Hacker News Reader

Comment by mcny | Hacker News Reader

> I'm not going to make a moral judgement here, I'll just say that I'm not a fan of treating "cyber" as some magical realm where there are no norms.

On the contrary, I think we are pulling in too many assumptions into "cyber". Imagine this: if someone had left their door unlocked and someone came in and stole their lawn mower, you could say they deprived the owner of use of their lawn mower. However, imagine if equifax removed [authorize] in an http endpoint like /v2/person/:id allowing anyone to just GET /v2/person/1 .. 999999999 consecutively. Is this a criminal matter? I'd say no. I'd go further and say that this "cyber" fearmongering has gone too far and we should ABOLISH the CFAA. The EFF has still laid their hopes on reform but I for one think it is irredeemable and must be abolished with no replacement.

View on HN

Just to play devil's advocate: If an armored Brinks truck gets in an accident and cash spills all over, it's not legal to take just because it's no longer protected and on public land.

Intent has to matter a lot in these cases, though.

If a bill blows a mile away and somebody happens to find it with no knowledge of the crash, that's qualitatively different than witnessing the accident and then rushing to grab the money you watched spill out.

> it's not legal to take

How about to copy?

I think that a better comparison would be with an armoured truck having left open its doors and spilling top secret documents all over the road.

printing money as a non-government entity is always illegal. when, where or how doesn't matter.

I did not say printing though. Copying could as well be taking a picture of them.

If you want to print them though, I am pretty sure that it is legal as long as you include a clear disclaimer that they are fake.

> Copying could as well be taking a picture of them.

These are very different things and regulated in different ways. This is some weird version of strawman.

I do not see how, given that this is about the equifax events. Is it really different if you copy a "top secret" text file or if you take photographs of your screen displaying it?

Nobody will care if you take a photo of money. Copying the money, as in making a physical copy is a problem.

This is different from information which is inherently not physical, so any copy of representation is a copy. The grey area of course is a lossy copy... redistributed low-res copies of art, etc.

Just to be practical: the internet is not a magical place just one where anonymity is so practical that one can not justify a figurative brink truck failing. Moreover, it's absolutely unacceptable for institutions like Equifax to fail given the importance of identity security and the apparent lack of (or unwillingness to consider) alternatives to the social security number such as PKI; PGP for example. If you've ever seen a bitcoin paper wallet with QR codes printed on it you'll know what I'm talking about. I don't care if it's Apache Struts or PHP + mySQL they should have tested to the point of impossibility of intrusion. I think it's also reasonable to assume that the government is full of shit, and the most likely scenario is that these people in China admitted this to the government because they wanted us to know that they did it. If anything they're doing us a favor, but I still think the real solution to the problem is to stop relying so heavily on pseudo-secret identities like the social security number and to at least offer people an alternative means that uses cryptography at least for the people who care about doing things right and taking responsibility for their own security since the government can only make fraudulent guarantees that we're ever going to be safe.

Maybe I'm wrong about this, but I'm pretty damn sure if you use tor the right way they're not ever going to find you unless you give yourself away some other way.

Just because the proverbial armored car company and/or driver was negligent, doesn't mean the thief is innocent.

no for sure, stealing is a dick thing to do. But I like to keep my expectations reasonable. Can I reasonably expect to carelessly leave my phone at a table in a place where crime is known to happen when I know better?

One problem is the metaphor of place. The internet is not composed of tool sheds that contain lawnmowers; it is not composed of places at all. The internet is a network that allows hosts to send packets to other hosts. These packets are, fundamentally, communications. A communication can constitute a fraud or a slander or a copyright violation or certain other communication-oriented crimes or torts, but communication is never theft.

The "place" metaphor was intended to help people who don't have an intuitive understanding of communication networks. Since POTS had existed for many decades, it's not clear that this metaphor was ever necessary. No one ever confused a phone number with a place. Now that most living people have had childhoods during which the internet existed, the metaphor is certainly not necessary now.

If host A on the internet responds to a simple unauthenticated GET from host B with PII, we really shouldn't be blaming host B. The "place" metaphor obscures that fact.

Of course it's a criminal matter! When a bank is negligent and leaves the doors unlocked, they're on the hook for massive civil liability if people's deposit boxes are robbed. The thief is still going to jail if caught, though.

IANAL (I am not a lawyer) - but I think there’s a distinction here in that the lawn mower is going to be on private property, but having urls in the Internet is generally assumed to be public.

According to the DMCA, even if it’s up for public viewing, the mere act of making a copy is theft. For example, if the MPAA posted a full length movie on YouTube for free viewing, and you made a copy, you’ve committed a crime. That’s ignoring the fact that you already do make a copy: your browser cache. It’s perverted, but it’s what the law is.

If you collect massive sensitive information by scraping endpoint/1 ... 999999999, and you resident in the U.S. You will be in big trouble.

How do I know its sensitive? How did you decide its massive? 20 GB of data is not massive in my opinion.

Furthermore, perhaps I operate a crawler or an internet archiving service, and i dont even know i am collecting it.

Sorry. I meant intentionally.

Reply on news.ycombinator.com