5 ms·

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type w

by gitgud 9y ago

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?

rayiner 9y ago
"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.
- prophesi 9y ago
  There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
  - rayiner 9y ago
    The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
    - munk-a 9y ago
      You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.
    - prophesi 9y ago
      I would agree if it took an actual exploit to obtain the information.
    - PretzelPirate 9y ago
      When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
      - gitgud 9y ago
        Totally agree with this. If the web resource is available to anyone, then how could you be mad that some one saw it.
      - tantanel 9y ago
        Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle. I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access the data once they understood it (e.g. did they close the door and leave)?
        rootlocus 9y ago
        Web servers are not houses. They are implicitly public, whereas houses are implicitly private.
        gnode 9y ago
        That analogy would be more accurate if you also operated a cafe out of your living room, with a big "open" sign on the front door, and someone accidentally used your personal bathroom because you failed to stick a "private" sign on it. In that case, it would be unreasonable to sue someone for trespass.
    - jmvoodoo 9y ago
      This isn't even the case though. The site specifically says that the documents, all of them, are public. They just happened to have noticed they screwed up and published some they shouldn't have, and are now going after someone who downloaded the entire set. This was not prohibited in any way that was documented on the site,and the language that was on the site made it sound like it was allowed. Since the theme is analogies how about this one: someone puts a box labeled "free stuff" in front of their house. You dig through it and find something of value. You take it and go home. A few days later your house is raided because the owner of the house put in something valuable by mistake and is now claiming they never intended for anyone to take anything that wasn't visible from the street. Since you dug through the box, they are charging you with theft.
  - deleted 9y ago
    [deleted]
- shkkmo 9y ago
  > Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters. It implies the exact opposite. The owner may have intended it to be private, but making it publicly available, without security checks on a publicly accessible server, implies the property owner intended for people to access that property.
- kps 9y ago
  Sequential numbers are not obscure. They're commonly used for pagination and collections, to the point where popular browsers have extensions to simplify navigating them. https://addons.mozilla.org/en-US/firefox/addon/nextprev-page/?src=search https://addons.mozilla.org/en-US/firefox/addon/nextprev-page... https://chrome.google.com/webstore/detail/urlnext/emepkgfiamgdjilgkacpciojagbolepb https://chrome.google.com/webstore/detail/urlnext/emepkgfiam...
- rootlocus 9y ago
  Since when is "intention" legally enforceable?

by gitgud 9y ago

rayiner 9y ago

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

prophesi 9y ago
There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
- rayiner 9y ago
  The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
  - munk-a 9y ago
    You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.
  - prophesi 9y ago
    I would agree if it took an actual exploit to obtain the information.
  - PretzelPirate 9y ago
    When accessing a document on the web, you ask the server if you can have it. The server then says "yes" or "no" based on a set of rules. In this case, he asked and the server said "yes". This is like going to a library, asking the librarian if you can check out a book, being told yes, and then later being arrested because they meant to say "no".
    - gitgud 9y ago
      Totally agree with this. If the web resource is available to anyone, then how could you be mad that some one saw it.
    - tantanel 9y ago
      Couldn’t the same analogy be used if I left my front door unlocked? The door would happily say: “yes, you may enter” to anyone trying the handle. I think the real question here is: did the website provide enough information for the user to have been assumed to understand that what they were accessing wasn’t meant to be public (e.g. did the door look like a door to a private property)? And did the user cease to access the data once they understood it (e.g. did they close the door and leave)?
      - rootlocus 9y ago
        Web servers are not houses. They are implicitly public, whereas houses are implicitly private.
      - gnode 9y ago
        That analogy would be more accurate if you also operated a cafe out of your living room, with a big "open" sign on the front door, and someone accidentally used your personal bathroom because you failed to stick a "private" sign on it. In that case, it would be unreasonable to sue someone for trespass.
  - jmvoodoo 9y ago
    This isn't even the case though. The site specifically says that the documents, all of them, are public. They just happened to have noticed they screwed up and published some they shouldn't have, and are now going after someone who downloaded the entire set. This was not prohibited in any way that was documented on the site,and the language that was on the site made it sound like it was allowed. Since the theme is analogies how about this one: someone puts a box labeled "free stuff" in front of their house. You dig through it and find something of value. You take it and go home. A few days later your house is raided because the owner of the house put in something valuable by mistake and is now claiming they never intended for anyone to take anything that wasn't visible from the street. Since you dug through the box, they are charging you with theft.
- deleted 9y ago
  [deleted]
shkkmo 9y ago
> Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters. It implies the exact opposite. The owner may have intended it to be private, but making it publicly available, without security checks on a publicly accessible server, implies the property owner intended for people to access that property.
kps 9y ago
Sequential numbers are not obscure. They're commonly used for pagination and collections, to the point where popular browsers have extensions to simplify navigating them. https://addons.mozilla.org/en-US/firefox/addon/nextprev-page/?src=search https://addons.mozilla.org/en-US/firefox/addon/nextprev-page... https://chrome.google.com/webstore/detail/urlnext/emepkgfiamgdjilgkacpciojagbolepb https://chrome.google.com/webstore/detail/urlnext/emepkgfiam...
rootlocus 9y ago
Since when is "intention" legally enforceable?