Hacker News Reader

Comment by austincheney | Hacker News Reader

It is because I am a strong advocate for privacy that I believe Microsoft is wrong. If Microsoft really wanted to protect user privacy they would restrict access to user data on their platform. This is basic entry level security: apply access control.

Microsoft wants to split hairs in order to both maximize revenue and prevent competitor access, which is nothing to do with privacy. If Microsoft wins companies will be able to use this verdict to destroy privacy for revenue gain.

View on HN

Is hiQ a competitor to LinkedIn? They scrape people’s profiles so they can snitch to employers about employees whom they think are job hunting. AFAIK, that’s not a service LinkedIn provides.

Moreover, I would like it both ways. Access control would be great, but it sidesteps the underlying issue. I’m fine with my profile being public — in fact, I want it to be — but I don’t want my data to be vacuumed up and weaponized against me.

I agree that anti-hacking laws are not appropriate here. But what hiQ is doing is sleazy as heck, and we should absolutely try to throw out as much bathwater as possible without throwing out the baby too.

> I’m fine with my profile being public — in fact, I want it to be — but I don’t want my data to be vacuumed up and weaponized against me.

LinkedIn is a authwalled garden only available to those with accounts. "We may or may not have a Jake Lazaroff. Who's asking?".

Sounds like you need a personal website.

When most people say they want things to be public, they typically mean "accessible to those who have a legitimate reason to access it, which may include some people I have not explicitly authorized."

Also LinkedIn does have public profile settings which allow some or all of your profile to be visible without an account.

https://www.linkedin.com/help/linkedin/answer/83/linkedin-pu...

I believe LinkedIn started providing some services similar to HiQ, which is one of their arguments.

How can your profile be public but not vaccumed up? Google vacuums it to index of course. Or perhaps you mean only public on Linkedin?

What the Russians or any other bad actor you care to think about already has done with your public profile is probably way way sleazier.

Yes, important to note that Microsoft is going after a competitor here; there are a bunch of data brokers that have been scraping LinkedIn for years and this is the case they're going after. I hope the Supreme Court can see through this BS and tell them to go pound sand.

(If Microsoft wanted to go after data brokers I'd be on board for that tho)

It was hiq that sued linkedin

After being threaten by LinkedIn: "LinkedIn told hiQ in 2017 to stop scraping LinkedIn's public profiles or face liability under the anti-hacking law."

I think it's fair to say LinkedIn is the instigator in this case.

That seems like it would have been a breathtakingly easy problem to solve using technical means instead of legal threats. They could've required logins to view profile information. They could have blacklisted any IP address exhibiting automated behavior.

That sort of 'solution' is just a game of technical whack-a-mole as one party finds a new way to scrape the data and the other finds a new way to stop them though. If you want to permanently stop scrapping you need a non-technical solution that stops someone even trying.

But thats exactly the issue here. If they find a way to limit the data such that they can split who is "authorized" and who is not, then they have found something that falls under the now new reading of cfaa.

It's not going to stop scrapers from entities outside of the jurisdiction of the US legal system, but it's going to end up icing companies in the US who do this.

But I think Microsoft/Linked In is going to have a very difficult time redefining authorized when the data is publicly available to anonymous access.

...after LinkedIn sent them a cease and desist and started causing problems with hiQs third-party contracts. They went after hiQs business with a dubious application of existing laws (CFAA).

It's not a dubious application. The CFAA says that it's illegal to access a computer system you don't have authorization to access, regardless of whether it's technically possible. It's no different than if a manager banned someone from a restaurant - if they return, even though the restaurant is easily accessible, they are nevertheless trespassing.

The recent ruling on the CFAA introduces some confusion in that if a user has authorization to access a system, they are no longer in violation of the CFAA even if they access it for disallowed reasons (ie if you're allowed in the krusty krab, you're not trespassing even if you only went there to steal the krabby patty secret formula). But that's irrelevant here because hiQ was explicitly told they did not have authorization to access (ie Plankton isn't allowed in the krusty krab regardless of what he intends to do there).

LinkedIn pretty much tries or at least tried to stop ANYONE from scraping other than search engines, etc.

I agree. I want to add that the headline is infuriatingly credulous of Microsoft's claims.

And let's not forget that Microsoft probably is using that data when it comes to their own hiring decisions and recruiting efforts.

They already sell the data to anyone who wants to pay, they have no moral high ground here at all, the only extra "protection" you'd get is that companies would have to pay Microsoft more money to abuse your data.

Reply on news.ycombinator.com