10 ms·

The headline has been editorialized. While I don't agree with what the authorities did here, and believe the developer was acting in good faith, the developer c

by ch_123 6y ago

The headline has been editorialized. While I don't agree with what the authorities did here, and believe the developer was acting in good faith, the developer created an app for buying railway tickets which charged a small fee for the tickets - the issue was that he was arrested for making money off ticket sales, as opposed to "automating forms on a website"

moh_maya 6y ago
Yep. He circumvented rate-limiters that ensured that you couldn't game the booking system. The regulations very clearly prohibit this to ensure fair access. Now, one can absolutely argue about whether this form of rate limiting is the right approach, but to circumvent something that is clearly prohibited & charge money to do that is illegal. This does not mean that I think the current system is perfect OR that there aren't other players who also have backdoors into the process; just that the action is not as egregious as 'BUREAUCRATS STIFILING INNOVATION'. There is more nuance needed here [1]. "According to the sources, the apps enabled users to book Tatkal tickets bypassing security checks on the IRCTC portal. His mobile applications were unauthorized and had features to bypasses Completely Automated Public Turing Test (CAPTCHA), a security measure that users must fill in while logging in to IRCTC. As per reports the apps also bypassed other security measures installed by the IRCTC." ... "However, railway officials clarified Yuvrajaa bypassed the railway system and made money illegally which is a crime. He wasn’t event an authorized agent registered with IRCTC to book tickets. RPF has registered a case under section 143 (2) of the Railways Act (penalty for unauthorised carrying on of the business of procuring and supplying of railway tickets). Developing an unauthorised software bypassing e-ticketing system is an offence. Such applications defeated the purpose of having a first-come-first-serve system and benefit only a few who use the software." This govt., like most Indian govts, has a stupidly archaic & top-down / low-trust / risk-averse / bean-counter approach to innovation and transparency (case in point, the Covid tracking app Arogya Setu's sordid development & transparency issues), but this specific incident isn't the right stick, IMO. :) [1] https://www.the420.in/conman-or-genius-arrest-of-iit-kharagpur-student-who-made-faster-rail-ticket-booking-app-than-irctc-sparks-debate/ https://www.the420.in/conman-or-genius-arrest-of-iit-kharagp...
- yitchelle 6y ago
  You see similar software used in Auction sites such as eBay and the likes. Are this type of software also banned in India?
  - moh_maya 6y ago
    AFAIK, for railways ticket bookings, yes; not banned but illegal. However, it's common knowledge that they exist and are used.
    - jaikant77 6y ago
      India has a strong legal framework and unfortunately very poor implementation (the arrest is an example of poor implementation/bullying by the state). When you say illegal, you should be able to specify the law under which it is illegal. Broadly classifying anything not convenient to the state as illegal does not stand ground, AFAIK there is no law which prohibits automation of forms on any website?
      - ch_123 6y ago
        You're attacking a strawman here. The issue was that he was making a profit by reselling tickets, not by automating filling forms in a website. The mechanism is not particularly relevant. By analogy, it is legal to park my car in my own garden, but not legal to park it in my neighbour's garden. If I were to do that, I might expect to be punished for "parking my car".
        jkoudys 6y ago
        You start by accusing him of using a strawman, then using an analogy which doesn't even remotely apply. It's closer to your neighbour selling you the rights to park in their garden, then you selling those rights to someone else. Far from a criminal, arrestable offence, so their point on the broad-brush of being "illegal" stands. Even my closer analogy is still pretty far off and it's much more innocent. Maybe closer to charging a fee to use a very tricky to figure out parking meter.
jaikant77 6y ago
Yes. thats because technically thats what he seems to have done. Since tatkal tickets are limited in number, by prefilling and automating the forms he effectively helps his clients jump the queue. This is a clear hack, but I find it irrational to arrest a person because the website is suboptimal and cannot prevent his hack from running. This similar to what Github did when they pulled down youtube-dl, bully your way to compliance.
- dmurray 6y ago
  Github wasn't bullying anyone in the youtube-dl saga. Their crime was that they didn't stand up for their user.
Karishma1234 6y ago
Some context here: Indian railways website is very slow and pathetic (so bad that there are lengthy discussion on HN about it. search for IRCTC). Given the shortage of tickets thousands of people try to book tickets at 7am when the window to book a certain class of tickets call `Tatkal` opens. Thousands of people are trying to book the exact same tickets from say 7am and by 7:10 am all tickets get sold out. Now, if you could prefill all the forms and just press submit you might be able to buy the tickets before others. Railways website specifically tries to not allow any kind of pre-filling. The app merely bypasses that restriction. (I have written scripts in past to do just that when I lived there). Railways is a classic colonial government system and operates pretty much as if India is still a British colony. They have their own police force called RPF which arrested the boy under Railways act 1989 for “unauthorised business of procuring and supplying railway tickets” which the boy did not do at all. Not to mention, the railways form has a captcha so it was not even a programmatic submission. There are railways mafias in India who buy tickets by bribing railways staff and I suspect these people are responsible for getting this boy jailed as his solution helped more genuine passengers to book their tickets by undercutting the "agents". It remains to be seen how the courts apply the standard here but it will probably take around 10-15 years for the courts to come to a verdict. Personal Rant: When I was in India, I had the misfortune of relying on Indian railways to travel home from college. I was so pissed that I was determined to get out of India so I have to never deal with Indian railways. I had tried all possible ways to hack the booking system and had my own chrome extensions to fill up the forms.
- afiori 6y ago
  If the timeframe is so tight it would be way more stable to just register all booking attempts (let's say up to 7:15) and then distribute the ticket randomly between unique users for some definition of uniwue user
sbmthakur 6y ago
This is still better. Certain publications described this as an attempt to stifle innovation. https://theprint.in/opinion/india-wants-innovation-but-arrests-iit-grad-who-develops-faster-tatkal-ticket-booking-app/535095/ https://theprint.in/opinion/india-wants-innovation-but-arres...
Beggers1960 6y ago
One the rare situations where this type of issue should be - in part - rewarded to some degree.
- realshadow 6y ago
  And people who follow the rules should be punished. facepalm

by ch_123 6y ago

moh_maya 6y ago

Yep. He circumvented rate-limiters that ensured that you couldn't game the booking system. The regulations very clearly prohibit this to ensure fair access. Now, one can absolutely argue about whether this form of rate limiting is the right approach, but to circumvent something that is clearly prohibited & charge money to do that is illegal. This does not mean that I think the current system is perfect OR that there aren't other players who also have backdoors into the process; just that the action is not as egregious as 'BUREAUCRATS STIFILING INNOVATION'. There is more nuance needed here [1]. "According to the sources, the apps enabled users to book Tatkal tickets bypassing security checks on the IRCTC portal. His mobile applications were unauthorized and had features to bypasses Completely Automated Public Turing Test (CAPTCHA), a security measure that users must fill in while logging in to IRCTC. As per reports the apps also bypassed other security measures installed by the IRCTC." ... "However, railway officials clarified Yuvrajaa bypassed the railway system and made money illegally which is a crime. He wasn’t event an authorized agent registered with IRCTC to book tickets. RPF has registered a case under section 143 (2) of the Railways Act (penalty for unauthorised carrying on of the business of procuring and supplying of railway tickets). Developing an unauthorised software bypassing e-ticketing system is an offence. Such applications defeated the purpose of having a first-come-first-serve system and benefit only a few who use the software." This govt., like most Indian govts, has a stupidly archaic & top-down / low-trust / risk-averse / bean-counter approach to innovation and transparency (case in point, the Covid tracking app Arogya Setu's sordid development & transparency issues), but this specific incident isn't the right stick, IMO. :) [1] https://www.the420.in/conman-or-genius-arrest-of-iit-kharagpur-student-who-made-faster-rail-ticket-booking-app-than-irctc-sparks-debate/ https://www.the420.in/conman-or-genius-arrest-of-iit-kharagp...

yitchelle 6y ago
You see similar software used in Auction sites such as eBay and the likes. Are this type of software also banned in India?
- moh_maya 6y ago
  AFAIK, for railways ticket bookings, yes; not banned but illegal. However, it's common knowledge that they exist and are used.
  - jaikant77 6y ago
    India has a strong legal framework and unfortunately very poor implementation (the arrest is an example of poor implementation/bullying by the state). When you say illegal, you should be able to specify the law under which it is illegal. Broadly classifying anything not convenient to the state as illegal does not stand ground, AFAIK there is no law which prohibits automation of forms on any website?
    - ch_123 6y ago
      You're attacking a strawman here. The issue was that he was making a profit by reselling tickets, not by automating filling forms in a website. The mechanism is not particularly relevant. By analogy, it is legal to park my car in my own garden, but not legal to park it in my neighbour's garden. If I were to do that, I might expect to be punished for "parking my car".
      - jkoudys 6y ago
        You start by accusing him of using a strawman, then using an analogy which doesn't even remotely apply. It's closer to your neighbour selling you the rights to park in their garden, then you selling those rights to someone else. Far from a criminal, arrestable offence, so their point on the broad-brush of being "illegal" stands. Even my closer analogy is still pretty far off and it's much more innocent. Maybe closer to charging a fee to use a very tricky to figure out parking meter.

jaikant77 6y ago

Yes. thats because technically thats what he seems to have done. Since tatkal tickets are limited in number, by prefilling and automating the forms he effectively helps his clients jump the queue. This is a clear hack, but I find it irrational to arrest a person because the website is suboptimal and cannot prevent his hack from running. This similar to what Github did when they pulled down youtube-dl, bully your way to compliance.

dmurray 6y ago
Github wasn't bullying anyone in the youtube-dl saga. Their crime was that they didn't stand up for their user.

Karishma1234 6y ago

Some context here: Indian railways website is very slow and pathetic (so bad that there are lengthy discussion on HN about it. search for IRCTC). Given the shortage of tickets thousands of people try to book tickets at 7am when the window to book a certain class of tickets call `Tatkal` opens. Thousands of people are trying to book the exact same tickets from say 7am and by 7:10 am all tickets get sold out. Now, if you could prefill all the forms and just press submit you might be able to buy the tickets before others. Railways website specifically tries to not allow any kind of pre-filling. The app merely bypasses that restriction. (I have written scripts in past to do just that when I lived there). Railways is a classic colonial government system and operates pretty much as if India is still a British colony. They have their own police force called RPF which arrested the boy under Railways act 1989 for “unauthorised business of procuring and supplying railway tickets” which the boy did not do at all. Not to mention, the railways form has a captcha so it was not even a programmatic submission. There are railways mafias in India who buy tickets by bribing railways staff and I suspect these people are responsible for getting this boy jailed as his solution helped more genuine passengers to book their tickets by undercutting the "agents". It remains to be seen how the courts apply the standard here but it will probably take around 10-15 years for the courts to come to a verdict. Personal Rant: When I was in India, I had the misfortune of relying on Indian railways to travel home from college. I was so pissed that I was determined to get out of India so I have to never deal with Indian railways. I had tried all possible ways to hack the booking system and had my own chrome extensions to fill up the forms.

afiori 6y ago
If the timeframe is so tight it would be way more stable to just register all booking attempts (let's say up to 7:15) and then distribute the ticket randomly between unique users for some definition of uniwue user

sbmthakur 6y ago

This is still better. Certain publications described this as an attempt to stifle innovation. https://theprint.in/opinion/india-wants-innovation-but-arrests-iit-grad-who-develops-faster-tatkal-ticket-booking-app/535095/ https://theprint.in/opinion/india-wants-innovation-but-arres...

Beggers1960 6y ago

One the rare situations where this type of issue should be - in part - rewarded to some degree.

realshadow 6y ago
And people who follow the rules should be punished. facepalm