8 ms·

Clearly, if the websites didn’t want you to download their customer db, they’d not let you inject SQL queries!

tareqak 7y ago
Is modifying the data that the server sends to my local machine as part of the server’s expected operation, and then me not retransmitting that data a problem? That’s how a user uses any accessibility feature (dark mode, screen reader mode, magnification/zoom, etc).
- ryanlol 7y ago
  >Is modifying the data that the server sends to my local machine as part of the server’s expected operation, and then me not retransmitting that data a problem? Why not? It’s pretty clear that you’re knowingly doing this in order to exceed authorized access. Why is this different from exploiting a vulnerability? Accessibility features are not intended to defeat access controls.
  - tareqak 7y ago
    If that’s the case, then browsers allowing people to view and manipulate the source of a web page (both initial download and XHR requests) are aiding in that process. If the ask is to walk back decades of being able to do exactly this sort of local manipulation of received data, then this form of the Internet would be like cable or satellite television with permitted forms of interactivity. Why bring content to the Internet if there is desire to change the rules and norms of how the Internet works? Why not roll a separate version of the Internet with those desired rules? Yes, laws exist to protect copyright, prevent theft, and forbid illegal access, but those laws are insufficiently aware of how the Internet operates with respect to things like client-server communication. In fact, the design of the Internet predates many (if not all) of these laws, and the specifications of how the Internet works are a de facto law expressing how clients and servers interact with one another. Should lawmakers give requirements to the W3C to specify desired and undesired operations on the Internet? I genuinely ask these questions in good faith: they are simply follow-on thoughts of mine from taking your point as a premise. If my ideas seems extreme or exaggerated, then that’s simply where my mind goes first as opposed to necessarily being criticism.
LMYahooTFY 7y ago
That's an improper use of the term, so I think the analogy falls apart. You don't "inject" queries, you submit queries as normal. You're "injecting" what you know to be code that will execute, where no code is even designed to execute.
dusted 7y ago
Except, they're sending all the content to me, I show only a subset of it (that is, the content that they sent me, instead of the nag-box they intended to go on top of it). I actually thought of making a plugin to do this, but decided against it, since I'd rather just keep reading my free articles than making it so easy for everyone to do that they'd be forced to remove that feature, which is a likely consequence of this repository.
- ryanlol 7y ago
  You’re intentionally defeating (weak) access controls intended to keep you from reading the article without paying. Would it be okay for you to exploit a SQLi bug on the website to access the articles just because it’s easy?

Is modifying the data that the server sends to my local machine as part of the server’s expected operation, and then me not retransmitting that data a problem? That’s how a user uses any accessibility feature (dark mode, screen reader mode, magnification/zoom, etc).

ryanlol 7y ago
>Is modifying the data that the server sends to my local machine as part of the server’s expected operation, and then me not retransmitting that data a problem? Why not? It’s pretty clear that you’re knowingly doing this in order to exceed authorized access. Why is this different from exploiting a vulnerability? Accessibility features are not intended to defeat access controls.
- tareqak 7y ago
  If that’s the case, then browsers allowing people to view and manipulate the source of a web page (both initial download and XHR requests) are aiding in that process. If the ask is to walk back decades of being able to do exactly this sort of local manipulation of received data, then this form of the Internet would be like cable or satellite television with permitted forms of interactivity. Why bring content to the Internet if there is desire to change the rules and norms of how the Internet works? Why not roll a separate version of the Internet with those desired rules? Yes, laws exist to protect copyright, prevent theft, and forbid illegal access, but those laws are insufficiently aware of how the Internet operates with respect to things like client-server communication. In fact, the design of the Internet predates many (if not all) of these laws, and the specifications of how the Internet works are a de facto law expressing how clients and servers interact with one another. Should lawmakers give requirements to the W3C to specify desired and undesired operations on the Internet? I genuinely ask these questions in good faith: they are simply follow-on thoughts of mine from taking your point as a premise. If my ideas seems extreme or exaggerated, then that’s simply where my mind goes first as opposed to necessarily being criticism.

LMYahooTFY 7y ago

That's an improper use of the term, so I think the analogy falls apart. You don't "inject" queries, you submit queries as normal. You're "injecting" what you know to be code that will execute, where no code is even designed to execute.

dusted 7y ago

Except, they're sending all the content to me, I show only a subset of it (that is, the content that they sent me, instead of the nag-box they intended to go on top of it). I actually thought of making a plugin to do this, but decided against it, since I'd rather just keep reading my free articles than making it so easy for everyone to do that they'd be forced to remove that feature, which is a likely consequence of this repository.

ryanlol 7y ago
You’re intentionally defeating (weak) access controls intended to keep you from reading the article without paying. Would it be okay for you to exploit a SQLi bug on the website to access the articles just because it’s easy?