6 ms·

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each oth

by jopsen 9y ago

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. For example, many URLs are actually permalinks, you can bookmark them, or send them to a friend. While most websites don't document this API, it's very common. Lots of people configure search keywords in Firefox by injecting queries in bookmarked URLs. Few of these URL patterns are formally documented, but that doesn't make their usage illegal.

rayiner 9y ago
> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable person would infer about the property owner's intent. The method of access, therefore, is relevant insofar as it tells you about what the owner of the web server intended people to have access to. The fact that content on a website meant for the public to access is only accessible by "programmatic" means that ordinary users would not know, is strong evidence that the owners of the web server did not intend for people to access those documents.
- letlambda 9y ago
  Isn't the assumption always that accessing a web page programmatically is allowed unless specifically asked not to in robots.txt?
- shkkmo 9y ago
  > The fact that content on a website meant for the public to access is only accessible by "programmatic" means that ordinary users would not know, is strong evidence that the owners of the web server did not intend for people to access those documents Sorry, that is complete BS. Have you scanned the entire internet and sure sure there are no links to these files on other public pages? Files publicly hosted by a web server (software explicitly designed and installed to make those files public) is in no shape or form private property. Furthermore, in this specific case, there is an explicit statement saying the files are public and saying nothing about them not being accessible: "The Access to Information website allows you to submit, pay and receive FOIPOP requests online. The Nova Scotia Government also posts responses to formal FOIPOP requests online on the Disclosure log. This is a free public repository of FOIPOP responses that have been approved for publication and have met a specific set of criteria (PDF file 800 KB)." https://novascotia.ca/is/programs-and-services/information-access-and-privacy.asp https://novascotia.ca/is/programs-and-services/information-a...
- ShroudedNight 9y ago
  What is significantly more programmatic about manually incrementing a document ID by 1, than viewing a website in the first place?
- ljm 9y ago
  I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You have to be accountable. The guy who found the problem or abused it is not accountable.
  - harryh 9y ago
    The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.
    - ozzmotik 9y ago
      in this context i don't think your metaphor applies. your house isn't a freely accessible entity that has been declared as such which has certain areas of it that are off limits but never clearly defined as just that.
      - harryh 9y ago
        So what you are saying is that what matters is the intent of the property owner and the general understanding of the population about what is typically public vs private property?
        ozzmotik 9y ago
        i would say that those things are certainly relevant, but it would be perhaps very myopic to say they are the only relevant concepts. one should also keep in mind the intent of the individual attempting to access the property, and the perception of what they're doing when they do within their mind as an expression of that intent, for instance. if i have been to led to believe that your property is public through a means that is debatably authoritative, such as a sign indicating it as such, then for all intents and purposes, anything i interact with inside of it in my mind is perfectly acceptable because it falls within the context of pre-established permissions. and if there are parts of your property that for some reason you would prefer private but they are not demarcated as such, am i really in the wrong to interact with them or go inside of them if i have no external information telling me that i should not? in the context of the article and the problem at hand, the teenager downloaded a bunch of things that were supposed to be public access, but also accidentally downloaded some things that were confidential though not clearly marked as such (im assuming based on available information) and so the only real way he would have known they were confidential was if he actually perused the contents of them. that would be like having a room that is private property and off-limits, and it is marked as such, but the marking is inside the room and can only be seen by entering it and as such violating the private nature of said room. but really these are all just my thoughts on it and i certainly don't think i'm right or anything. it's just fun to talk ya know
- ScottBurson 9y ago
  > Where the intent is not made express, we try to figure out what a reasonable person would infer about the property owner's intent. We do. But if we fail to do so correctly, as people occasionally will, have we committed a serious crime for which we should be facing prison? Particularly in a case where societal custom is not well formed, and analogies to more familiar situations are all strained? This young man, by his account, likes to archive stuff he finds on the Web. From the sound of it, he's done URL incrementation many times, and this is the first time he's gotten in trouble for it. Let's suppose for the sake of argument that that's true, and also that there really were no indications on this site that the information was unintentionally left accessible. Do you really want to send him to prison for that? You might reply that as cruel as that seems, its deterrent value would make it worth doing. But I don't even want to live in a world where people without criminal intent are so succesfully deterred from experimenting with the Internet. In such a world, site owners would take even less responsibility than they do now for securing their information, and therefore actual criminals would have even more unfettered access to it.
asfasgasg 9y ago
> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Agreed. There is no inherent or intrinsic reason to expect that any given document or any given URL ought to be restricted. However, a look at the documents could have provided some extrinsic reason to stop looking. For example, if I find a filing cabinet full of classified documents, I will not continue leafing through them after I see the first one. I will stop immediately and notify someone appropriate (after contacting my lawyer). I do not intend to access classified documents. The question is one of intent. Did the individual intend to access documents that they knew or should have known that they ought not access. If the kid pulled down one classified document, took a look, realized what he was looking at, and deleted it and notified the authorities, then I'm with the crowd. Likewise if they pulled down the entire archive without looking at any of them. I'll be on the front lines with my pitchfork. On the other hand, if they saw the first classified document, then pulled down the rest of the trove hunting for more, some amount of punishment is probably warranted. Even then, I would say fifteen years is too much. Maybe a few months of time and probation, depending on exactly how much willfulness was on display. I imagine these are the kinds of questions that will be resolved during the trial.
- deleted 9y ago
  [deleted]
- ozzmotik 9y ago
  ah yes the age old problem of actus reus sans mens rea
- deleted 9y ago
  [deleted]
- fenomas 9y ago
  > if they saw the first classified document, then pulled down the rest of the trove hunting for more.. Per the articles: nothing was "classified", it was an archive of public documents that the government published periodically. The issue is that a small subset weren't redacted properly - but there's no apparent reason the teen would have known that. It appears that someone simply archived a bunch of documents they reasonably believed to be public information.

by jopsen 9y ago

rayiner 9y ago

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable person would infer about the property owner's intent. The method of access, therefore, is relevant insofar as it tells you about what the owner of the web server intended people to have access to. The fact that content on a website meant for the public to access is only accessible by "programmatic" means that ordinary users would not know, is strong evidence that the owners of the web server did not intend for people to access those documents.

letlambda 9y ago
Isn't the assumption always that accessing a web page programmatically is allowed unless specifically asked not to in robots.txt?
shkkmo 9y ago
> The fact that content on a website meant for the public to access is only accessible by "programmatic" means that ordinary users would not know, is strong evidence that the owners of the web server did not intend for people to access those documents Sorry, that is complete BS. Have you scanned the entire internet and sure sure there are no links to these files on other public pages? Files publicly hosted by a web server (software explicitly designed and installed to make those files public) is in no shape or form private property. Furthermore, in this specific case, there is an explicit statement saying the files are public and saying nothing about them not being accessible: "The Access to Information website allows you to submit, pay and receive FOIPOP requests online. The Nova Scotia Government also posts responses to formal FOIPOP requests online on the Disclosure log. This is a free public repository of FOIPOP responses that have been approved for publication and have met a specific set of criteria (PDF file 800 KB)." https://novascotia.ca/is/programs-and-services/information-access-and-privacy.asp https://novascotia.ca/is/programs-and-services/information-a...
ShroudedNight 9y ago
What is significantly more programmatic about manually incrementing a document ID by 1, than viewing a website in the first place?
ljm 9y ago
I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You have to be accountable. The guy who found the problem or abused it is not accountable.
- harryh 9y ago
  The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.
  - ozzmotik 9y ago
    in this context i don't think your metaphor applies. your house isn't a freely accessible entity that has been declared as such which has certain areas of it that are off limits but never clearly defined as just that.
    - harryh 9y ago
      So what you are saying is that what matters is the intent of the property owner and the general understanding of the population about what is typically public vs private property?
      - ozzmotik 9y ago
        i would say that those things are certainly relevant, but it would be perhaps very myopic to say they are the only relevant concepts. one should also keep in mind the intent of the individual attempting to access the property, and the perception of what they're doing when they do within their mind as an expression of that intent, for instance. if i have been to led to believe that your property is public through a means that is debatably authoritative, such as a sign indicating it as such, then for all intents and purposes, anything i interact with inside of it in my mind is perfectly acceptable because it falls within the context of pre-established permissions. and if there are parts of your property that for some reason you would prefer private but they are not demarcated as such, am i really in the wrong to interact with them or go inside of them if i have no external information telling me that i should not? in the context of the article and the problem at hand, the teenager downloaded a bunch of things that were supposed to be public access, but also accidentally downloaded some things that were confidential though not clearly marked as such (im assuming based on available information) and so the only real way he would have known they were confidential was if he actually perused the contents of them. that would be like having a room that is private property and off-limits, and it is marked as such, but the marking is inside the room and can only be seen by entering it and as such violating the private nature of said room. but really these are all just my thoughts on it and i certainly don't think i'm right or anything. it's just fun to talk ya know
ScottBurson 9y ago
> Where the intent is not made express, we try to figure out what a reasonable person would infer about the property owner's intent. We do. But if we fail to do so correctly, as people occasionally will, have we committed a serious crime for which we should be facing prison? Particularly in a case where societal custom is not well formed, and analogies to more familiar situations are all strained? This young man, by his account, likes to archive stuff he finds on the Web. From the sound of it, he's done URL incrementation many times, and this is the first time he's gotten in trouble for it. Let's suppose for the sake of argument that that's true, and also that there really were no indications on this site that the information was unintentionally left accessible. Do you really want to send him to prison for that? You might reply that as cruel as that seems, its deterrent value would make it worth doing. But I don't even want to live in a world where people without criminal intent are so succesfully deterred from experimenting with the Internet. In such a world, site owners would take even less responsibility than they do now for securing their information, and therefore actual criminals would have even more unfettered access to it.

asfasgasg 9y ago

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Agreed. There is no inherent or intrinsic reason to expect that any given document or any given URL ought to be restricted. However, a look at the documents could have provided some extrinsic reason to stop looking. For example, if I find a filing cabinet full of classified documents, I will not continue leafing through them after I see the first one. I will stop immediately and notify someone appropriate (after contacting my lawyer). I do not intend to access classified documents. The question is one of intent. Did the individual intend to access documents that they knew or should have known that they ought not access. If the kid pulled down one classified document, took a look, realized what he was looking at, and deleted it and notified the authorities, then I'm with the crowd. Likewise if they pulled down the entire archive without looking at any of them. I'll be on the front lines with my pitchfork. On the other hand, if they saw the first classified document, then pulled down the rest of the trove hunting for more, some amount of punishment is probably warranted. Even then, I would say fifteen years is too much. Maybe a few months of time and probation, depending on exactly how much willfulness was on display. I imagine these are the kinds of questions that will be resolved during the trial.

deleted 9y ago
[deleted]
ozzmotik 9y ago
ah yes the age old problem of actus reus sans mens rea
deleted 9y ago
[deleted]
fenomas 9y ago
> if they saw the first classified document, then pulled down the rest of the trove hunting for more.. Per the articles: nothing was "classified", it was an archive of public documents that the government published periodically. The issue is that a small subset weren't redacted properly - but there's no apparent reason the teen would have known that. It appears that someone simply archived a bunch of documents they reasonably believed to be public information.