11 ms·

Classifying data of any form as illegal is a dangerous idea. Requests with SQL in them shouldn't be illegal. If people want laws against hacking, they should be

Classifying data of any form as illegal is a dangerous idea. Requests with SQL in them shouldn't be illegal. If people want laws against hacking, they should be based on something other than the contents of files and electricity on wires. If they can't find something, there just shouldn't be a law.

rayiner 10y ago
But it seems to me like 'ramblenode is arguing the exact opposite: that the law ignores the HTTP request and response on the wire to look at the actual interaction between Power and Facebook and the result of the packets Power sent.
- themihai 10y ago
  The SQL injection is more like entering using a `back door` instead asking for permission. Power used the facebook API which is the `main entrance`.
  - deleted 10y ago
    [deleted]
  - dpark 10y ago
    You realize trespassing is illegal regardless of which door you use, right?
    - tptacek 10y ago
      This came up on a recent thread here, where someone was surprised to learn that the crime of entering someone's house through an unlocked window or door is called "breaking and entering".
      - dpark 10y ago
        Yeah, I was reluctant to mention breaking and entering here because it depends on the state. In California, it would be burglary because they don't actually have a "breaking and entering" law. If you somehow entered through the window with no intent to commit further crime, I think it would be trespass, but I'm not sure.
      - Spivak 10y ago
        I think the fact that it's surprising is an indication of a problem with the law. If people think that breaking and entering actually requires physically breaking something or disarming some security measure then that's probably what it should be. Is there really a harm in calling it trespassing?
        dpark 10y ago
        Trespassing is a different crime. It's a bother to have a stranger enter your property uninvited. It's a huge invasion to have a stranger enter your house uninvited. The former may be trespassing. The latter is likely breaking and entering (or burglary or some similar law). You could try to change the names, but it honestly doesn't matter. Many people also don't know the difference between assault and battery. No one really thinks it's okay to threaten others with physical violence even if no blows are dealt, though. Similarly, no one really thinks it's acceptable to enter someone's home without permission even without literally "breaking in". The laws around these are generally reasonable even if the legal names aren't exactly what people expect.
        dragonwriter 10y ago
        > If people think that breaking and entering actually requires physically breaking something or disarming some security measure then that's probably what it should be. "Breaking and entering" appears to have originated as a English legal doublet [0] -- a pair of words with origins in different languages with similar meaning adopted as the language of the law changed. As an aid to clarity. > Is there really a harm in calling it trespassing? Well, yes, because: (1) "Breaking and entering" already has another name, "burglary". [1] (2) "Trespassing" is the name of another, broader and, by itself less serious, crime of intrusion onto property without permission. [0] https://en.wikipedia.org/wiki/Legal_doublet https://en.wikipedia.org/wiki/Legal_doublet [1] See, e.g., https://en.wikipedia.org/wiki/Breaking_and_entering https://en.wikipedia.org/wiki/Breaking_and_entering
tptacek 10y ago
This at least points towards a coherent position. Before assuming that you hold it, let me clarify a little: we both understand that SQL is just an example, right, and virtually all other security vulnerabilities would be lawfully exploitable as well? The difference between SQL injection and memory corruption is simply that of two different programming languages being used to carry the attack. So the position you hold is that people on the Internet should be allowed to hijack each others computers, lest the law begin determining the legality of contents of files or electricity on wires? As I said: that's a coherent position. It's not one I hold or would personally find tolerable, and I think the long term public policy consequences would be surprising to people who hold that position out of a rooting interest for underdogs (people are quick to forget that money buys more exploits every year than principle ever has). But I don't know that I could rebut arguments based on it simply based on logic.
- ctrl-j 10y ago
  The terminology as it stands it too broad. The people on the internet shouldn't be allowed to hijack each others computers. There should be a law specifically against hijacking another computer without permission. Just like guns, and going to the bank aren't illegal. In some places going to the bank with a gun isn't illegal. But pointing a gun in a bank at a teller and saying "give me all the money" is illegal.
  - dpark 10y ago
    > In some places going to the bank with a gun isn't illegal. But pointing a gun in a bank at a teller and saying "give me all the money" is illegal. Right, it's entirely about intent. Assuming you live in a place where you can legally open-carry a gun into a bank, it's still illegal for you to stare down the teller while motioning to the gun if you're doing so with the intent of stealing money from the bank. It's not about what you say or don't, or how you indicate that you want the money. It's entirely about whether you intend to steal from the bank. If the teller gets freaked out just because you're open-carrying and hits the alarm button, you've not committed a crime unless you had intent.
madmax96 10y ago
>Requests with SQL in them shouldn't be illegal. Intent matters here. If little "Johnny DROP TABLE" causes a problem with his input but there is no evidence he did so deliberately, I don't think a sane person would argue he was cracking. But if a user fetches "Main St. USA Business" unencrypted passwords and sells or distributes them, clearly a line has been crossed. That line seems to be "personal profit", financially or otherwise.
- riskable 10y ago
  Actually, there's loads of laws like this! I'd argue that if a user fetches the unencrypted passwords of users from a website that they shouldn't be punished at all because merely obtaining such information isn't harmful to anyone until it is used (in a nefarious way). If I download a huge list of credit card/account details that someone accidentally exposed on their website have I committed a crime? Certainly not! If I use those account details to commit fraud (or similar crimes) then it's a problem. Aside: If someone is able to pull unencrypted passwords from any company's database the real crime there is the fact that the passwords were stored unencrypted in the first place!
  - deleted 10y ago
    [deleted]

rayiner 10y ago

But it seems to me like 'ramblenode is arguing the exact opposite: that the law ignores the HTTP request and response on the wire to look at the actual interaction between Power and Facebook and the result of the packets Power sent.

themihai 10y ago
The SQL injection is more like entering using a `back door` instead asking for permission. Power used the facebook API which is the `main entrance`.
- deleted 10y ago
  [deleted]
- dpark 10y ago
  You realize trespassing is illegal regardless of which door you use, right?
  - tptacek 10y ago
    This came up on a recent thread here, where someone was surprised to learn that the crime of entering someone's house through an unlocked window or door is called "breaking and entering".
    - dpark 10y ago
      Yeah, I was reluctant to mention breaking and entering here because it depends on the state. In California, it would be burglary because they don't actually have a "breaking and entering" law. If you somehow entered through the window with no intent to commit further crime, I think it would be trespass, but I'm not sure.
    - Spivak 10y ago
      I think the fact that it's surprising is an indication of a problem with the law. If people think that breaking and entering actually requires physically breaking something or disarming some security measure then that's probably what it should be. Is there really a harm in calling it trespassing?
      - dpark 10y ago
        Trespassing is a different crime. It's a bother to have a stranger enter your property uninvited. It's a huge invasion to have a stranger enter your house uninvited. The former may be trespassing. The latter is likely breaking and entering (or burglary or some similar law). You could try to change the names, but it honestly doesn't matter. Many people also don't know the difference between assault and battery. No one really thinks it's okay to threaten others with physical violence even if no blows are dealt, though. Similarly, no one really thinks it's acceptable to enter someone's home without permission even without literally "breaking in". The laws around these are generally reasonable even if the legal names aren't exactly what people expect.
      - dragonwriter 10y ago
        > If people think that breaking and entering actually requires physically breaking something or disarming some security measure then that's probably what it should be. "Breaking and entering" appears to have originated as a English legal doublet [0] -- a pair of words with origins in different languages with similar meaning adopted as the language of the law changed. As an aid to clarity. > Is there really a harm in calling it trespassing? Well, yes, because: (1) "Breaking and entering" already has another name, "burglary". [1] (2) "Trespassing" is the name of another, broader and, by itself less serious, crime of intrusion onto property without permission. [0] https://en.wikipedia.org/wiki/Legal_doublet https://en.wikipedia.org/wiki/Legal_doublet [1] See, e.g., https://en.wikipedia.org/wiki/Breaking_and_entering https://en.wikipedia.org/wiki/Breaking_and_entering

tptacek 10y ago

This at least points towards a coherent position. Before assuming that you hold it, let me clarify a little: we both understand that SQL is just an example, right, and virtually all other security vulnerabilities would be lawfully exploitable as well? The difference between SQL injection and memory corruption is simply that of two different programming languages being used to carry the attack. So the position you hold is that people on the Internet should be allowed to hijack each others computers, lest the law begin determining the legality of contents of files or electricity on wires? As I said: that's a coherent position. It's not one I hold or would personally find tolerable, and I think the long term public policy consequences would be surprising to people who hold that position out of a rooting interest for underdogs (people are quick to forget that money buys more exploits every year than principle ever has). But I don't know that I could rebut arguments based on it simply based on logic.

ctrl-j 10y ago
The terminology as it stands it too broad. The people on the internet shouldn't be allowed to hijack each others computers. There should be a law specifically against hijacking another computer without permission. Just like guns, and going to the bank aren't illegal. In some places going to the bank with a gun isn't illegal. But pointing a gun in a bank at a teller and saying "give me all the money" is illegal.
- dpark 10y ago
  > In some places going to the bank with a gun isn't illegal. But pointing a gun in a bank at a teller and saying "give me all the money" is illegal. Right, it's entirely about intent. Assuming you live in a place where you can legally open-carry a gun into a bank, it's still illegal for you to stare down the teller while motioning to the gun if you're doing so with the intent of stealing money from the bank. It's not about what you say or don't, or how you indicate that you want the money. It's entirely about whether you intend to steal from the bank. If the teller gets freaked out just because you're open-carrying and hits the alarm button, you've not committed a crime unless you had intent.

madmax96 10y ago

>Requests with SQL in them shouldn't be illegal. Intent matters here. If little "Johnny DROP TABLE" causes a problem with his input but there is no evidence he did so deliberately, I don't think a sane person would argue he was cracking. But if a user fetches "Main St. USA Business" unencrypted passwords and sells or distributes them, clearly a line has been crossed. That line seems to be "personal profit", financially or otherwise.

riskable 10y ago
Actually, there's loads of laws like this! I'd argue that if a user fetches the unencrypted passwords of users from a website that they shouldn't be punished at all because merely obtaining such information isn't harmful to anyone until it is used (in a nefarious way). If I download a huge list of credit card/account details that someone accidentally exposed on their website have I committed a crime? Certainly not! If I use those account details to commit fraud (or similar crimes) then it's a problem. Aside: If someone is able to pull unencrypted passwords from any company's database the real crime there is the fact that the passwords were stored unencrypted in the first place!
- deleted 10y ago
  [deleted]