4 ms·

Every interaction between the client and server begins as a request from the client. If the server replies "yes, have some data" it's nonsensical that this coul

Every interaction between the client and server begins as a request from the client. If the server replies "yes, have some data" it's nonsensical that this could be construed as gaining unauthorized access, as Facebook claims. Using the same line of reasoning, you could explain away every computer breach in history as being authorized by the entity that suffered the breach...

a_imho 10y ago
Well, taking aside that security is hard, everyone should be responsible for their system and it is a much more apt analogy. The only thing that gives a free pass imo is that it is impossible to be 100% secure.
Canada 10y ago
That's true, you could, however in this case Power isn't exploiting a security vulnerability in Facebook. Power is acting on behalf of a user. This is like saying a maid is guilty of trespassing because a tenant provided his room key while the landlord has a strict "no roommates" policy.
- DougBTX 10y ago
  I like this analogy, it extends quite well. Two more cases to consider: the landlord has a "no sharing keys" policy, and it has told the maid, "you may not enter, regardless of which keys you have".
  - acranox 10y ago
    But the maids agreement is with the tenant, not the landlord. So if the landlord wants to ban the maid, maybe they should change the locks, or kick out the tenant. The key sharing policy would be between the tenant and the landlord, not directly with the maid.
- rayiner 10y ago
  That analogy is bad because the tenant has the right to possess his apartment, and has the legal power to consent to people being there. Indeed, it would probably be illegal for the landlord to keep the tenant from letting a maid in. Facebook users have no property interest in Facebook accounts. They can't consent for someone to access the accounts over Facebook's objection.
  - erroneousfunk 10y ago
    Second this. A lot of the comments in this thread reveal some fundamental -- not "misunderstandings" because I'm pretty confident that we all know how the Internet works -- but perhaps "incorrect patterns of thinking/mental shorthands" about the Internet. There are certain concepts that we often seem to forget when we're using the Internet day in and day out. Things like: "Facebook provides a service," "they're a private company," "you do not have an inalienable right to the service," "the service costs them money to provide," "content creators have certain IP rights to the content they create, but this does not translate into a fundamental right to use the Facebook service," "servers are real physical things," etc. I can't believe how many people are going along with the whole "comparing Facebook to your rented apartment" line of thinking...
- tptacek 10y ago
  Exactly how are you distinguishing between "exploiting a security vulnerability" and "making innocent requests"? I don't think it's possible to reliably make this distinction. The law, of course, doesn't try: it turns on whether the person who made the requests should reasonably have known whether they were authorized to make that request.
  - Canada 10y ago
    I know, and I also believe it's impossible. I was trying to steer the conversation away from that debate by pointing out that Power was invited in by authorized users.
erroneousfunk 10y ago
This is like being banned from a restaurant, then returning the next day and saying "well, I pushed on the door and it opened, so it's nonsensical to say I was trespassing"

a_imho 10y ago

Well, taking aside that security is hard, everyone should be responsible for their system and it is a much more apt analogy. The only thing that gives a free pass imo is that it is impossible to be 100% secure.

Canada 10y ago

That's true, you could, however in this case Power isn't exploiting a security vulnerability in Facebook. Power is acting on behalf of a user. This is like saying a maid is guilty of trespassing because a tenant provided his room key while the landlord has a strict "no roommates" policy.

DougBTX 10y ago
I like this analogy, it extends quite well. Two more cases to consider: the landlord has a "no sharing keys" policy, and it has told the maid, "you may not enter, regardless of which keys you have".
- acranox 10y ago
  But the maids agreement is with the tenant, not the landlord. So if the landlord wants to ban the maid, maybe they should change the locks, or kick out the tenant. The key sharing policy would be between the tenant and the landlord, not directly with the maid.
rayiner 10y ago
That analogy is bad because the tenant has the right to possess his apartment, and has the legal power to consent to people being there. Indeed, it would probably be illegal for the landlord to keep the tenant from letting a maid in. Facebook users have no property interest in Facebook accounts. They can't consent for someone to access the accounts over Facebook's objection.
- erroneousfunk 10y ago
  Second this. A lot of the comments in this thread reveal some fundamental -- not "misunderstandings" because I'm pretty confident that we all know how the Internet works -- but perhaps "incorrect patterns of thinking/mental shorthands" about the Internet. There are certain concepts that we often seem to forget when we're using the Internet day in and day out. Things like: "Facebook provides a service," "they're a private company," "you do not have an inalienable right to the service," "the service costs them money to provide," "content creators have certain IP rights to the content they create, but this does not translate into a fundamental right to use the Facebook service," "servers are real physical things," etc. I can't believe how many people are going along with the whole "comparing Facebook to your rented apartment" line of thinking...
tptacek 10y ago
Exactly how are you distinguishing between "exploiting a security vulnerability" and "making innocent requests"? I don't think it's possible to reliably make this distinction. The law, of course, doesn't try: it turns on whether the person who made the requests should reasonably have known whether they were authorized to make that request.
- Canada 10y ago
  I know, and I also believe it's impossible. I was trying to steer the conversation away from that debate by pointing out that Power was invited in by authorized users.

erroneousfunk 10y ago

This is like being banned from a restaurant, then returning the next day and saying "well, I pushed on the door and it opened, so it's nonsensical to say I was trespassing"