Hacker News Reader

Comment by gitgud | Hacker News Reader

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information.

Should you not have the freedom to type what you want into the address bar of a browser?

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

Sequential numbers are not obscure. They're commonly used for pagination and collections, to the point where popular browsers have extensions to simplify navigating them.

https://addons.mozilla.org/en-US/firefox/addon/nextprev-page...

https://chrome.google.com/webstore/detail/urlnext/emepkgfiam...

> Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

It implies the exact opposite. The owner may have intended it to be private, but making it publicly available, without security checks on a publicly accessible server, implies the property owner intended for people to access that property.

There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.

The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.

When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes".

This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".

Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle.

I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access the data once they understood it (e.g. did they close the door and leave)?

That analogy would be more accurate if you also operated a cafe out of your living room, with a big "open" sign on the front door, and someone accidentally used your personal bathroom because you failed to stick a "private" sign on it. In that case, it would be unreasonable to sue someone for trespass.

Web servers are not houses. They are implicitly public, whereas houses are implicitly private.

Totally agree with this. If the web resource is available to anyone, then how could you be mad that some one saw it.

This isn't even the case though. The site specifically says that the documents, all of them, are public. They just happened to have noticed they screwed up and published some they shouldn't have, and are now going after someone who downloaded the entire set. This was not prohibited in any way that was documented on the site,and the language that was on the site made it sound like it was allowed. Since the theme is analogies how about this one: someone puts a box labeled "free stuff" in front of their house. You dig through it and find something of value. You take it and go home. A few days later your house is raided because the owner of the house put in something valuable by mistake and is now claiming they never intended for anyone to take anything that wasn't visible from the street. Since you dug through the box, they are charging you with theft.

I would agree if it took an actual exploit to obtain the information.

You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.

Since when is "intention" legally enforceable?

Reply on news.ycombinator.com