7 ms·

Can't site operators also receive gag orders that forbid them from disclosing that they are being censored, in which case they aren't even allowed to use the 45

by k_sze 11y ago

Can't site operators also receive gag orders that forbid them from disclosing that they are being censored, in which case they aren't even allowed to use the 451 code, which defeats the purpose of the code?

paulddraper 11y ago
403s are often used in place of 404s. This is even allowed by the spec. That doesn't mean 404 if worthless.
- novaleaf 11y ago
  Regarding 403 instead of 404: I'd suggest rather that 403 doesn't reveal information on whether the page exists (for those who may not have permission to access).
  - billyhoffman 11y ago
    While you are correct, you can use the stock behavior of most web servers like Apache or IIS to evade this attempt at misinformation and learn whether something really exists or not. Lets say /admin/ is a directory that exists on the site, but I am not authorized to access it. So site returns a 403 or, if you are sneaky and don't want to reveal the existence /admin/ to unauthorized users, you configured the server to return 404. Go ahead a send a GET request for just /admin without the trailing slash. Assuming there isn't actually a file named "admin" and admin is actually a directory, by default most versions of Apache/IIS will return a 302 direct to /admin/. This reveals the existence of the directory, regardless of what status code you get when fetching /admin/. I'm not sure the exactly why web servers behave this way. My educated guess is that when Apache/IIS service the request, they see the named entity is actually a directory, so there is no content to return. So they redirect you into the directory, so that either the directory contents can be displayed, or a default document can be sent instead. Years ago, I worked on a web brute forcer which used this method to detect the existence of directories. The advantage is slightly more limited now with the rise of MVC where the entire path of a URL doesn't directly map to a file system path.
  - paulddraper 11y ago
    Exactly. In neither case is 404 or 451 pointless just because 403 is sometimes used to restrict access to that information.
nchelluri 11y ago
FTA: > In some jurisdictions, I suspect that censorious governments will disallow the use of 451, to hide what they're doing. We can't stop that (of course), but if your government does that, it sends a strong message to you as a citizen about what their intent is. That's worth knowing about, I think.
btown 11y ago
Yes, and from what I've gathered (IANAL), many fear that judges would not look kindly on things that do not specifically leak "gagged" information, but go against the spirit of gag orders (i.e. warrant canaries). The IETF's "permission" certainly doesn't supercede state or federal governments. So in practice this status code is cute, but it won't move the needle on reining in state censorship any more than before.
- pdkl95 11y ago
  Exactly - judges generally don't look kindly at "technicalities"[1] and creative interpretations that are obviously created to work around a judicial order. Often, when legal issues are discussed on places like HN some people will jump at some obvious trick to bypass the order (such as using status code 451). There is a good chance that a judge will simply say you knew the gag order forbid you from telling anyone you have a gag order, sending code 451 explicitly tells people about the gag order, so enjoy your contempt of court penalties. The traditional warrant canaries are a genius work around as it relies upon the person potentially being gaged actively taking an action (it's a dead-man trigger). In theory, it's a lot harder to make someone lie and forge new warrant canaries as part of a gag order. Following the order and doing nothing sends the message. There is a time and place for challenging or evading legal requirements, but it's a dangerous game to play and only with good legal advice. [1] One exception might be legal technicalities where you can show precedent. It will probably still piss off the judge, but there is at least reasonable chance of such a technicality-based argument will work. As usual, YMMV, see a real lawyer.

by k_sze 11y ago

paulddraper 11y ago

403s are often used in place of 404s. This is even allowed by the spec. That doesn't mean 404 if worthless.

novaleaf 11y ago
Regarding 403 instead of 404: I'd suggest rather that 403 doesn't reveal information on whether the page exists (for those who may not have permission to access).
- billyhoffman 11y ago
  While you are correct, you can use the stock behavior of most web servers like Apache or IIS to evade this attempt at misinformation and learn whether something really exists or not. Lets say /admin/ is a directory that exists on the site, but I am not authorized to access it. So site returns a 403 or, if you are sneaky and don't want to reveal the existence /admin/ to unauthorized users, you configured the server to return 404. Go ahead a send a GET request for just /admin without the trailing slash. Assuming there isn't actually a file named "admin" and admin is actually a directory, by default most versions of Apache/IIS will return a 302 direct to /admin/. This reveals the existence of the directory, regardless of what status code you get when fetching /admin/. I'm not sure the exactly why web servers behave this way. My educated guess is that when Apache/IIS service the request, they see the named entity is actually a directory, so there is no content to return. So they redirect you into the directory, so that either the directory contents can be displayed, or a default document can be sent instead. Years ago, I worked on a web brute forcer which used this method to detect the existence of directories. The advantage is slightly more limited now with the rise of MVC where the entire path of a URL doesn't directly map to a file system path.
- paulddraper 11y ago
  Exactly. In neither case is 404 or 451 pointless just because 403 is sometimes used to restrict access to that information.

nchelluri 11y ago

FTA: > In some jurisdictions, I suspect that censorious governments will disallow the use of 451, to hide what they're doing. We can't stop that (of course), but if your government does that, it sends a strong message to you as a citizen about what their intent is. That's worth knowing about, I think.

btown 11y ago

Yes, and from what I've gathered (IANAL), many fear that judges would not look kindly on things that do not specifically leak "gagged" information, but go against the spirit of gag orders (i.e. warrant canaries). The IETF's "permission" certainly doesn't supercede state or federal governments. So in practice this status code is cute, but it won't move the needle on reining in state censorship any more than before.

pdkl95 11y ago
Exactly - judges generally don't look kindly at "technicalities"[1] and creative interpretations that are obviously created to work around a judicial order. Often, when legal issues are discussed on places like HN some people will jump at some obvious trick to bypass the order (such as using status code 451). There is a good chance that a judge will simply say you knew the gag order forbid you from telling anyone you have a gag order, sending code 451 explicitly tells people about the gag order, so enjoy your contempt of court penalties. The traditional warrant canaries are a genius work around as it relies upon the person potentially being gaged actively taking an action (it's a dead-man trigger). In theory, it's a lot harder to make someone lie and forge new warrant canaries as part of a gag order. Following the order and doing nothing sends the message. There is a time and place for challenging or evading legal requirements, but it's a dangerous game to play and only with good legal advice. [1] One exception might be legal technicalities where you can show precedent. It will probably still piss off the judge, but there is at least reasonable chance of such a technicality-based argument will work. As usual, YMMV, see a real lawyer.