17 ms·

I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government rea

I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.

rayiner 9y ago
That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.
- gowld 9y ago
  ...which is not a felony, because that would be insane.
- deGravity 9y ago
  I think that's a bit harsh. The documents at that URL were understood to be freely available to the public. As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.
  - harryh 9y ago
    Going to a restaurant and taking every single straw out of the top of the straw dispenser is clearly anti-social and is probably theft.
    - bwbw223 9y ago
      But there’s a near infinite supply of straws and it didn’t damage the dispenser.
      - harryh 9y ago
        It did, however, damage the privacy of various Canadian citizens.
        pdonis 9y ago
        > It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.
        harryh 9y ago
        Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.
        phaemon 9y ago
        > Can you please send me a copy of your last 3 tax returns? Options: A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years. B) No, that's confidential. ^^ Which option do you think is more reasonable?
        harryh 9y ago
        A) is not comparable to the current situation because you are the one initiating the action. I can't stop you from sending me an email so it can't be a crime on my part if you do so.
        9y ago
  - spacemanmatt 9y ago
    I have been arrested for taking too many straws.
- Declanomous 9y ago
  That's not true at all, for instance a number of the records that are part of the download were indexed by Google.[1] So it's more like going in to your library, using the card stack, learning about a book, going to the shelf it is on, and then looking at all the books on the same shelf. Somebody noticed that you were looking at all the books and called the cops on you. The cops break in and arrest you for looking at books. They tell you that the bookshelf is off-limits and has personal information. Sure, the library creates it's own card stack and google is an external service; however if you design websites for a living you expect google to perform that functionality. I mean, I designed a service where we wanted to make it easy to share private information, so we didn't use authorization. However I realized that if I wanted the data to be private I should use a suitably long non-consecutive random ID for the resource. If anyone is guilty of criminal misconduct, it's the person who designed this asinine system or the executive who allowed it to be used on the internet. Hell, I'd go so far as to say that the fact that the exact same system is still being used across the US is a sign that the company who runs the system is criminally negligent. [1] https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
- iak8god 9y ago
  These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.
  - rayiner 9y ago
    The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.
    - iak8god 9y ago
      > "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
    - c22 9y ago

rayiner 9y ago

That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

gowld 9y ago
...which is not a felony, because that would be insane.
deGravity 9y ago
I think that's a bit harsh. The documents at that URL were understood to be freely available to the public. As I physical analogy, I'd think about it more as one of those restaurant straw dispensers. He got tired of pressing the button each time for a new straw, and instead opened the lid and grabbed a bunch out.
- harryh 9y ago
  Going to a restaurant and taking every single straw out of the top of the straw dispenser is clearly anti-social and is probably theft.
  - bwbw223 9y ago
    But there’s a near infinite supply of straws and it didn’t damage the dispenser.
    - harryh 9y ago
      It did, however, damage the privacy of various Canadian citizens.
      - pdonis 9y ago
        > It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.
        harryh 9y ago
        Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.
        phaemon 9y ago
        > Can you please send me a copy of your last 3 tax returns? Options: A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years. B) No, that's confidential. ^^ Which option do you think is more reasonable?
        harryh 9y ago
        A) is not comparable to the current situation because you are the one initiating the action. I can't stop you from sending me an email so it can't be a crime on my part if you do so.
        9y ago
- spacemanmatt 9y ago
  I have been arrested for taking too many straws.
Declanomous 9y ago
That's not true at all, for instance a number of the records that are part of the download were indexed by Google.[1] So it's more like going in to your library, using the card stack, learning about a book, going to the shelf it is on, and then looking at all the books on the same shelf. Somebody noticed that you were looking at all the books and called the cops on you. The cops break in and arrest you for looking at books. They tell you that the bookshelf is off-limits and has personal information. Sure, the library creates it's own card stack and google is an external service; however if you design websites for a living you expect google to perform that functionality. I mean, I designed a service where we wanted to make it easy to share private information, so we didn't use authorization. However I realized that if I wanted the data to be private I should use a suitably long non-consecutive random ID for the resource. If anyone is guilty of criminal misconduct, it's the person who designed this asinine system or the executive who allowed it to be used on the internet. Hell, I'd go so far as to say that the fact that the exact same system is still being used across the US is a sign that the company who runs the system is criminally negligent. [1] https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
iak8god 9y ago
These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.
- rayiner 9y ago
  The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.
  - iak8god 9y ago
    > "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
  - c22 9y ago