5 ms·

I wholeheartedly disagree, despite the down votes in this community. The act of attempting to open it is what is illegal, in both situations. You have a person

I wholeheartedly disagree, despite the down votes in this community. The act of attempting to open it is what is illegal, in both situations. You have a person cruising for keys to a house and a person cruising for keys to databases. They own neither.

nkrisc 8y ago
But if a database is unsecured, how do you know it's not meant to be publicly accessible?
- cabaalis 8y ago
  Your point is good of course, but I think the question has already been answered in society. If you aren't explicitly allowed into someone else's property, you aren't allowed.
  - c22 8y ago
    It's not analogous because in internet protocols the server has to actively send the "property" in response to a specific request to access it. If a request is made and a response freely given with no further authentication required then it is a stretch to compare this to coming onto someone's property without invitation. Perhaps if one is accessing unauthenticated services on a private network this analogy would sort of work, but the assumption is that if you run a service that responds to random requests on the public internet you intended the responses to be public. It is more like an owner hiring someone to stand on their property and invite people in then complaining that they gave their employee poor directions and faulting the public for trespass.
  - beatgammit 8y ago
    I'm allowed to look at property from the street. There's nothing stopping me from walking around the neighborhood looking into everyone's property. I can even walk up to the house in most cases, and peering into windows is usually legal as well. I would even argue that trying the doors is also legal, though entering is probably illegal in most areas. Accessing a URL is like walking around the neighborhood looking from the street. Trying different URLs is like peering into windows. Trying the door is like testing default credentials. To make something a crime, you need to prove some kind of loss as well as intent. If there's no intent, it's likely a civil case to get restitution (e.g. you won't arrested for breaking something in a store accidentally). Likewise, you could get arrested for intent without loss (e.g. tried to break something in a store, but failed). IMO, it should only be illegal if there's intent to harm. Likewise, if you accidentally harm something without intent (e.g. accidentally DOS a server), you should be expected to make restitution. Both need to be proven in a court of law, criminal if there's intent, civil if there isn't, and if there's no harm or intent, there's no crime.
  - nkrisc 8y ago
    I wouldn't try to use physical property as an analogy. You can't even see what properties there are until you enter them. If the door wasn't locked you won't know until you're already inside. Here's an analogy I think is closer: I ask you for all your personal documents and bank account numbers. You promptly give them to me with no questions asked. Was I accessing private property improperly? If you refused and demanded I identify myself as someone authorized to have access, and then I forcibly took them from you anyway, that would be criminal. Web addresses aren't property, I think that's the wrong analogy. The web is made of requests and responses, and you don't know what response you'll get until you make the request.

nkrisc 8y ago

But if a database is unsecured, how do you know it's not meant to be publicly accessible?

cabaalis 8y ago
Your point is good of course, but I think the question has already been answered in society. If you aren't explicitly allowed into someone else's property, you aren't allowed.
- c22 8y ago
  It's not analogous because in internet protocols the server has to actively send the "property" in response to a specific request to access it. If a request is made and a response freely given with no further authentication required then it is a stretch to compare this to coming onto someone's property without invitation. Perhaps if one is accessing unauthenticated services on a private network this analogy would sort of work, but the assumption is that if you run a service that responds to random requests on the public internet you intended the responses to be public. It is more like an owner hiring someone to stand on their property and invite people in then complaining that they gave their employee poor directions and faulting the public for trespass.
- beatgammit 8y ago
  I'm allowed to look at property from the street. There's nothing stopping me from walking around the neighborhood looking into everyone's property. I can even walk up to the house in most cases, and peering into windows is usually legal as well. I would even argue that trying the doors is also legal, though entering is probably illegal in most areas. Accessing a URL is like walking around the neighborhood looking from the street. Trying different URLs is like peering into windows. Trying the door is like testing default credentials. To make something a crime, you need to prove some kind of loss as well as intent. If there's no intent, it's likely a civil case to get restitution (e.g. you won't arrested for breaking something in a store accidentally). Likewise, you could get arrested for intent without loss (e.g. tried to break something in a store, but failed). IMO, it should only be illegal if there's intent to harm. Likewise, if you accidentally harm something without intent (e.g. accidentally DOS a server), you should be expected to make restitution. Both need to be proven in a court of law, criminal if there's intent, civil if there isn't, and if there's no harm or intent, there's no crime.
- nkrisc 8y ago
  I wouldn't try to use physical property as an analogy. You can't even see what properties there are until you enter them. If the door wasn't locked you won't know until you're already inside. Here's an analogy I think is closer: I ask you for all your personal documents and bank account numbers. You promptly give them to me with no questions asked. Was I accessing private property improperly? If you refused and demanded I identify myself as someone authorized to have access, and then I forcibly took them from you anyway, that would be criminal. Web addresses aren't property, I think that's the wrong analogy. The web is made of requests and responses, and you don't know what response you'll get until you make the request.