7 ms·

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the i

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

gowld 8y ago
Googlebot has the resources to fight back against government attacks.
rayiner 8y ago
> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
- samatman 8y ago
  It... it is accessible from a link That's what a url with an id in it is a link
  - rayiner 8y ago
    A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.
    - doomtop 8y ago
      Sounds like you might be thinking of an anchor element. People ask for the "link" when they mean the URI all the time.
      - rayiner 8y ago
        Wikipedia disagrees: > In computing, a hyperlink, or simply a link, is a reference to data that the reader can directly follow either by clicking, tapping, or hovering. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is called anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink (or simply to link). A user following hyperlinks is said to navigate or browse the hypertext. The URL in the abstract is not a "link." A link is an element in hypertext.
        always_good 8y ago
        You're just being stubborn. Link is used to mean a URL by the layperson. For example, I don't think I've ever heard my family say "URL" in their life.
        ozzmotik 8y ago
        a "link" is something that connects two entities together in some arbitrary way. a chain link for instance connects the constituent entities of a chain (other links) together. a link in a linked list connects different nodes together. and a hypertext link connects two hypertext resources together. what you're doing is picking one specific definition and applying it liberally to all potential interpretations and contexts of said word. this is why i tend to espouse the virtues of generality over specificity; when you get too specific, you start eliminating the actual utility and flexibility of language. a link in terms of computing is most certainly NOT just a hypertext link, that is only one very specific interpretation of the concept at hand that you're falling back on to try and further your argument. liberally ignoring all the other possible interpretations is quite intellectually dishonest imo. still, you're entitled to perceive things how you want and argue it whatever way you desire. just know that the majority of reasonable and educated individuals will disagree with you. you're up shit creek and you keep denying every paddle that's offered to ya m8
        jakeogh 8y ago
        "wikipedia disagrees" like it's a source?
    - gitgud 8y ago
      Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?
      - rayiner 8y ago
        "Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.
        prophesi 8y ago
        There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
        rayiner 8y ago
        The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
        munk-a 8y ago
        You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.
        prophesi 8y ago
        I would agree if it took an actual exploit to obtain the information.
        PretzelPirate 8y ago
        When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
    - ljm 8y ago
      A link is nothing of the sort, it's a colloquial term that connects one point to another. It is not unique to HTML or programming in the slightest. In those terms a URL is always a link because the only practical reason for inventing the concept of a universal resource locator is to link one thing to another without them coming into conflict. There is no reason for a URL to exist except for it to be a link and it has nothing to do with the DOM.
    - lewilewilewi 8y ago
      You're right - a URL is an address, and a link is a sign saying 'go here'. The address still exists with or without the sign.
- BadThink6655321 8y ago
  If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.
  - systematical 8y ago
    A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They should be glad a seemingly benign teenager discovered their flaw and not some more nefarious actor.
    - maddyboo 8y ago
      Violating Terms of Use is not a crime [1]. 1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing https://www.eff.org/deeplinks/2010/07/court-violating-terms-...
      - brailsafe 8y ago
        I agree, however it is worth noting that this link probably only falls within the jurisdiction of the U.S.
      - jessaustin 8y ago
        ...for now. It's pretty clear which direction the legal profession wants to go.
      - gnode 8y ago
        This example is not entirely equivalent. My understanding is that the opinion of the court was that authorisation (for the definition of "without permission") cannot be decided based on method of access. I.e. if you have granted a user access to data, you can't later say they accessed it without permission because they used a proxy or bot to access it (in violation of your TOS). A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.
- hug 8y ago
  Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files. Turns out some of them were mislabeled, and were private information in the public information filing cabinet. Not so weird, not so antisocial, not his fault, shouldn't be his problem.
  - rayiner 8y ago
    If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.
    - prophesi 8y ago
      Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out. Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.
      - munk-a 8y ago
        Also, the library was called the "Free Information" library. IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.
    - corny 8y ago
      It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.
- noonespecial 8y ago
  Its more like a bunch of books on a shelf at the library with one 'special' book, unmarked, in the middle where they charge you with theft if you grab it.
- brailsafe 8y ago
  Door handles should be actively jiggled on the regs. If anything it's social behavior. Maybe you'll walk in on an orgy and get to join in!
  - jessaustin 8y ago
    That's what I'm going to tell the next inhabitant I meet while jiggling knobs!
    - brailsafe 8y ago
      That you were just hoping to find an orgy? I fully support this endeavor.
- framtk 8y ago
  Let's say you are reading a free manual online and every page is stored as a different webpage with a common URL and only the last number changing (E.G. page 1 is book/1 page 2 is book/2 and so on). The only way to go to a certain page is with a "next page" link from the previous one. You read the index at page 1 and see that you cant find the information you need but page 500 is missing, a printing error in the index perhaps. Instead of clicking 499 times on the page links to see if the information you need is on page 500 you simply change book/1 to book/500. OH NO, the link on page 499 brings you to page 501 and it's not in the index because page 500 contains the truth about aliens so now you read it and are going to prison. That's in a nutshell what happened
- msla 8y ago
  Imagine a government information bureau. The employees who work there have access to all information. Why wouldn't they? They work at the information bureau. They also answer all questions. Why wouldn't they? They work at the information bureau. You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets. Do you see a possible problem with this arrangement?

gowld 8y ago

Googlebot has the resources to fight back against government attacks.

rayiner 8y ago

> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.

samatman 8y ago
It... it is accessible from a link That's what a url with an id in it is a link
- rayiner 8y ago
  A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.
  - doomtop 8y ago
    Sounds like you might be thinking of an anchor element. People ask for the "link" when they mean the URI all the time.
    - rayiner 8y ago
      Wikipedia disagrees: > In computing, a hyperlink, or simply a link, is a reference to data that the reader can directly follow either by clicking, tapping, or hovering. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is called anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink (or simply to link). A user following hyperlinks is said to navigate or browse the hypertext. The URL in the abstract is not a "link." A link is an element in hypertext.
      - always_good 8y ago
        You're just being stubborn. Link is used to mean a URL by the layperson. For example, I don't think I've ever heard my family say "URL" in their life.
      - ozzmotik 8y ago
        a "link" is something that connects two entities together in some arbitrary way. a chain link for instance connects the constituent entities of a chain (other links) together. a link in a linked list connects different nodes together. and a hypertext link connects two hypertext resources together. what you're doing is picking one specific definition and applying it liberally to all potential interpretations and contexts of said word. this is why i tend to espouse the virtues of generality over specificity; when you get too specific, you start eliminating the actual utility and flexibility of language. a link in terms of computing is most certainly NOT just a hypertext link, that is only one very specific interpretation of the concept at hand that you're falling back on to try and further your argument. liberally ignoring all the other possible interpretations is quite intellectually dishonest imo. still, you're entitled to perceive things how you want and argue it whatever way you desire. just know that the majority of reasonable and educated individuals will disagree with you. you're up shit creek and you keep denying every paddle that's offered to ya m8
      - jakeogh 8y ago
        "wikipedia disagrees" like it's a source?
  - gitgud 8y ago
    Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?
    - rayiner 8y ago
      "Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.
      - prophesi 8y ago
        There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
        rayiner 8y ago
        The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
        munk-a 8y ago
        You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.
        prophesi 8y ago
        I would agree if it took an actual exploit to obtain the information.
        PretzelPirate 8y ago
        When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
  - ljm 8y ago
    A link is nothing of the sort, it's a colloquial term that connects one point to another. It is not unique to HTML or programming in the slightest. In those terms a URL is always a link because the only practical reason for inventing the concept of a universal resource locator is to link one thing to another without them coming into conflict. There is no reason for a URL to exist except for it to be a link and it has nothing to do with the DOM.
  - lewilewilewi 8y ago
    You're right - a URL is an address, and a link is a sign saying 'go here'. The address still exists with or without the sign.
BadThink6655321 8y ago
If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.
- systematical 8y ago
  A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They should be glad a seemingly benign teenager discovered their flaw and not some more nefarious actor.
  - maddyboo 8y ago
    Violating Terms of Use is not a crime [1]. 1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing https://www.eff.org/deeplinks/2010/07/court-violating-terms-...
    - brailsafe 8y ago
      I agree, however it is worth noting that this link probably only falls within the jurisdiction of the U.S.
    - jessaustin 8y ago
      ...for now. It's pretty clear which direction the legal profession wants to go.
    - gnode 8y ago
      This example is not entirely equivalent. My understanding is that the opinion of the court was that authorisation (for the definition of "without permission") cannot be decided based on method of access. I.e. if you have granted a user access to data, you can't later say they accessed it without permission because they used a proxy or bot to access it (in violation of your TOS). A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.
hug 8y ago
Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files. Turns out some of them were mislabeled, and were private information in the public information filing cabinet. Not so weird, not so antisocial, not his fault, shouldn't be his problem.
- rayiner 8y ago
  If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.
  - prophesi 8y ago
    Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out. Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.
    - munk-a 8y ago
      Also, the library was called the "Free Information" library. IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.
  - corny 8y ago
    It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.
noonespecial 8y ago
Its more like a bunch of books on a shelf at the library with one 'special' book, unmarked, in the middle where they charge you with theft if you grab it.
brailsafe 8y ago
Door handles should be actively jiggled on the regs. If anything it's social behavior. Maybe you'll walk in on an orgy and get to join in!
- jessaustin 8y ago
  That's what I'm going to tell the next inhabitant I meet while jiggling knobs!
  - brailsafe 8y ago
    That you were just hoping to find an orgy? I fully support this endeavor.
framtk 8y ago
Let's say you are reading a free manual online and every page is stored as a different webpage with a common URL and only the last number changing (E.G. page 1 is book/1 page 2 is book/2 and so on). The only way to go to a certain page is with a "next page" link from the previous one. You read the index at page 1 and see that you cant find the information you need but page 500 is missing, a printing error in the index perhaps. Instead of clicking 499 times on the page links to see if the information you need is on page 500 you simply change book/1 to book/500. OH NO, the link on page 499 brings you to page 501 and it's not in the index because page 500 contains the truth about aliens so now you read it and are going to prison. That's in a nutshell what happened
msla 8y ago
Imagine a government information bureau. The employees who work there have access to all information. Why wouldn't they? They work at the information bureau. They also answer all questions. Why wouldn't they? They work at the information bureau. You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets. Do you see a possible problem with this arrangement?