they can act autonomously, as their operators intend. In fact it is customary that they do so, just as it is customary that billboards are viewed by the public. Jeff Bezos doesn't have to stay at the console approving everything whizzing in and out of AWS. There's nothing anthropomorphic about recognizing that intent may be coded in such a way that a computer obeys that intent. In future please consider reading more charitably.

You post often enough on this topic that we all know your position, before you post. Consider, if you will, whether your preferred position is one that will lead to improvements. I posit that it will not. Your position, if adopted, would lead more faceless totalizing organizations to amass, against our will, more of our personal data, and to be less careful stewards of the same. We have far more to fear from those organizations than from 19yos.

> There's nothing anthropomorphic about recognizing that intent may be coded in such a way that a computer obeys that intent.

What a computer does may be evidence of intent, just as a lock (or lack thereof) may be evidence of intent. But just like an unlocked door is not evidence of intent to make something accessible, neither is an unlocked computer.

> Consider, if you will, whether your preferred position is one that will lead to improvements.

The Internet belongs to ordinary people, not folks who have read the HTTP spec. (It's their world, we just live in it.) "Improvements" will be had when the rules comport with what ordinary people want and expect. Ordinary people don't think about computer security; they expect that, like in the real world, people won't go into places that don't look like they're meant for the public just because there's no locks to prevent them from doing so. The law should reflect those expectations.

Laws exist to create social norms. HN users are preoccupied with data security, but ordinary people hate security measures and are bad at it. So it seems completely backward to me to codify in the law the idea that accessing data should be presumed to be permissible just because the owner of the data didn’t secure it.

Sending a packet in response to some other packet is something "a computer does". Back when "ordinary people" thought that witch-dunking was an "ordinary" security measure, "ordinary people" were wrong. Improvements came not when the courts surrendered to ignorance, but when they corrected it.

Very few "ordinary people" would describe websites as "places", anyway. They don't say they're "at" Facebook, they say they're "on" it, much like they could be "on the phone" or "on TV". Maybe this hasn't always been the case, but the courts aren't tied to 1990s-era metaphors. No one on a jury remembers those silly "Welcome to the BatCave, Come on in if you Dare" geocities pages.

Incidentally, Facebook and its ilk hold ordinary people to much more complicated standards of behavior than those to which you and they would hold sites, all the time. Oh, you didn't read all 50 pages of TOS and then update the (hidden) configuration, every week? Silly user, that's why we gave all your data to the English!

Meanwhile, you don't think Facebook should have to understand how HTTP works, just because one person working at the company might not. Interesting, that the benefits go one direction and the duties go the other.

I think your arguments are well-reasoned, but I also think that you, along with others here making analogies to libraries/filing cabinets/etc. are too eager to equate physical access to internet access.

In the physical world, one can accidentally walk into a room they shouldn't have, perhaps mistaking it for the bathroom, and then leave without having committed any transgression. Entering a room you shouldn't be in doesn't mean you've automatically taken the contents of the room. On the internet, however, visiting a URL means just that. There's no "oh, it looks like I shouldn't be here" opportunity.

URLs are not doors. They aren't rooms. The same reasoning can't be applied to them, as they behave in fundamentally different ways.

There was no sign that the supposedly private documents were intended to be private. I’ve often fiddled with URLs on public sites because I’ve had the intuition that something hasn’t been indexed that perhaps should have been indexed, or because of a dead link.

If those sensitive documents were on a _public_ website intended to be browsed by the _public_, who presumably did not require authentication, and the documents did not cause an “Authorization required” response when accessed, it feels rather totalitarian to treat that as a crime.

Most of the metaphors I’ve seen about this are not fitting. As excessive as the barrage of metaphors may be, allow me to add my own:

As part of a free treasure hunt, a person gives you the address of their house and says, “Whatever is not locked up is fair game for you to look over, take photos, or copy.”

You go there and have a great time. Then the homeowner has a fit because you discovered a hidden cellar full of pornography, which was apparently off limits but the door was inadvertently left unlocked. Now the homeowner is charging you with breaking and entering, saying you should have known better and it was common sense.

Of course a computer doesn't choose to do anything, but its actions do represent the choices of its operator. If I put a sign on my door the onus is on me to check if it says "All members of the public are welcome here" or "No trespassing".

At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will?

The answer, even in the realm of physical property, is clearly not 'never', so where is it, and what leads you to believe its threshold was not crossed here?

> At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will?

The law is that the onus falls on the owner or their agents at the point where a reasonable person would not be able to infer the scope of the implied license from the circumstances.

I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible.

>I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible.

Do you view 'a HN reader' as a reasonable representation of someone skilled in the art [of creating and serving websites]?

Unless I'm missing something, the only conclusion that I can see following this line of reasoning is that skill in the art is inversely proportional to a person's 'reasonableness' in this matter.

If a quorum of experts are coherently proposing that certain actions are reasonable, even if you find them distasteful, at what point is 'reasonable' no longer reasonable?

For what it's worth, despite sounding like a rhetorical question, I am truly interested to know your thoughts on that last matter.

Except in certain limited areas (e.g. “the reasonable doctor” standard for medical malpractice), the standard is the “reasonable person,” not the “reasonable person skilled in the art.”

People on HN are not representative, because they know about computer security and HTTP access codes. We don’t live in a world where those people get to make the rules. We live in a world where the rules are set by reference to ordinary people. My mom gets to set the rules for what’s “reasonable” (what are the social norms everyone has to follow). Not you or me.

My point is that a reasonable layman would assume that if a document was not linked or indexed from a public portion of the site, it was not meant to be accessed. That makes sense, because if the document was meant to be accessed, it would be made accessible in a way a reasonable lay person would know how to access it.

> My point is that a reasonable layman would assume that if a document was not linked or indexed from a public portion of the site, it was not meant to be accessed.

And others point out that editing a URL to increment an ID which is obviously sequential is absolutely a reasonable way of browsing the web. That doesn't mean a lay person has to know how to do it, but that they wouldn't think anything criminal was happening if they watched someone else do it.

How about a "reasonable mechanic", "a reasonable grocery clerk", or a "reasonable carpenter"? Dare we imagine a "reasonable web developer"?

And I posit you are wrong.

An ordinary person would infer from accessing a url and receiving information, that the information was intended to be public

Reply on news.ycombinator.com