21 ms·

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building

by eboyjr 8y ago

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

cookingrobot 8y ago
How about looking into the display window of a shop? If they wanted to keep something secret, it should have been out of sight.
losteric 8y ago
I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.
- rayiner 8y ago
  That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.
  - gowld 8y ago
    ...which is not a felony, because that would be insane.
  - deGravity 8y ago
    I think that's a bit harsh. The documents at that URL were understood to be freely available to the public. As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.
    - harryh 8y ago
      Going to a restaurant and taking every single straw out of the top of the straw dispenser is clearly anti-social and is probably theft.
      - bwbw223 8y ago
        But there’s a near infinite supply of straws and it didn’t damage the dispenser.
        harryh 8y ago
        It did, however, damage the privacy of various Canadian citizens.
        pdonis 8y ago
        > It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.
        harryh 8y ago
        Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.
        phaemon 8y ago
        > Can you please send me a copy of your last 3 tax returns? Options: A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years. B) No, that's confidential. ^^ Which option do you think is more reasonable?
  - Declanomous 8y ago
    That's not true at all, for instance a number of the records that are part of the download were indexed by Google.[1] So it's more like going in to your library, using the card stack, learning about a book, going to the shelf it is on, and then looking at all the books on the same shelf. Somebody noticed that you were looking at all the books and called the cops on you. The cops break in and arrest you for looking at books. They tell you that the bookshelf is off-limits and has personal information. Sure, the library creates it's own card stack and google is an external service; however if you design websites for a living you expect google to perform that functionality. I mean, I designed a service where we wanted to make it easy to share private information, so we didn't use authorization. However I realized that if I wanted the data to be private I should use a suitably long non-consecutive random ID for the resource. If anyone is guilty of criminal misconduct, it's the person who designed this asinine system or the executive who allowed it to be used on the internet. Hell, I'd go so far as to say that the fact that the exact same system is still being used across the US is a sign that the company who runs the system is criminally negligent. [1] https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
  - iak8god 8y ago
    These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.
    - rayiner 8y ago
      The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.
      - iak8god 8y ago
        > "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
      - c22 8y ago
haser_au 8y ago
It's more like the restricted section of the public library, and they left the door open. He just walked in, and started reading the books on the shelves, and photocopied all of the books. If there were books in this section that shouldn't have been in there, that's not his fault. That's the librarian's fault.
UncleEntity 8y ago
More like finding a classified FBI interrogation manual in the Library of Congress... Ok, not actually a metaphor -- https://www.motherjones.com/politics/2013/12/fbi-copyrighted-interrogation-manual-unredacted-secrets/ https://www.motherjones.com/politics/2013/12/fbi-copyrighted...
deleted 8y ago
[deleted]
belltaco 8y ago
>the kid Is a 19 year old a kid?
- brailsafe 8y ago
  yes
jessaustin 8y ago
No, it's much more like calling the government on the phone and asking a series of questions. Or like sending them a series of letters. Or entering a government office during business hours and conducting business there. We don't need a metaphor, there are already laws in place governing how we speak to our public servants and how they respond.
- rayiner 8y ago
  Computers are dumb machines. They have no free will, and cannot serve as agents whose actions bind humans.
  - jessaustin 8y ago
    If your car runs me over, I'm going to sue you.
    - rayiner 8y ago
      If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the computer let you access the file." But "what does how the computer let you access the file tell you about what the computer owner intended?"
      - jessaustin 8y ago
        The car is still a dumb object that you own that hurt me, and as a result someone is still paying my hospital bills. You might blame your mechanic, if he did a poor job of brake maintenance. When he attempts to defend himself, how is this "intent" mishmash going to fly? "Your honor, please ignore that there are several RFCs defining how one installs calipers, none of which I followed! It was clearly my intent for the brakes to work!" Also, I'm not sure your analogy works at all. In the first paragraph, you seem to analogize the car to the accused "hacker", while in the second you're talking about the supposedly "hacked" host. To be clear, the point of the car example is that a machine's intelligence has no bearing on how its actions affect the duties of its operators.
dgudkov 8y ago
>I'd argue that the kid was entering through an open window of a public building. Given that he tried to sequentially download all possible documents by sequentially incrementing document ID in URL it's more like trying to open every window in the public building and see what happens.
tremon 8y ago
The open window metaphor implies that the rest of the building's facade was a wall. I don't think that is an accurate description of a website. If we have to resort to metaphors, then let's describe this section of the site as a ring binder, and each FOIPOP publication as a single page in the ring binder. What the kid did, then, is to take out the entire stack of pages and feed it to an automatic copier, put back the originals in the binder and left with the copied stack. There is no indication that the "perpetrator" even looked at any page in that stack. And since the binder was clearly labeled as "free public repository of FOIPOP responses that have been approved for publication", the act of copying the entire stack is no reason to assume foul play.

by eboyjr 8y ago

cookingrobot 8y ago

How about looking into the display window of a shop? If they wanted to keep something secret, it should have been out of sight.

losteric 8y ago

I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.

rayiner 8y ago
That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.
- gowld 8y ago
  ...which is not a felony, because that would be insane.
- deGravity 8y ago
  I think that's a bit harsh. The documents at that URL were understood to be freely available to the public. As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.
  - harryh 8y ago
    Going to a restaurant and taking every single straw out of the top of the straw dispenser is clearly anti-social and is probably theft.
    - bwbw223 8y ago
      But there’s a near infinite supply of straws and it didn’t damage the dispenser.
      - harryh 8y ago
        It did, however, damage the privacy of various Canadian citizens.
        pdonis 8y ago
        > It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.
        harryh 8y ago
        Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.
        phaemon 8y ago
        > Can you please send me a copy of your last 3 tax returns? Options: A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years. B) No, that's confidential. ^^ Which option do you think is more reasonable?
- Declanomous 8y ago
  That's not true at all, for instance a number of the records that are part of the download were indexed by Google.[1] So it's more like going in to your library, using the card stack, learning about a book, going to the shelf it is on, and then looking at all the books on the same shelf. Somebody noticed that you were looking at all the books and called the cops on you. The cops break in and arrest you for looking at books. They tell you that the bookshelf is off-limits and has personal information. Sure, the library creates it's own card stack and google is an external service; however if you design websites for a living you expect google to perform that functionality. I mean, I designed a service where we wanted to make it easy to share private information, so we didn't use authorization. However I realized that if I wanted the data to be private I should use a suitably long non-consecutive random ID for the resource. If anyone is guilty of criminal misconduct, it's the person who designed this asinine system or the executive who allowed it to be used on the internet. Hell, I'd go so far as to say that the fact that the exact same system is still being used across the US is a sign that the company who runs the system is criminally negligent. [1] https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
- iak8god 8y ago
  These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.
  - rayiner 8y ago
    The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.
    - iak8god 8y ago
      > "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
    - c22 8y ago

haser_au 8y ago

It's more like the restricted section of the public library, and they left the door open. He just walked in, and started reading the books on the shelves, and photocopied all of the books. If there were books in this section that shouldn't have been in there, that's not his fault. That's the librarian's fault.

UncleEntity 8y ago

More like finding a classified FBI interrogation manual in the Library of Congress... Ok, not actually a metaphor -- https://www.motherjones.com/politics/2013/12/fbi-copyrighted-interrogation-manual-unredacted-secrets/ https://www.motherjones.com/politics/2013/12/fbi-copyrighted...

deleted 8y ago

[deleted]

belltaco 8y ago

>the kid Is a 19 year old a kid?

brailsafe 8y ago
yes

jessaustin 8y ago

No, it's much more like calling the government on the phone and asking a series of questions. Or like sending them a series of letters. Or entering a government office during business hours and conducting business there. We don't need a metaphor, there are already laws in place governing how we speak to our public servants and how they respond.

rayiner 8y ago
Computers are dumb machines. They have no free will, and cannot serve as agents whose actions bind humans.
- jessaustin 8y ago
  If your car runs me over, I'm going to sue you.
  - rayiner 8y ago
    If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the computer let you access the file." But "what does how the computer let you access the file tell you about what the computer owner intended?"
    - jessaustin 8y ago
      The car is still a dumb object that you own that hurt me, and as a result someone is still paying my hospital bills. You might blame your mechanic, if he did a poor job of brake maintenance. When he attempts to defend himself, how is this "intent" mishmash going to fly? "Your honor, please ignore that there are several RFCs defining how one installs calipers, none of which I followed! It was clearly my intent for the brakes to work!" Also, I'm not sure your analogy works at all. In the first paragraph, you seem to analogize the car to the accused "hacker", while in the second you're talking about the supposedly "hacked" host. To be clear, the point of the car example is that a machine's intelligence has no bearing on how its actions affect the duties of its operators.

dgudkov 8y ago

>I'd argue that the kid was entering through an open window of a public building. Given that he tried to sequentially download all possible documents by sequentially incrementing document ID in URL it's more like trying to open every window in the public building and see what happens.

tremon 8y ago

The open window metaphor implies that the rest of the building's facade was a wall. I don't think that is an accurate description of a website. If we have to resort to metaphors, then let's describe this section of the site as a ring binder, and each FOIPOP publication as a single page in the ring binder. What the kid did, then, is to take out the entire stack of pages and feed it to an automatic copier, put back the originals in the binder and left with the copied stack. There is no indication that the "perpetrator" even looked at any page in that stack. And since the binder was clearly labeled as "free public repository of FOIPOP responses that have been approved for publication", the act of copying the entire stack is no reason to assume foul play.