6 ms·

Interestingly enough the person the article about was convinced and jailed for making GET requests on publicly available websites, because he knew he did not ha

by wfo 11y ago

Interestingly enough the person the article about was convinced and jailed for making GET requests on publicly available websites, because he knew he did not have permission to access them. I think a print server at a university is pretty obviously not fair game. If you forget to lock up your business overnight and someone walks in and prints off a couple thousand pages using your printer it's definitely illegal.

biot 11y ago
Yeah, I made an analogy 3 years ago when the Weev case came up: https://news.ycombinator.com/item?id=6435092 https://news.ycombinator.com/item?id=6435092 contrasting a publicly accessible web server with a librarian at a public library. Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access. Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"? To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.
- wfo 11y ago
  I think a better analogy would be if a library accidentally placed a paper copy of their members' records in the library alongside the books, you found it, and instead of informing the library of the horrible mistake you took it over to the library photocopy machine and made a copy for yourself and showed it to everyone to humiliate the library for their mistake. Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it. It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.
  - biot 11y ago
    A publicly accessible, internet-connected printer is almost directly analogous to a fax machine that you can phone, transmit a document, and have it print out on the other side. Maybe you intend the phone number to only be called by certain people, but the default behavior will be for the fax machine to accept calls from anybody in the world. So it is for a printer with a public IP address. Sending faxes in this manner (without prior business relationship; not respecting opt-out, etc.) is an FCC violation; it's not hacking. Why would printing be any different? I agree with you on the ethics/morality of it all.
- mikeash 11y ago
  Can you honestly say that you might come across an unsecured printer on the public internet and truly believe that it was set up that way intentionally and you have the owner's permission to print stuff? That literally never happens. It's possible in theory, but in practice, if you encounter such a thing and send it a print job, you know you're accessing it without permission. If you don't have permission and you know you don't have permission and you still do it, that's illegal. Analogies about librarians don't help.
jack-r-abbit 11y ago
... and that conviction was overturned on appeal. Sometimes the judges get it wrong the first time.

by wfo 11y ago

biot 11y ago

Yeah, I made an analogy 3 years ago when the Weev case came up: https://news.ycombinator.com/item?id=6435092 https://news.ycombinator.com/item?id=6435092 contrasting a publicly accessible web server with a librarian at a public library. Your "forget to lock up your business overnight" scenario isn't a useful analogy since entering that business would be at least trespass and possibly breaking and entering (no physical breaking needs to occur), so anything after that obviously is a result of exceeding access. Riffing off of my older analogy, if I entered a library and asked the librarian "Can you please print flyer.pdf?" and the librarian did so, is that "obviously not fair game"? To be clear, I'm considering only the act of printing rather than the contents of the flyer; it could be a single pixel or the word "LOVE". I suspect that this is ultimately some sort of mischief since it's unlikely he had any plans to travel to each location to pick up the output, but I'm having a hard time seeing how this is hacking.

wfo 11y ago
I think a better analogy would be if a library accidentally placed a paper copy of their members' records in the library alongside the books, you found it, and instead of informing the library of the horrible mistake you took it over to the library photocopy machine and made a copy for yourself and showed it to everyone to humiliate the library for their mistake. Or if the printer was in a locked room in the back of a library, to be opened only with a keycard, and said "employees only" and you found out that the keycard didn't work quite right so you could walk right in and use it. It doesn't matter how easy the hack is. If you use someone else's machine in a way that hasn't been made publicly available AND it is public common knowledge that what you are doing is against the wishes of the people who own the hardware then it's illegal and immoral. If a bank exposes monetary transfer functionality by way of a public http GET request it's very stupid but it's still very illegal to use it to steal money from people.
- biot 11y ago
  A publicly accessible, internet-connected printer is almost directly analogous to a fax machine that you can phone, transmit a document, and have it print out on the other side. Maybe you intend the phone number to only be called by certain people, but the default behavior will be for the fax machine to accept calls from anybody in the world. So it is for a printer with a public IP address. Sending faxes in this manner (without prior business relationship; not respecting opt-out, etc.) is an FCC violation; it's not hacking. Why would printing be any different? I agree with you on the ethics/morality of it all.
mikeash 11y ago
Can you honestly say that you might come across an unsecured printer on the public internet and truly believe that it was set up that way intentionally and you have the owner's permission to print stuff? That literally never happens. It's possible in theory, but in practice, if you encounter such a thing and send it a print job, you know you're accessing it without permission. If you don't have permission and you know you don't have permission and you still do it, that's illegal. Analogies about librarians don't help.

jack-r-abbit 11y ago

... and that conviction was overturned on appeal. Sometimes the judges get it wrong the first time.