Hacker News Reader

Comment by Gigablah | Hacker News Reader

> "At worse, only the internet etiquette has been breached."

Proceeds to announce the name of a stalking victim. Classy.

And he's also wrong. I assume he's French, and French law specifically says that any unwanted access to restricted parts of a "data processing system" is punishable by a hefty fine and/or prison time. For example, I think bug/vul bounties programs are illegal in France (but IANAL).

A relatively famous French blogger was convicted once in trial for having publicly reported that a governemental agency was letting GoogleBot index confidential/restricted documents : http://bluetouff.com/2013/04/25/la-non-affaire-bluetouff-vs-... [FR] http://arstechnica.com/tech-policy/2014/02/french-journalist... [EN].

I believe that only services hosted on the French ground are eligible to the French law.

Also, showing the link but not the content is a smart move because it doesn't prove that the author looked for the content of these documents, when the robots.txt is obviously a file you should be able to consult.

French law would then be different than German law, where the ground the intended audience is on matters. Of course it is much harder to prosecute someone, when the server is in a country that does not cooperate.

How exactly is robots.txt a "restricted part"?

I believe the intent was that if robots.txt claims to disallow a section of a website, then French law would say that section is off-limits to visitors and visiting disallowed sections is punishable by law.

I doubt that this is a valid interpretation of the law. The robots.txt file simply mentions parts of the site that shouldn't be indexed, not which parts of a site shouldn't be viewed by the general public. You use a robots.txt file to prevent a search engine from following links that would enumerate all the possible dynamically-generated content on your site to conserve resources and to prevent junk results appearing for a search user.

Tangentially relevant: when you do have something you want indexed, it should probably be a static page that lives at a permanent URL. But never attempt to use a robots.txt file to "hide" sensitive data.

Off limits to robots, hence the name.

edit: I think you edited to clarify since I commented. Thanks.

Robots.txt is supposed to be public. Its purpose is to recommend not to visit some links (it's only a recommendation). And he did not visit the link itself, he just read the comments (made for humans to read) in a public file, I don't think there is a problem here.

Strongly agree. I emailed the school to let them know about the error on their part. How hard would it have been for the author to do the same, and to change the name of the victim and institution to protect her?

It'a name that's in a plain text document that anybody can personally look up on its browser. What's the point of hiding it, if it's a very good point for his article?

Now it's indexed by search engines?

https://www.google.com/search?q=inurl%3Arobots.txt

Not that I agree it should be further divulged, mind you.

He could have made exactly the same point with a fake name and institution. The information became public due to incompetence, he's made it much more visible… I don't care to speculate on what personal failing might be the reason.

It won't be exactly the same point.

With a fake name there is no proof that the information in question ever existed.

I would've probably masked a name, but institution url should stay there, so anyone could check that the point is valid.

Okay, that's fair, but it would be the same point for practical purposes, in my opinion. I don't personally believe that it's necessary for people to get hand-holding to independently verify his individual claims. Certainly other people could copy his methods to reproduce the results, but I'm not sure what the benefit is of links into the individual leaks of sensitive information.

The point would be just as well made if he did not list the actual name.

The exact same point can be made by redacting or anonymizing the individual's name. Perhaps the organization rethinks its use of the comment and removes it. However, this blog post will live on through the archives of the internet in perpetuity, forever labeling that individual and, unfortunately, helps out their stalker.

Google for "Lisa Wilberg esc" (just like what a stalker might do to narrow it down to the correct uni) and you get the robots.txt file itself in 3rd place. The author isn't doing any more harm than Google already is. It's already easily searchable.

The author is bringing more unwanted attention to a victim. Why not contact the school and let them know of their error, or change the woman's name? Reprinting her name and the institution name accomplishes nothing good.

According to the date it would be almost 2 years ago, not exactly a current event...

There's plenty of others with the same name as her (58k according to Google), that file is now 404, and archive.org doesn't have it (due to its mention in the robots.txt), so whatever information in it that could've been useful for a stalker is long gone.

Does it matter that the event was 2 years ago? I'm sure the victim wants to move on and put this well behind her.

Signed up real quick to post this...

Her name shows up in a news letter, inc middle name, published and indexed by the school in 2012. It lists her occupation (a very public one) and even where you can find her works. This alone would be enough to get in touch with her.

It was pure morbid curiosity that lead me to search for it, but its totally still relevant if you were looking for her. Unfortunately, given her occupation, its unlikely that anything short of the stalker giving up or getting arrested will grant her any sort of reprieve.

I've had a stalker track me for well over 2 years.

That said, he only reveals that she was stalked which I presume the stalker and her are quite aware of, but no more than that. A better way to report the finding would have been to keep her name and the name of the institution out of it.

When I do that I get four relevant results. First is the robots.txt. Esc could presumably fix that were they told of their error. The second is the article, the third is your comment, and the fourth is a reddit post. The reddit one has recently been redacted (but is still in google cache).

You also get this one and other online discussions about the article. The author has shown his lack of empathy and judgement by putting somebody on the spotlight for no good reason whatsoever.

I can't comment on the particulars, because the document doesn't mention this name (maybe it changed since it was originally posted?), but, whatever you feel about the justification for the original article, it seems clear that nothing is served by your re-posting the information.

At the moment, for me, your post is the only hit on Google for the query you suggest.

I doubt the stalker has forgotten it.

Is it possible that has been removed (in which case, kudos to the author)? I didn't see a name in the document, and the name that Lorento mentions doesn't appear.

Reply on news.ycombinator.com