3 ms·
You’ve never heard of an API then? This is silly. Your door analogies have no place at all. A great many websites work this way. Unless you’re injecting meta
by lawnchair_larry 9y ago
You’ve never heard of an API then?
This is silly. Your door analogies have no place at all.
A great many websites work this way.
Unless you’re injecting metacharacters into URLs, or requesting AAAAAAAA * 65535 followed by shellcode, changing paramter values is using HTTP exactly as designed, and a well-formed request has many possible error codes for the exact purpose of letting you know what you are allowed to access.
It’s perfectly normal for people to alter URLs. The fact that people who are unfamiliar with URLs don’t do that is irrelevant, and you could say the same for any subject. Just yesterday I changed lat= and lon= to get a NOAA forecast. Is that snooping or hacking? How about when we change the integer at the end of an XKCD comic to view another one without previously confirming there is a hyperlink somewhere?
At least in the Weev case, people could take his IRC logs out of context as well as argue the fact that it was plainly obvious that the server was misconfigured and he was seeing content that he should not. But getting a response when incrementing an integer, generally speaking, does not mean you are viewing something unintended for you. When you are downloading public documents, it would be entirely unreasonable to assume that the material was non-public.
Also, take a step back to really think about what you are advocating. Is society better off by ruining this kid’s life? It blows my mind that someone even remotely technical can think this particular case is a good use of the justice system, or can even compare it to someone snooping around their neighborhood and trying their doors.
- walrus01 9y agoSupporting your examples, in previous GIS work I have iterated through a series of public URLs with file ID integers in them (Corresponding with individual document IDs) to batch-mirror whole public GIS datasets from government websites. This was on a public server, no http authentication or username/password, just something that was presented with a terrible javascript user interface only designed to retrieve one file at a time, slowly. Exactly the sort of thing that got this guy arrested.
- aceofspades19 9y agoI agree, even if we assume what he did is illegal, its sort of like impounding someone's car and arresting them for dangerous driving because they went 1 mph over the speed limit. We don't do that even though it is technically illegal because that would not be a good use of the legal resources we have, which are finite. Same thing if we arrested and imprisoned everyone who fiddled with url parameter, it would be a waste of finite resources. Probably a phone call saying 'Hey can you please stop doing that would suffice in most cases.