Comment by robbedpeter | Hacker News Reader

Comment by robbedpeter | Hacker News Reader

Parent Full thread

This seems like a perfectly Karen request.

Information you expose to the public internet, behind an isp or not, is not private or secure.

This is like complaining that people keep taking walks by your house whenever your wife sunbathes nude on your front porch. The people doing the looking aren't the problem. Where your wife is exposing anything sensitive is the problem.

The solution is to move your wife to the privacy of the back yard, buy her a sunbooth,or accept that she's on display to the public.

Much the same, make sure your firewall facing your public network connection only exposes what you want it to. Part of the implicit structure of the internet is that by connecting, you're agreeing to be connected to, to be visible to everyone else that's connected.

Leave Shodan be, their presence is important and relevant to the ongoing discussions of educating the public and maintaining accountability for security decisions by giant corporations.

Example you picked has a flaw that nude wife will be fined even if she exposes herself on your property - but in a way that others can see her. Police officer will be quite quick to explain her why she should not do this :)

Other point on "Karen request" is spot on because Shodan is making requests for research purposes and selling the results. They don't access anything that is behind password and they don't scan with intention to find something that they can break through.

While I mostly don't agree with people "scanning is not a crime", because I don't believe randoms on the internet that they are "scanning just for fun" and I expect they scan to find something they can get into which is first step of crime "preparation".

Then people don't understand intent of scanning is what makes it illegal/legal not the scan on itself. Just like knife is not good/bad but if you hold it to harm someone it makes it bad and illegal.

> example you picked has a flaw that nude wife will be fined even if she exposes herself on your property

That's not even true for every jurisdiction in America, let alone the world.

> Police officer will be quite quick to explain her why she should not do this

That's not a flaw in the analogy. The point of the GPs comparison is to pick a similar real life scenario in which the fault is very obvious. The fact that you're able to identify the obviousness of the fault (and suggest the police would too) demonstrates the success of the analogy.

I'll skip dissecting your painful metaphor and go straight to your claim. I haven't said anything about my opinion of Shodan or their work. I also know that the Internet is full of malicious actors and we must expect and protect against abuse.

I didn't give Shodan permission to access my systems. The services and methods they used were not publicly listed services that one would expect a member of the public to use. They don't have implicit permission.

Before reporting them to their ISPs, I checked the terms of the ISPs. These prohibited Shodan's behaviour.

I didn't exaggerate or lie to the ISPs, just gave them the facts. The ISPs chose to bring this up with Shodan, proving that my reports were meritorious.

Shodan contacted me more than once and I politely told them not to access my systems again. Each time they ignored my explicit withdrawal of consent.

Shodan are a commercial organisation that profits from the information they gather.

So they accessed my systems without permission, broke the terms of service of multiple ISPs, which were then enforced by their ISPs, and then were specifically asked by me to stop on more than one occasion, which they did not. They profit from all of this. And you think I'm a Karen?

It used to be that people who used the Internet did so under certain social norms. One of these was not to touch another's network without permission and, if caught, accept you got caught and gracefully stop it. I guess because you like Shodan, you assert they can do all of this and anyone who reasonably and politely objects to it is somehow unreasonable.

It bemuses me what the Internet has become.

>>It used to be that people who used the Internet did so under certain social norms. One of these was not to touch another's network without permission and, if caught, accept you got caught and gracefully stop it.

This is a silly argument. You're connecting to the internet, bud. It's a dangerous place, and there is zero expectation that nobody look at or scan your network. PUBLIC internet means what you connect to it is PUBLIC, at the global scale.

Shodan isn't hacking into secured devices. It isn't getting past your ISP's firewall and looking into restricted networks. It's scanning publicly addressed, explicitly broadcast ports, services, devices, and data. It's not on them to cater to your weird sense of internet manners, it's on you to wise up to what your public internet connection means.

To push the analogy a little, what is she is nude in the living room, and people are stopping on the sidewalk to look in through your windows. I think that would be a rude invasion of privacy. (Alternatively, replace the living room window with an open front-door, or to push it even more with a closed but not locked front-door)

The question of this analogy hinges, in my mind, on whether "this site talks https on port 443" is the equivalent of looking in someones front yard, or the equivalent of looking through the window into someones living room.

I think one weird difference is that we can passively observe things in the real world. But you can't passively observe an IP-address. You need to send data at it to see how it responds.

On that note, perhaps the analogy should be that people are shining a flashlight into your front-garden at night. Because they need to illuminate your private property in order to see anything.

> I think one weird difference is that we can passively observe things in the real world. But you can't passively observe an IP-address. You need to send data at it to see how it responds.

The other part of that is that you also can't passively show anything. The other side needs the actively respond with something that you can then observe.

Reply on news.ycombinator.com