Hacker News Reader

Comment by pbhjpbhj | Hacker News Reader

So, you post a comment in a private Skype "please don't visit this link, it's copyright and reproduction of a single copy requires a license at a cost of $10 million USD due to the sensitive nature of the content". You make sure the link is to a brand new unshared domain with robots.txt denying access.

MS download and you've got them on copyright infringement for which there is no apparent excuse outside of wilful negligence.

What's the multiplying factor the MPAA use for copyright infringement, something like 1000 times the regular licensing fee.

...

4) Profit

View on HN

Worse, you make it destruction.

"Bob, if you should ever need to delete 100% of the content that I've created for you, you would follow this URL. Let me be clear, it will destroy USD $1,000,000 worth of goods."

Well per the HTTP standard, GET requests should be idempotent. I kid, but imagine seeing pompous development advice stapled to official justification for some internet sleuthing!

I didn't realize this was part of a standard. Could you link to the section you're referring to?

right up near the top: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request. The methods GET, HEAD, PUT and DELETE share this property.

From RFC 2616 (Fielding et al) at http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

"In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested."

The document section also makes a distinction between "safe" and "idempotent" methods. That's not the same thing.

Lots of web apps are still implemented along the lines of: GET /foo?action=delete&item=x

A less naive implementation would also include a crumb to mitigate CSRF as well as unintentional access.

Yes, and you regularly see notes about how [some bot] has caused some developer to learn why this is bad practice whenever a link like that gets accidentally exposed in a way that allows crawling.

popular web browsers prefetch links.

Do you mean that GET requests shouldn't modify data? A URL that deletes everything would be idempotent; if it's hit once, it's the same effect as if it's hit many times.

Yes. Idempotency is just one property of the GET request, what parent described would be a DELETE request (these too are idempotent). So I could have been more precise and funny with that joke, I guess.

If you RTFA, it looks like it isn't even doing a GET, its doing a HEAD request.

So what, many PHP apps don't check for the HTTP type, and even less Perl/other CGI scripts.

Never rely on your environment to differ between the various HTTP methods for you.

Two thoughts:

1. There is probably something in the EULA for Skype that MS put in there to cover themselves with respect to this.

2. If there is not, it might be more effective to try and bring a multitude of small claims court cases against them. A tactic that worked against Dell in at least one instance: http://consumerist.com/2006/12/13/man-sues-dell-and-wins-by-...

Maybe I'm sick, but sometimes I dream of a world where there a people that actually go out and do stuff like this, to bring attention to the stupidity of some laws.

I imagine some people do go out and do it, then realize that it's ridiculous and pointless, perhaps after every lawyer they contact tells me that there is no way they would take such an insane case.

IANAL "licences" are basically contracts (to buy a good). Them clicking on a link isn't capable of entering a contract, since it's a machine that does the clicking and isn't really a meeting of the minds. Contracts can't be unconsciensable and extreme. So you won't really be able to sue them.

Copyright infringement doesn't require establishment of a license, in fact just the opposite. The license is there to underpin the value of the good that is infringed. The court might not buy it, but that's a separate issue to that of infringement, it's only there to establish the level of damages.

The machine excuse is inoperable - the agreed mode of operation of such machines is to refuse to follow links in a robots.txt file. If the machine has been programmed to ignore this de facto regulation then there's mens rea to go with actus rea performed by the machine for and at the behest of those who programmed it.

I can't program a tank to drive me on to your land and then claim that I haven't committed the tort of trespass, same goes here.

IANA(IP)L either, but sometimes I play one on the internet.

Robots.txt are an industry-standard, but non-legally-binding method of denying access. If you wish to actually deny access, the proper, legally-recognized means for doing so is by actually denying access (i.e., by using .htaccess or similar means).

Also, mens rea (i.e., "guilty mind" or colloquially, intent) is a criminal law concept that has no relevance in the civil/tort law realm. It doesn't matter whether the machine has been programmed to ignore robots.txt because no law requires a software program to obey robots.txt.

Indeed your assertions about robots.txt are the expected logical response. However when the issue of copyright infringement for Google (and other search engines) came up in the past [eg storing entire page text, thumbnailing and such] the response, that was apparently accepted, was that as a protocol exists (namely robots.txt) that enabled a website owner to refuse access to works there was no actual infringement. The onus being placed on the works owner to label the work as off-limits using robots.txt.

If that line holds then the corollary appears to be that programming a robot to duplicate linked content deny-ed by robots.txt is certain copyright infringement.

Copyright law is a weird one, it sits in a sort of limbo between tort and crime hence it seems relevant to not only consider the balance of probabilities and the test for tortuous infringement but also the criminal considerations. Moreover in various jurisdictions it's a crime to access a part of a computer system without authorisation, this would appear to apply to MS's directorship in this case; such laws might "require" obedience to established protocols for determining if access is authorised [would be interested if anyone reading can cite caselaw to support/discredit this line of thinking].

Reply on news.ycombinator.com