Hacker News Reader

Comment by ikeboy | Hacker News Reader

This is a technical legal point. You can be forced to produce information you have, but generally not to create new information.

View on HN

They are arguing that finding data that's in log files is creating new data (because they have to write a script to parse it) which is specious. Logs are designed to be parsed and searched. You might as well claim that running an SQL script to query data is creating new information.

Well, if we’re following that logic, then anytime data is moved from a disk to ram, we’re “creating new data.” Well, yes, it wasn’t there before, so it’s “new data,” but it’s also a copy of old data.

There have been some weird legal discussions about whether turning on a computer breaks the copyright depending on who does it:

https://en.wikipedia.org/wiki/MAI_Systems_Corp._v._Peak_Comp....

That's actually a fairly interesting case. I haven't read into it too much but it seems that they agree that it isn't necessarily a copyright violation based on who does it. It looks like what they got Peak on was instead the fact that they had unlicensed copies of MAI software at their HQ and were loaning MAI equipment in such a way that violated the license agreements.

P.S. Please correct me if I got any of this wrong.

There are some details in the case that are as you say, about Peak having "unclean hands" in effect, but they're fairly beside the point for the case's broader significance.

What it really stands/stood for is the notion that a "copy" sufficient for the operation of copyright law occurs when a program is loaded from disk to RAM, and therefore it's possible to infringe copyright merely by using software that you aren't personally licensed for.

MAI basically used this theory to make third-party maintenance of their systems illegal, so Congress responded by amending the Copyright Act, but in an extremely narrow way: there's a carve out specifically for maintenance and repair.

> Logs are designed to be parsed and searched

You’ve never dealt with a bad log setup. Things I’ve seen:

- inconsistent format depending on which part of the software was logging (think of some modules using logging lib and others using print())

- multiline logs without any indication they are multiline

- logs in some dumb binary format that requires the original software to reverse into legible text

There are more, but the point is that logs are not often designed to be parsed and searched. They are normally added by developers to be human readable means of reversing internal state to debug issues. Anything above that is (shockingly) bonus material that doesn’t make it into home-grown enterprise/govt software.

> You’ve never dealt with a bad log setup. Things I’ve seen:

I'm not sure how this is relevant. I've seen miles of incompetence in my career, that someone can fudge something up royally doesn't change the fundamental purpose of the thing. The point of log files is to store and make retrievable data about server state and actions over time. That someone somewhere can screw that up doesn't change that.

In this particular case, I find it unlikely they rolled some custom bizarro log file format regardless because of the nature of the subject matter: Proxy server log files. It's unlikely they rolled their own proxy server (and they certainly don't imply any particular difficulties like that in court statements) so we're most likely talking about reading standard Apache logs or something similar.

> The point of log files

That’s a point of log files. However, it’s not the point tons of developers have in mind when they add log statements. Developers are primarily concerned with state required to reproduce bugs, not long term standardized storage containing enough information for useful attribution or even all important state transitions. You would be surprised how many developers don’t even bother logging item deletions because it’s such a trivial code path.

You’re idea of “the fundamental purpose” is from an operators view. It rarely lines up with the developers’ views and you’re in for a bad time if you think people who don’t see your perspective are “fudging something up royally” with “miles of incompetence”.

uh they're text.... they don't need to be formatted well to be indexed and searched lol.

Uh, you do know a field has to actually be present in a line for it to be indexed? And it has to be consistently formatted placed to be parsed lol.

That is true but more likely they try to push back against every request that isn't simply zip up files or documents and deposit them.

They are using the "defense" that it may be difficult to do, but their aim (avoiding the more sinister possibilities) is to stop precedent for other unwieldy requests.

In my experience, government agencies fulfill requests if it's easy and won't put the agency or administration in a bad light. I suspect this falls more into the latter case than the former, they don't want people to see the logs because they know the bulk of the comments are bogus.

They have the information (note that they did not contest that point), the script would presumably allow them to surface that information more quickly.

Technically you can open that logfile in Notepad and Ctrl+F the thing. If I was the judge and you pulled that argument someone at your agency would now be using that method instead of "researching" a grep query.

Reply on news.ycombinator.com