I think the reasoning that it is generally not legal (including in the US) is that it’s a slippery slope into the ambiguities of hacking. e.g. “I found a public

I think the reasoning that it is generally not legal (including in the US) is that it’s a slippery slope into the ambiguities of hacking. e.g. “I found a public link that listed a bunch of addresses marked “private.foo.com”” I then pinged those addresses and they were also publicly available. I then scanned for documents and other links. I found more links publicly available named “classified-do-not-open.pdf” - I downloaded them all and distributed them to others. Or for example when Dropbox disclosed a brief moment when you could sign into anyone else’s account. What if all their links had just broken and had auth removed at that time? If you were to exploit that, are you hacking - or was it the fault of Dropbox? Are you wrong for taking publicly available files? They were publicly available when you downloaded them - but you knew you shouldn’t have. How do you draw the line?