3 ms·

Phishing and social engineering attacks are close to conventional fraud and should be prosecuted. But nothing that goes over the wire should be interpreted by

Phishing and social engineering attacks are close to conventional fraud and should be prosecuted. But nothing that goes over the wire should be interpreted by prosecutors and judges as a criminal act. It's simply far too arbitrary what they will consider legal or not and the law should be reasonably predictable. On the wire security is the responsibility of server operators and blame shifting has already undermined the influence of correct security practices far too much.

rayiner 10y ago
> But nothing that goes over the wire should be interpreted by prosecutors and judges as a criminal act The law, as written, doesn't look at what "goes over the wire." It focuses on the end-result of getting access to a computer. I don't think that's arbitrary or unpredictable.
- angersock 10y ago
  It focuses on the end-result of getting access to a computer. I don't think that's arbitrary or unpredictable. There are sites that, all the time and with authorized and well-meaning users, have unpredictable results when serving a page request. We call them bugs. :| The law is out of its depth here, least of all because it is attempting to proscribe what it can neither reliably control nor measure.
  - dpark 10y ago
    And if you exploit a bug to gain unauthorized access to a computer, you've committed a crime. Computers and networks are not magic and it makes no sense to pretend that laws cannot limit unauthorized access. We do need to improve many of the laws related to computers, but it's unreasonable to claim that there's no way for laws to cover computers in a reasonable way. > The law is out of its depth here, least of all because it is attempting to proscribe what it can neither reliably control nor measure. You could claim the same about trespass. The courts cannot control access to your property, nor can they monitor or measure such access. Nonetheless, they can prosecute and convict people who trespass on your property and in general, we tend to agree that this is a good thing.

rayiner 10y ago

> But nothing that goes over the wire should be interpreted by prosecutors and judges as a criminal act The law, as written, doesn't look at what "goes over the wire." It focuses on the end-result of getting access to a computer. I don't think that's arbitrary or unpredictable.

angersock 10y ago
It focuses on the end-result of getting access to a computer. I don't think that's arbitrary or unpredictable. There are sites that, all the time and with authorized and well-meaning users, have unpredictable results when serving a page request. We call them bugs. :| The law is out of its depth here, least of all because it is attempting to proscribe what it can neither reliably control nor measure.
- dpark 10y ago
  And if you exploit a bug to gain unauthorized access to a computer, you've committed a crime. Computers and networks are not magic and it makes no sense to pretend that laws cannot limit unauthorized access. We do need to improve many of the laws related to computers, but it's unreasonable to claim that there's no way for laws to cover computers in a reasonable way. > The law is out of its depth here, least of all because it is attempting to proscribe what it can neither reliably control nor measure. You could claim the same about trespass. The courts cannot control access to your property, nor can they monitor or measure such access. Nonetheless, they can prosecute and convict people who trespass on your property and in general, we tend to agree that this is a good thing.