3 ms·

> How does a website put reasonable limits on access? 1) Blocking TCP connections 2) Returning a 4XX error, perhaps even "401 Authorization Required", "402 P

> How does a website put reasonable limits on access? 1) Blocking TCP connections 2) Returning a 4XX error, perhaps even "401 Authorization Required", "402 Payment Required", "403 Forbidden", or "429 Too Many Requests" > A regular B&M store can refuse service to disruptive people and trespass people who don't comply, why not servers? A Brick and Mortar store has to _tell_ you you're being banned. The mechanisms I listed above both tell you and lock the door whenever you attempt to access. Edit: In this case, it's more like someone was looking in the store window from the public sidewalk and asked to stop. Can you really ask someone to stop looking at you from a public place?

UncleEntity 9y ago
> In this case, it's more like someone was looking in the store window from the public sidewalk and asked to stop. I think it's more like calling the store and asking them what their prices are 20 times a minute.
- mcguire 9y ago
  No, it's more like you holding the giraffe while I fill the bathtub with brightly painted power tools. Because reasoning by analogy sucks. No one is accusing HiQ of performing a denial of service attack.
  - UncleEntity 9y ago
    > ...you holding the giraffe while I fill the bathtub with brightly painted power tools. I'm down for that.
- jimktrains2 9y ago
  ...and the coffee shop doesn't block your number. Also, a phone call consumes, as a percentage of available resources, vastly more than an HTTP request. Disregarding that though, I think you'd need a court order telling someone not to talk to you, and you'd have to take action to prevent them as well, blocking their number and tell them to stop before that would be granted. If they persisted after being told explicitly and having their number blocked, then yes, I do think legal action would occure and be swift. I would also assume, presumably, that "you" can be extended to be an automated phone system. (Which is still more limited in capacity than a server would be, but even disregarding that.) FWIW, I'm not saying that "hiQ Labs" is blameless or acting in good faith. I'm saying that unimpeded access to publicly accessible information requires more than asking someone to stop and that the CFAA isn't the right tool for this. I'm not an expert in this field, but I doubt the vast majority of anyone in this thread is. It also becomes interesting because I believe the CFAA has been used in similar situations before, but those were where the accessed knowlege could be assumed to be private, even if made public (client details at a phone company, or articles known to be behind a paywall) (and not that I agree with its usage there either, but the data accessed there could be assumed, by a reasonable person, to not be public). So the key thing here is: if something is publicly available, can I ask you to stop looking at it, or do I need a more stringent court order to prevent you from viewing public information? And in this case, I do think the capacity constraints disregarded above would come into play. I think the courts would look differently at someone calling your clerk 20 times a day vs looking at a menu you post on the window.
  - UncleEntity 9y ago
    > ...I think you'd need a court order telling someone not to talk to you, and you'd have to take action to prevent them as well, blocking their number and tell them to stop before that would be granted. Like, for example, sending a C&D letter? This whole hubbub is over them sending a C&D, they just made the mistake of trying to use the CFAA as a means to enforce it -- which, honestly, hiQ is fighting the good fight trying to stop.
    - jimktrains2 9y ago
      A c&d is not a court order. It is a not-so-polite request and warning that further action will be taken. Edit: If that's your point I agree with you. C&d followed by some more appropriate (than the cfaa) seems like a not-raise-everyones-backs approach.
      - mark-r 9y ago
        That raises a point - would hiQ be liable in a civil suit if the CFAA were not a factor?
amyjess 9y ago
LinkedIn sent HiQ a C&D. They were indeed told that they were banned. Let's try a thought experiment: you're at a supermarket, and you're abusing coupons to the point where you're holding up the line for everyone. Someone complains to the manager, and the manager escorts you out of the store and tells you you're banned for life (as an aside, I wish this would happen to extreme couponers). The supermarket also has automatic doors and a self-checkout. They're also pretty understaffed, so there's a good chance you won't run into anyone stocking the shelves as you're shopping. A few days after you've been banned, you waltz in through the automatic doors, grab some items off the nearest shelf, go through the self-checkout, and leave without a single employee getting a good look at your face. At the end of the day, the manager starts fast-forwarding though the day's security camera footage looking for anything odd and notices you've been in the store. They call the police and have you charged with trespassing. Do they have a case, yes or no? I say yes.
- jimktrains2 9y ago
  Because of the minimal amount of LinkedIn resources utilized and this not apply to all robots/extreme couponers, wouldn't this be more like a competitor checking your weekly ads posted on your front window? Walking into a store is a clear violation of private space. Is looking at their window? So, if you had to have an account to view any linked in information, and you got a c&d and your account banned, and you sign up for a new account, I think it would be like entering a store you've been banned from. But we're talking about information available from a public space: on your window or without an account. I also take issue with the CFAA being used here. I'm sure there are other laws more applicable to keeping someone from talking with you. To recap: I don't think LinkedIn is wrong to ask them to stop, I just don't think they're using the appropriate means of forcing them to.
oh_sigh 9y ago
Looking in a window from a public place doesn't use any resources of the company being looked-upon.
- TheDong 9y ago
  This legal complaint is not about resources used; it's not a "They criminally DDoSes us". This lawsuit is an attempt to stop competition by curbing access to data, not about ensuring reasonable use of apis and rate limits.

UncleEntity 9y ago

> In this case, it's more like someone was looking in the store window from the public sidewalk and asked to stop. I think it's more like calling the store and asking them what their prices are 20 times a minute.

mcguire 9y ago
No, it's more like you holding the giraffe while I fill the bathtub with brightly painted power tools. Because reasoning by analogy sucks. No one is accusing HiQ of performing a denial of service attack.
- UncleEntity 9y ago
  > ...you holding the giraffe while I fill the bathtub with brightly painted power tools. I'm down for that.
jimktrains2 9y ago
...and the coffee shop doesn't block your number. Also, a phone call consumes, as a percentage of available resources, vastly more than an HTTP request. Disregarding that though, I think you'd need a court order telling someone not to talk to you, and you'd have to take action to prevent them as well, blocking their number and tell them to stop before that would be granted. If they persisted after being told explicitly and having their number blocked, then yes, I do think legal action would occure and be swift. I would also assume, presumably, that "you" can be extended to be an automated phone system. (Which is still more limited in capacity than a server would be, but even disregarding that.) FWIW, I'm not saying that "hiQ Labs" is blameless or acting in good faith. I'm saying that unimpeded access to publicly accessible information requires more than asking someone to stop and that the CFAA isn't the right tool for this. I'm not an expert in this field, but I doubt the vast majority of anyone in this thread is. It also becomes interesting because I believe the CFAA has been used in similar situations before, but those were where the accessed knowlege could be assumed to be private, even if made public (client details at a phone company, or articles known to be behind a paywall) (and not that I agree with its usage there either, but the data accessed there could be assumed, by a reasonable person, to not be public). So the key thing here is: if something is publicly available, can I ask you to stop looking at it, or do I need a more stringent court order to prevent you from viewing public information? And in this case, I do think the capacity constraints disregarded above would come into play. I think the courts would look differently at someone calling your clerk 20 times a day vs looking at a menu you post on the window.
- UncleEntity 9y ago
  > ...I think you'd need a court order telling someone not to talk to you, and you'd have to take action to prevent them as well, blocking their number and tell them to stop before that would be granted. Like, for example, sending a C&D letter? This whole hubbub is over them sending a C&D, they just made the mistake of trying to use the CFAA as a means to enforce it -- which, honestly, hiQ is fighting the good fight trying to stop.
  - jimktrains2 9y ago
    A c&d is not a court order. It is a not-so-polite request and warning that further action will be taken. Edit: If that's your point I agree with you. C&d followed by some more appropriate (than the cfaa) seems like a not-raise-everyones-backs approach.
    - mark-r 9y ago
      That raises a point - would hiQ be liable in a civil suit if the CFAA were not a factor?

amyjess 9y ago

LinkedIn sent HiQ a C&D. They were indeed told that they were banned. Let's try a thought experiment: you're at a supermarket, and you're abusing coupons to the point where you're holding up the line for everyone. Someone complains to the manager, and the manager escorts you out of the store and tells you you're banned for life (as an aside, I wish this would happen to extreme couponers). The supermarket also has automatic doors and a self-checkout. They're also pretty understaffed, so there's a good chance you won't run into anyone stocking the shelves as you're shopping. A few days after you've been banned, you waltz in through the automatic doors, grab some items off the nearest shelf, go through the self-checkout, and leave without a single employee getting a good look at your face. At the end of the day, the manager starts fast-forwarding though the day's security camera footage looking for anything odd and notices you've been in the store. They call the police and have you charged with trespassing. Do they have a case, yes or no? I say yes.

jimktrains2 9y ago
Because of the minimal amount of LinkedIn resources utilized and this not apply to all robots/extreme couponers, wouldn't this be more like a competitor checking your weekly ads posted on your front window? Walking into a store is a clear violation of private space. Is looking at their window? So, if you had to have an account to view any linked in information, and you got a c&d and your account banned, and you sign up for a new account, I think it would be like entering a store you've been banned from. But we're talking about information available from a public space: on your window or without an account. I also take issue with the CFAA being used here. I'm sure there are other laws more applicable to keeping someone from talking with you. To recap: I don't think LinkedIn is wrong to ask them to stop, I just don't think they're using the appropriate means of forcing them to.

oh_sigh 9y ago

Looking in a window from a public place doesn't use any resources of the company being looked-upon.

TheDong 9y ago
This legal complaint is not about resources used; it's not a "They criminally DDoSes us". This lawsuit is an attempt to stop competition by curbing access to data, not about ensuring reasonable use of apis and rate limits.