7 ms·

Ahh so if a company leaks data it's the viewer's fault, not the companies?

rayiner 7y ago
Yes. That's the general rule--negligence of a victim does not negate the culpability of the criminal. "It was easy to commit the crime" is not a defense. If you find yourself with access to something you think you're not supposed to have access to, you're supposed to do the right thing.
- deleted 7y ago
  [deleted]
- manfredo 7y ago
  I think the issue is not "negligence of the victim" so much as, "took no steps to make the information private". If I don't lock my door and someone goes into my house, opens my filing cabinet, and copies my financial info then they're still a criminal. They took information from a place that was unambiguously meant to be private. But if I staple a copy of my financial info to a telephone pole, surely those who read it are not committing the crime of reading private information. A URL that is not authenticated seems more like the latter than the former. The web is public unless people take steps to make it private. Criminalizing accessing unprotected URLs is like arresting people for reading the financial info I left stapled to the telephone pole. A while back there was a "world's most exclusive chat room" website that hosted IRC channels for people above twitter follower numbers. People learned that they could just manually increment a URL parameter to access higher room numbers regardless of their twitter follower count. Were those people committing a crime?
  - tptacek 7y ago
    To take the case at issue, when your immediate reaction to discovering an unprotected URL is to scrape it, discuss on an IRC channel how you're going to monetize it, and then go to the media to announce your security vulnerability discovery, you are going to find it difficult to make the argument that you believed you had authorized access.
    - manfredo 7y ago
      By that same line of reasoning, one could argue that changing your url parameter in that twitter chatroom website is a privilege escalation attack that allows users to access protected information. Absence of authentication means all access is authorized, otherwise just typing in random urls is a crime.
      - tptacek 7y ago
        You can indeed argue that. Typing random URLs can indeed be a crime.
      - txcwpalpha 7y ago
        The case referenced by the top-level comment of this chain (the one about 'weev') is a case where someone was prosecuted and imprisoned specifically because changing URL parameters was seen as an attack allowing access to protected information.
alistairSH 7y ago
Nobody leaked any data here. These were public profiles that were "controlled" by a robots.txt file. The judge appears to question whether robots.txt is sufficient to prevent scraping, or if a proper authorization step would be required. The best real-world analogy I can come up with... I post a No Trespassing sign on my garden, but don't fence/gate the property. Is it ok to access the property and take my tomatoes? After all, the sign is just a suggestion... had I really wanted to prevent access, I'd install a fence.
- sgc 7y ago
  It's more like a store putting up a no shoes no shirt no service sign and then trying to sue for trespass when a beachgoer comes in to shop anyway. LinkedIn is a business with publicly accessible assets they want to be frequented, but they want to control how you do that. However they are finding the laws regulating the rights people have in respect to frequenting places open to the public apply.
  - JamesBarney 7y ago
    I think this is the best analogy I've seen on this thread.
  - merb 7y ago
    jep. it's more like having a public store and only letting some people into it. like only males, no womans. because they clearly allowed the google bot.
    - mullingitover 7y ago
      More like only letting humans into it, and only one type of robot, the googlebot. Then this company is ignoring the posted rules and sending armies of robots into the store to photograph every square inch of the business.
      - TeMPOraL 7y ago
        Well I'm sorry, but if I opt to wrap a cURL call in a bash for loop, I'm still a human that tries to access the same resources, only with a different user agent. There is legitimate individual interest in both scraping and non-browser HTTP sessions.

Yes. That's the general rule--negligence of a victim does not negate the culpability of the criminal. "It was easy to commit the crime" is not a defense. If you find yourself with access to something you think you're not supposed to have access to, you're supposed to do the right thing.

deleted 7y ago
[deleted]
manfredo 7y ago
I think the issue is not "negligence of the victim" so much as, "took no steps to make the information private". If I don't lock my door and someone goes into my house, opens my filing cabinet, and copies my financial info then they're still a criminal. They took information from a place that was unambiguously meant to be private. But if I staple a copy of my financial info to a telephone pole, surely those who read it are not committing the crime of reading private information. A URL that is not authenticated seems more like the latter than the former. The web is public unless people take steps to make it private. Criminalizing accessing unprotected URLs is like arresting people for reading the financial info I left stapled to the telephone pole. A while back there was a "world's most exclusive chat room" website that hosted IRC channels for people above twitter follower numbers. People learned that they could just manually increment a URL parameter to access higher room numbers regardless of their twitter follower count. Were those people committing a crime?
- tptacek 7y ago
  To take the case at issue, when your immediate reaction to discovering an unprotected URL is to scrape it, discuss on an IRC channel how you're going to monetize it, and then go to the media to announce your security vulnerability discovery, you are going to find it difficult to make the argument that you believed you had authorized access.
  - manfredo 7y ago
    By that same line of reasoning, one could argue that changing your url parameter in that twitter chatroom website is a privilege escalation attack that allows users to access protected information. Absence of authentication means all access is authorized, otherwise just typing in random urls is a crime.
    - tptacek 7y ago
      You can indeed argue that. Typing random URLs can indeed be a crime.
    - txcwpalpha 7y ago
      The case referenced by the top-level comment of this chain (the one about 'weev') is a case where someone was prosecuted and imprisoned specifically because changing URL parameters was seen as an attack allowing access to protected information.

alistairSH 7y ago

Nobody leaked any data here. These were public profiles that were "controlled" by a robots.txt file. The judge appears to question whether robots.txt is sufficient to prevent scraping, or if a proper authorization step would be required. The best real-world analogy I can come up with... I post a No Trespassing sign on my garden, but don't fence/gate the property. Is it ok to access the property and take my tomatoes? After all, the sign is just a suggestion... had I really wanted to prevent access, I'd install a fence.

sgc 7y ago
It's more like a store putting up a no shoes no shirt no service sign and then trying to sue for trespass when a beachgoer comes in to shop anyway. LinkedIn is a business with publicly accessible assets they want to be frequented, but they want to control how you do that. However they are finding the laws regulating the rights people have in respect to frequenting places open to the public apply.
- JamesBarney 7y ago
  I think this is the best analogy I've seen on this thread.
- merb 7y ago
  jep. it's more like having a public store and only letting some people into it. like only males, no womans. because they clearly allowed the google bot.
  - mullingitover 7y ago
    More like only letting humans into it, and only one type of robot, the googlebot. Then this company is ignoring the posted rules and sending armies of robots into the store to photograph every square inch of the business.
    - TeMPOraL 7y ago
      Well I'm sorry, but if I opt to wrap a cURL call in a bash for loop, I'm still a human that tries to access the same resources, only with a different user agent. There is legitimate individual interest in both scraping and non-browser HTTP sessions.