11 ms·

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document wi

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.

rayiner 8y ago
The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.
- iak8god 8y ago
  > "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
- c22 8y ago
  Editing a url is not "tricking the web server", the web server is designed to respond to urls with the information they point to. Tricking the server would be doing something like sending malformed packets designed to cause the server to leak memory and display the contents of "hidden data" in an exposed field, ie causing it to behave in a way for which it was not intended.
- defined 8y ago
  I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to publicly accessible, and the entire site was meant to be publicly accessible. One can close the analysis until the cows come home, it will not change this fact. Accessing that material is as illegal as finding a diamond ring (or personal files) while dumpster diving. Dumpster diving may be seen as tasteless or low-class, but as far as I know, it’s not illegal. Do we prosecute reporters for ferreting out publicly available, yet embarrassing, information?
  - rayiner 8y ago
    > The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit themselves.
    - jessaustin 8y ago
      Ordinary young people already laugh at this sort of ignorance. Ordinary old people will die soon.
      - rayiner 8y ago
        Ordinary young people today are probably even less computer literate than ordinary people my age (mid 30s). They grew up being spoon fed the Internet through the FB and Snapchat apps on iPhones.
        jessaustin 8y ago
        Your entire argument is based on this idiosyncratic theory of widespread ignorance. This theory is simply wrong, as a matter of fact. Even if it were true, no historical case ever turned on the unprovable notion that most people are too dumb to understand the truth. Since you didn't respond when I raised it elsewhere in-thread, I would highlight again the fundamental imbalance between the rules you would impose on Facebook etc. and those you would impose on users. Firms that spend billions of dollars developing their systems only have to be as smart as the most ignorant person we can imagine. Their users, in contrast, must be geniuses to keep up with their many changes to TOS, interfaces, and functionality, while simultaneously those genius users aren't allowed to notice that numbers follow each other in sequence. This is nonsense on its face, but then again authoritarian maneuvers are their own justification, aren't they?
- fenomas 8y ago
  > And that really is the end of the analysis. You're being hugely disingenuous. The owner of these files set up their website, which includes deciding which files are and are not publicly accessible, and it is reasonable to expect that the files they made publicly accessible are the files they intended to be publicly accessible. One can certainly make the counterargument that a lack of public links suggests the owner wanted them to be private, but you are pretending that there's no evidence whatsoever that the files were meant to be public, and that's plainly not true.
- pdonis 8y ago
  > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. I think most people don't have an intuitive understanding of this at all, which means you can get them to give any answer you want by crafting your description of the problem appropriately. That doesn't make such a procedure reasonable.
- catern 8y ago
  Just curious, not trying to trip you up: In your perspective, would it be trespassing to make a new website which has links to the original site with the edited URLs, without actually accessing those edited URLs? If such a website with links containing edited URLs already existed, would it be trespassing to follow those links? Just curious about which one, or both, of those are trespassing in your perspective.
- naasking 8y ago
  > would a reasonable person infer that documents which could only be accessed by editing a URL Except there's no way to know whether that's the only way to access those documents. That's what access control is for. They could be linked from elsewhere for all you know, and it's perfectly reasonable to assume that if you can access the document by punching in a URL, then it is so accessible.
- rootlocus 8y ago
  > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis. You do realize HN provides an API that allows you to request any item by using an ID? [1] Stories, comments, jobs, Ask HNs and even polls are just items. They're identified by their ids, which are unique integers, and live under /v0/item/<id>. If you really know better than everyone else who has replied to you on this story, why don't you point out the exact law that states accessing resources over HTTP is forbidden if not initiated from another resource originating from the target server? Otherwise, I'll assume your "analysis" is simply a subjective view on how you would like the web to work. A pretty limited and unrealistic view that wouldn't work in the real world. For example: here is the link to the first story posted on HN: https://news.ycombinator.com/item?id=1 https://news.ycombinator.com/item?id=1 1. I don't think you can access that story by starting from the front page, because scrolling for more stories only gets you to page 25. Does that mean the intention is the story is private? 2. You can now access it by using the DOM element generated for my comment. Does that mean it's public? [1] https://github.com/HackerNews/API https://github.com/HackerNews/API
  - foldr 8y ago
    Sure, and the fact that HN has a note to that effect on its website is evidence that all of these items are intended to be publicly accessible. It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. In the case we're talking about here, it was far less obvious that the relevant documents were intended to be publicly available.
    - rootlocus 8y ago
      > It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. > it was far less obvious that the relevant documents were intended to be publicly available My browser and the respective HTTP servers consider them equally obvious publicly available.
      - foldr 8y ago

rayiner 8y ago

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on anthropomorphizing a dumb machine) was intended or not intended to be accessed? I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis.

iak8god 8y ago
> "tricking the HTTP server," I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response. You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own. > I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.
c22 8y ago
Editing a url is not "tricking the web server", the web server is designed to respond to urls with the information they point to. Tricking the server would be doing something like sending malformed packets designed to cause the server to leak memory and display the contents of "hidden data" in an exposed field, ie causing it to behave in a way for which it was not intended.
defined 8y ago
I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to publicly accessible, and the entire site was meant to be publicly accessible. One can close the analysis until the cows come home, it will not change this fact. Accessing that material is as illegal as finding a diamond ring (or personal files) while dumpster diving. Dumpster diving may be seen as tasteless or low-class, but as far as I know, it’s not illegal. Do we prosecute reporters for ferreting out publicly available, yet embarrassing, information?
- rayiner 8y ago
  > The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit themselves.
  - jessaustin 8y ago
    Ordinary young people already laugh at this sort of ignorance. Ordinary old people will die soon.
    - rayiner 8y ago
      Ordinary young people today are probably even less computer literate than ordinary people my age (mid 30s). They grew up being spoon fed the Internet through the FB and Snapchat apps on iPhones.
      - jessaustin 8y ago
        Your entire argument is based on this idiosyncratic theory of widespread ignorance. This theory is simply wrong, as a matter of fact. Even if it were true, no historical case ever turned on the unprovable notion that most people are too dumb to understand the truth. Since you didn't respond when I raised it elsewhere in-thread, I would highlight again the fundamental imbalance between the rules you would impose on Facebook etc. and those you would impose on users. Firms that spend billions of dollars developing their systems only have to be as smart as the most ignorant person we can imagine. Their users, in contrast, must be geniuses to keep up with their many changes to TOS, interfaces, and functionality, while simultaneously those genius users aren't allowed to notice that numbers follow each other in sequence. This is nonsense on its face, but then again authoritarian maneuvers are their own justification, aren't they?
fenomas 8y ago
> And that really is the end of the analysis. You're being hugely disingenuous. The owner of these files set up their website, which includes deciding which files are and are not publicly accessible, and it is reasonable to expect that the files they made publicly accessible are the files they intended to be publicly accessible. One can certainly make the counterargument that a lack of public links suggests the owner wanted them to be private, but you are pretending that there's no evidence whatsoever that the files were meant to be public, and that's plainly not true.
pdonis 8y ago
> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. I think most people don't have an intuitive understanding of this at all, which means you can get them to give any answer you want by crafting your description of the problem appropriately. That doesn't make such a procedure reasonable.
catern 8y ago
Just curious, not trying to trip you up: In your perspective, would it be trespassing to make a new website which has links to the original site with the edited URLs, without actually accessing those edited URLs? If such a website with links containing edited URLs already existed, would it be trespassing to follow those links? Just curious about which one, or both, of those are trespassing in your perspective.
naasking 8y ago
> would a reasonable person infer that documents which could only be accessed by editing a URL Except there's no way to know whether that's the only way to access those documents. That's what access control is for. They could be linked from elsewhere for all you know, and it's perfectly reasonable to assume that if you can access the document by punching in a URL, then it is so accessible.
rootlocus 8y ago
> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis. You do realize HN provides an API that allows you to request any item by using an ID? [1] Stories, comments, jobs, Ask HNs and even polls are just items. They're identified by their ids, which are unique integers, and live under /v0/item/<id>. If you really know better than everyone else who has replied to you on this story, why don't you point out the exact law that states accessing resources over HTTP is forbidden if not initiated from another resource originating from the target server? Otherwise, I'll assume your "analysis" is simply a subjective view on how you would like the web to work. A pretty limited and unrealistic view that wouldn't work in the real world. For example: here is the link to the first story posted on HN: https://news.ycombinator.com/item?id=1 https://news.ycombinator.com/item?id=1 1. I don't think you can access that story by starting from the front page, because scrolling for more stories only gets you to page 25. Does that mean the intention is the story is private? 2. You can now access it by using the DOM element generated for my comment. Does that mean it's public? [1] https://github.com/HackerNews/API https://github.com/HackerNews/API
- foldr 8y ago
  Sure, and the fact that HN has a note to that effect on its website is evidence that all of these items are intended to be publicly accessible. It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. In the case we're talking about here, it was far less obvious that the relevant documents were intended to be publicly available.
  - rootlocus 8y ago
    > It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. > it was far less obvious that the relevant documents were intended to be publicly available My browser and the respective HTTP servers consider them equally obvious publicly available.
    - foldr 8y ago