5 ms·

People have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL: https://en.wikipedia.org/w

People have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL: https://en.wikipedia.org/wiki/Weev https://en.wikipedia.org/wiki/Weev

ceejayoz 6y ago
We tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right? > the conviction was vacated by a higher court > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.
- deleted 6y ago
  [deleted]
Eupolemos 6y ago
I don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.
- rob74 6y ago
  ...and you are 100% sure that if this got before a court, the decision would go your way?
  - Eupolemos 6y ago
    No, I am not a lawyer. I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale___Straffelovens___263__stk._1.pdf https://projekter.aau.dk/projekter/files/305754822/Speciale_... But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacking-ikke-hacking-1076182 https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...
- ViViDboarder 6y ago
  I’m assuming, but the USA then. What country is that?
  - Eupolemos 6y ago
    Denmark. It is considered on par with an email sent to a wrong recipient. There might be an exception though, but it is untried in the courts, AFAIK.
rob74 6y ago
...and publishing the personal data they got their hands on this way ("In revealing the flaw to the media, the group also exposed personal data from over 100,000 people")
RIMR 6y ago
It was a bit more than that. The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider. Dumping the contents of a far-right website that helped push for Insurrection against the US Government seems pretty tame by comparison. Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great.
- bgentry 6y ago
  >The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider. You think there's "zero public interest" in knowing that a large US corporation, with private information about a significant fraction of the American public, has neglected their obligations to protect that private information? And that they've ignored all pleas to treat the vulnerability with the seriousness it deserves? >Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great. How are his political leanings relevant to the question of whether accessing this data would constitute a crime?

ceejayoz 6y ago

We tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right? > the conviction was vacated by a higher court > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.

deleted 6y ago
[deleted]

Eupolemos 6y ago

I don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.

rob74 6y ago
...and you are 100% sure that if this got before a court, the decision would go your way?
- Eupolemos 6y ago
  No, I am not a lawyer. I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale___Straffelovens___263__stk._1.pdf https://projekter.aau.dk/projekter/files/305754822/Speciale_... But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacking-ikke-hacking-1076182 https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...
ViViDboarder 6y ago
I’m assuming, but the USA then. What country is that?
- Eupolemos 6y ago
  Denmark. It is considered on par with an email sent to a wrong recipient. There might be an exception though, but it is untried in the courts, AFAIK.

rob74 6y ago

...and publishing the personal data they got their hands on this way ("In revealing the flaw to the media, the group also exposed personal data from over 100,000 people")

RIMR 6y ago

It was a bit more than that. The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider. Dumping the contents of a far-right website that helped push for Insurrection against the US Government seems pretty tame by comparison. Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great.

bgentry 6y ago
>The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider. You think there's "zero public interest" in knowing that a large US corporation, with private information about a significant fraction of the American public, has neglected their obligations to protect that private information? And that they've ignored all pleas to treat the vulnerability with the seriousness it deserves? >Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great. How are his political leanings relevant to the question of whether accessing this data would constitute a crime?