5 ms·

Is putting random shit at the end of a URL really illegal?

seiji 16y ago
There was this from a few years ago too: http://www.securityfocus.com/news/10611 http://www.securityfocus.com/news/10611 -- I think it was the same sort of "append a param to the URL" event. We're at a gaping chasm of misunderstanding here. Tech people see websites as things to be used and toyed with. Non-tech people see websites as things that have terms of service that are supposed to legally restrict what you can do. "YOU MUST NOT ACCESS THIS WEBSITE IN ANY AUTOMATED FASHION WHATSOEVER." They argue on a basis resembling: "You wouldn't break into the admissions office and steal the list of accepted candidates, would you?" We counter-argue that it's like knowing a person who can't lie to you. If you ask them for the result, they give you the result. Is it illegal to ask for an answer if they don't even hesitate to give it to you?
- surlyadopter 16y ago
  I think that is the same line of reasoning some warez/piracy sites used to put those "if you are a law enforcement personnel you are not allowed to view this website" messages.
- tvon 16y ago
  Doesn't that counter argument amount to "but it's easy, and tempting"?
  - seiji 16y ago
    Exactly right. Let's jump further in to not-quite-isomorphic-analogy land. Consider banks not having vaults and instead leaving their money sitting out in the open. It would be easy and tempting to swipe some. Doing so may be "wrong" technically, but by the availability and lack of security, one can presume the banks are aware of the risks and can tolerate some shrink. I would argue it's not wrong if they put no security in place, it's in a public place, and no person is denied a resource by your act of accessing the public resource with no security.
    - warfangle 16y ago
      To take it a liiiittle further: Like a bank whose tellers (a gatekeeping mechanism) will give you however much money you ask for as long as you end your sentence with "swordfish" - they just don't tell anyone about swordfish.
gizmo 16y ago
It's not random shit, it's deliberately crafted shit. Just because something can be represented by bunch of ones and zeros doesn't make it any less meaningful. So of course it should be illegal. Just as illegal as "random characters" that happen to contain terrorist plans or worse.
- gloob 16y ago
  Though, admittedly, the question does arise regarding just why AT&T would publicly publish a web page if they didn't want anyone to see it. "I thought it was private" might be a legitimate excuse for a middle-aged woman on Facebook. I have less sympathy for a telecom, somehow.
- koeselitz 16y ago
  "Terror plans or worse" have never been illegal in the United States.
  - gizmo 16y ago
    False. It's called conspiracy [to break the law] and it's illegal in almost every country, including the United States. Even if you never intend to carry through with your plans, it's still very illegal.
    - wrs 16y ago
      On the contrary, conspiracy is an agreement between people, not a plan, and especially not a plan you don't intend to carry out. Otherwise quite a few novels and disaster recovery documents would be illegal. http://www.lectlaw.com/def/c103.htm http://www.lectlaw.com/def/c103.htm
    - koeselitz 16y ago
      Do you sincerely believe that the "random characters" that make up the plan of a terrorist are themselves illegal? A group of Saudi men planned and carried out an attack on New York City in 2001. There - am I now liable for prosecution for describing "terror plans"? The intent to break the law, the intent to commit terrorist acts, can indeed be illegal. The intent, however, cannot be contained by "random characters," as you put it. The law does seek to ensure that people can live without fear of attack, but the act of mentioning terrorism or mentioning terrorist acts is certainly not illegal. And this is specifically what you said: you said that the random characters which make up a terror plan or worse are illegal.
mukyu 16y ago
http://www.zdnet.co.uk/news/security-management/2005/10/06/tsunami-appeal-site-hacker-found-guilty-39226548/ http://www.zdnet.co.uk/news/security-management/2005/10/06/t... I also recall a case where someone just removed one or two directories from a path and found an unprotected virtual listing but they said it was unauthorized because he had been sent a 403 at some point.
patio11 16y ago
"Wow, that took a lot of effort" is not frequently an element of the offense, for anything.
- billswift 16y ago
  In ordinary trespass it is. I am about to spend several hundred dollars to fence my back yard, because that is the only way to stop people from just cutting across it.

seiji 16y ago

There was this from a few years ago too: http://www.securityfocus.com/news/10611 http://www.securityfocus.com/news/10611 -- I think it was the same sort of "append a param to the URL" event. We're at a gaping chasm of misunderstanding here. Tech people see websites as things to be used and toyed with. Non-tech people see websites as things that have terms of service that are supposed to legally restrict what you can do. "YOU MUST NOT ACCESS THIS WEBSITE IN ANY AUTOMATED FASHION WHATSOEVER." They argue on a basis resembling: "You wouldn't break into the admissions office and steal the list of accepted candidates, would you?" We counter-argue that it's like knowing a person who can't lie to you. If you ask them for the result, they give you the result. Is it illegal to ask for an answer if they don't even hesitate to give it to you?

surlyadopter 16y ago
I think that is the same line of reasoning some warez/piracy sites used to put those "if you are a law enforcement personnel you are not allowed to view this website" messages.
tvon 16y ago
Doesn't that counter argument amount to "but it's easy, and tempting"?
- seiji 16y ago
  Exactly right. Let's jump further in to not-quite-isomorphic-analogy land. Consider banks not having vaults and instead leaving their money sitting out in the open. It would be easy and tempting to swipe some. Doing so may be "wrong" technically, but by the availability and lack of security, one can presume the banks are aware of the risks and can tolerate some shrink. I would argue it's not wrong if they put no security in place, it's in a public place, and no person is denied a resource by your act of accessing the public resource with no security.
  - warfangle 16y ago
    To take it a liiiittle further: Like a bank whose tellers (a gatekeeping mechanism) will give you however much money you ask for as long as you end your sentence with "swordfish" - they just don't tell anyone about swordfish.

gizmo 16y ago

It's not random shit, it's deliberately crafted shit. Just because something can be represented by bunch of ones and zeros doesn't make it any less meaningful. So of course it should be illegal. Just as illegal as "random characters" that happen to contain terrorist plans or worse.

gloob 16y ago
Though, admittedly, the question does arise regarding just why AT&T would publicly publish a web page if they didn't want anyone to see it. "I thought it was private" might be a legitimate excuse for a middle-aged woman on Facebook. I have less sympathy for a telecom, somehow.
koeselitz 16y ago
"Terror plans or worse" have never been illegal in the United States.
- gizmo 16y ago
  False. It's called conspiracy [to break the law] and it's illegal in almost every country, including the United States. Even if you never intend to carry through with your plans, it's still very illegal.
  - wrs 16y ago
    On the contrary, conspiracy is an agreement between people, not a plan, and especially not a plan you don't intend to carry out. Otherwise quite a few novels and disaster recovery documents would be illegal. http://www.lectlaw.com/def/c103.htm http://www.lectlaw.com/def/c103.htm
  - koeselitz 16y ago
    Do you sincerely believe that the "random characters" that make up the plan of a terrorist are themselves illegal? A group of Saudi men planned and carried out an attack on New York City in 2001. There - am I now liable for prosecution for describing "terror plans"? The intent to break the law, the intent to commit terrorist acts, can indeed be illegal. The intent, however, cannot be contained by "random characters," as you put it. The law does seek to ensure that people can live without fear of attack, but the act of mentioning terrorism or mentioning terrorist acts is certainly not illegal. And this is specifically what you said: you said that the random characters which make up a terror plan or worse are illegal.

mukyu 16y ago

http://www.zdnet.co.uk/news/security-management/2005/10/06/tsunami-appeal-site-hacker-found-guilty-39226548/ http://www.zdnet.co.uk/news/security-management/2005/10/06/t... I also recall a case where someone just removed one or two directories from a path and found an unprotected virtual listing but they said it was unauthorized because he had been sent a 403 at some point.

patio11 16y ago

"Wow, that took a lot of effort" is not frequently an element of the offense, for anything.

billswift 16y ago
In ordinary trespass it is. I am about to spend several hundred dollars to fence my back yard, because that is the only way to stop people from just cutting across it.