3 ms·

>...because we see the servers allow us to, and don't allow us to, respectively. Did you really have to attempt "ssh root@google.com" and be denied to know you

by kej 11y ago

>...because we see the servers allow us to, and don't allow us to, respectively. Did you really have to attempt "ssh root@google.com" and be denied to know you weren't allowed to do that? If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? >You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It allows for judgement based on the facts of the situation, instead of having to specify every possible variable in statute. More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful?

AnthonyMouse 11y ago
> If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? So this is a great example. Suppose you type "ssh root@google.com" on a lark and it unexpectedly lets you in. Your reaction is, of course, WTF. Something is wrong and you start trying to figure out what it is. DNS record point to the real google.com? Some malware or network attacker doing a MITM on all your ssh connections? What does the remote side think its network configuration is? This "wait, what?"-type reaction is completely innocuous. But the CFAA says you're already going to jail. Now if you get root@google.com and start reading everybody's gmail and stealing credit cards from Google Play, you deserve to go to jail. But there are like fifteen separate other laws against that stuff. > Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? Is it the front door to a store? Because yes. If the door is locked you expect that the store is closed, if not you expect it to be open for business. And that is the context we have in computer networks. The expectation is that things you shouldn't have access to don't allow you to access them and most everything actually works that way most of the time. > It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It is, it's just that in some cases the reasonable person standard is completely clear. The problem is the rest of the time it's as clear as mud and the outcome is a coin flip -- or 80% in your favor but the consequences are so severe you can't take the chance. > More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful? What I would suggest is that the CFAA ought to be entirely redundant for cases like this. Charge the man with misappropriating trade secrets and so on. What does it have anything to do with whether he used a computer or not?

by kej 11y ago

AnthonyMouse 11y ago

> If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? So this is a great example. Suppose you type "ssh root@google.com" on a lark and it unexpectedly lets you in. Your reaction is, of course, WTF. Something is wrong and you start trying to figure out what it is. DNS record point to the real google.com? Some malware or network attacker doing a MITM on all your ssh connections? What does the remote side think its network configuration is? This "wait, what?"-type reaction is completely innocuous. But the CFAA says you're already going to jail. Now if you get root@google.com and start reading everybody's gmail and stealing credit cards from Google Play, you deserve to go to jail. But there are like fifteen separate other laws against that stuff. > Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? Is it the front door to a store? Because yes. If the door is locked you expect that the store is closed, if not you expect it to be open for business. And that is the context we have in computer networks. The expectation is that things you shouldn't have access to don't allow you to access them and most everything actually works that way most of the time. > It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It is, it's just that in some cases the reasonable person standard is completely clear. The problem is the rest of the time it's as clear as mud and the outcome is a coin flip -- or 80% in your favor but the consequences are so severe you can't take the chance. > More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful? What I would suggest is that the CFAA ought to be entirely redundant for cases like this. Charge the man with misappropriating trade secrets and so on. What does it have anything to do with whether he used a computer or not?