4 ms·

> If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injec

by gioele 10y ago

> If what you say about "requests" and "responses" is both true and dispositive of the issue of authorization, then you're saying that virtually every SQL injection vulnerability on the Internet is also an "authorized" form of access to people's backend databases. I would say that the SQL/HTTP equest with the SQL injection is _per se_ legal. The damage that it has intentionally caused is what the law should punish. "You are free to tell me whatever you want, but beware: if you catch me offguard and make a damage, then you will be punished for it."

abstractbeliefs 10y ago
At this point, what about malformed requests from homegrown browsers that trigger catastrophic bugs in the upstream application, does this now constitute a federal crime? At no point did either party intent to cause harm, but it happened anyway. Really, I quite like the British framework for this sort of issue: anything can be illegal or legal, it depends on context and motivation.
- rayiner 10y ago
  The CFAA requires you to have "knowingly (accessed a computer without authorization or exceeding authorized access)." (Under typical statutory construction rules, the mens rea requirement should distribute as shown by the parens; I have not checked whether case law has construed the CFAA specifically that way). If you had permission to access the website otherwise, and exceeded authorized access because of a bug, you would not have met the "knowing" requirement and would not have violated the CFAA.
- talmand 10y ago
  Intent goes a long way in many things concerning legal cases in many places around the world.
- Lawtonfogle 10y ago
  Problem with the British system is that in practice race, gender, and SES are just as relevant as context and motivation.
dpark 10y ago
So you think only success is punishable? So if someone takes a swing at you, it's only assault if they connect? If someone takes a shot, it's only illegal if the bullet hits you? If someone tries to break into your house, it's legal until they get inside? Or are computers special for some reason?
- ploxiln 10y ago
  Computers are indeed not like any of these things. I would compare to chatting with someone and talking them into committing suicide. Wasn't there a court case about this a couple of years ago? This is something that is only considered a serious crime if it is successful. Otherwise, it's just being creepy and annoying, who would accept those calls/chats anyway. It's unfortunate that people accept and even love fundamentally unsafe designs of computer operation, where they are not in complete control of what their computer does, and then get upset when their computer does something quite actively opposite of what they wanted. This is inevitable! The biggest difference is in the prevalence.
  - dpark 10y ago
    > Computers are indeed not like any of these things. None of those things are really like the others either, except that they are all still (lesser) crimes even if you're not successful. > I would compare to chatting with someone and talking them into committing suicide. Wasn't there a court case about this a couple of years ago? This is something that is only considered a serious crime if it is successful. Otherwise, it's just being creepy and annoying, who would accept those calls/chats anyway. Probably depends on the state. If it's a crime to convince someone to commit suicide, it's probably a crime to attempt to do so. In California, attempting a crime is a crime in itself. > It's unfortunate that people accept and even love fundamentally unsafe designs of computer operation, where they are not in complete control of what their computer does, and then get upset when their computer does something quite actively opposite of what they wanted. This is inevitable! The biggest difference is in the prevalence. "Fundamentally unsafe"? Unplug your computer if you want fundamentally safe. Otherwise you are always fundamentally unsafe. Access to your house is not "fundamentally safe", but if someone kicks in your door and barges in, few will tell you that it's your fault that for not living in a concrete bunker.
dogweather 10y ago
Sounds like trespass to me because the request explicitly acts like it's conforming to a protocol while it's actually another.

by gioele 10y ago

abstractbeliefs 10y ago

At this point, what about malformed requests from homegrown browsers that trigger catastrophic bugs in the upstream application, does this now constitute a federal crime? At no point did either party intent to cause harm, but it happened anyway. Really, I quite like the British framework for this sort of issue: anything can be illegal or legal, it depends on context and motivation.

rayiner 10y ago
The CFAA requires you to have "knowingly (accessed a computer without authorization or exceeding authorized access)." (Under typical statutory construction rules, the mens rea requirement should distribute as shown by the parens; I have not checked whether case law has construed the CFAA specifically that way). If you had permission to access the website otherwise, and exceeded authorized access because of a bug, you would not have met the "knowing" requirement and would not have violated the CFAA.
talmand 10y ago
Intent goes a long way in many things concerning legal cases in many places around the world.
Lawtonfogle 10y ago
Problem with the British system is that in practice race, gender, and SES are just as relevant as context and motivation.

dpark 10y ago

So you think only success is punishable? So if someone takes a swing at you, it's only assault if they connect? If someone takes a shot, it's only illegal if the bullet hits you? If someone tries to break into your house, it's legal until they get inside? Or are computers special for some reason?

ploxiln 10y ago
Computers are indeed not like any of these things. I would compare to chatting with someone and talking them into committing suicide. Wasn't there a court case about this a couple of years ago? This is something that is only considered a serious crime if it is successful. Otherwise, it's just being creepy and annoying, who would accept those calls/chats anyway. It's unfortunate that people accept and even love fundamentally unsafe designs of computer operation, where they are not in complete control of what their computer does, and then get upset when their computer does something quite actively opposite of what they wanted. This is inevitable! The biggest difference is in the prevalence.
- dpark 10y ago
  > Computers are indeed not like any of these things. None of those things are really like the others either, except that they are all still (lesser) crimes even if you're not successful. > I would compare to chatting with someone and talking them into committing suicide. Wasn't there a court case about this a couple of years ago? This is something that is only considered a serious crime if it is successful. Otherwise, it's just being creepy and annoying, who would accept those calls/chats anyway. Probably depends on the state. If it's a crime to convince someone to commit suicide, it's probably a crime to attempt to do so. In California, attempting a crime is a crime in itself. > It's unfortunate that people accept and even love fundamentally unsafe designs of computer operation, where they are not in complete control of what their computer does, and then get upset when their computer does something quite actively opposite of what they wanted. This is inevitable! The biggest difference is in the prevalence. "Fundamentally unsafe"? Unplug your computer if you want fundamentally safe. Otherwise you are always fundamentally unsafe. Access to your house is not "fundamentally safe", but if someone kicks in your door and barges in, few will tell you that it's your fault that for not living in a concrete bunker.

dogweather 10y ago

Sounds like trespass to me because the request explicitly acts like it's conforming to a protocol while it's actually another.