6 ms·

This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files ju

by sbarre 5y ago

This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate the URL to my heart's content, it is 100% the server's job to restrict my access and make sure that I cannot access resources I shouldn't. This is entirely the fault of the operators, not the user, and they were mad at them because they _allowed_ the user to access things they should not.

throwaway09223 5y ago
It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user simply looked at what was sent to them.
- soylentnewsorg 5y ago
  > instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information. so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.
  - throwaway09223 5y ago
    > and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. There's no such crime. If you disagree, by all means cite a statute. > you should look up how http works. I'm intimately familiar with http. Upon issuing a request for your records (the request, GET or otherwise), you receive a response, pushed to you, with records you did not request. I think you may want to re-read my comment, this time more carefully and thoughtfully.
    - soylentnewsorg 5y ago
      "push" means the data is pushed. as in without a request from you. it's mind boggling how you are not getting this. exchange is an example of this - you get email pushed to a listener on your mail client, without requesting that data. if you use pop3 however, you request the data and receive a response. you are arguing a request - a GET - the literal opposite of a push, is a push. this is something anyone who has used email would know, so you are being purposely dense, and this conversation is done - I will not read your reply. as far as the crime, it's called unauthorized access to a computer system, and many people are in jail for it. whether that system is password protected or not makes absolutely zero legal difference.
      - throwaway09223 5y ago
        We don't have to continue the discussion but I'll wrap this up regardless for the peanut gallery. As I've mentioned, my metaphor is request, response. This additional data is included, unsolicited, piggybacking on the response. I think this is clear. Regarding the crime, no, this is completely incorrect. It sounds like you're referencing 18 USC § 1030. This law cannot apply whatsoever to this situation because there is no unauthorized access. The data was pushed, unsolicited, as part of an authorized access. It's being sent to all users when they use the system in a normal authorized fashion. Viewing the data takes place on the user's own device, because the state itself put the information there. We are all authorized to access our own devices as much as we please. The suggestion that the CFAA might apply here is nothing short of absurd.
Ajedi32 5y ago
> seeing a bunch of other patient files just left on the desk in eyesight ...and then proceeding to rifle through a bunch of those files to satisfy your curiosity. Finding a vulnerability and reporting it -> Good Continuing to exploit the vulnerability after you've found it just to satisfy your curiosity -> Bad
soylentnewsorg 5y ago
> Changing a URL is not "malicious use" the law disagrees as far as your doctor's office strawman - it's a strawman. To see those files, you don't have to actively do anything, if they are left at the desk. Now, if you pick up one of those closed folders, open it, then start looking through it - you have an equivalent comparison. You also have an arrest record. But don't argue with me. What he did is literally illegal.

by sbarre 5y ago

throwaway09223 5y ago

It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user simply looked at what was sent to them.

soylentnewsorg 5y ago
> instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information. so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.
- throwaway09223 5y ago
  > and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. There's no such crime. If you disagree, by all means cite a statute. > you should look up how http works. I'm intimately familiar with http. Upon issuing a request for your records (the request, GET or otherwise), you receive a response, pushed to you, with records you did not request. I think you may want to re-read my comment, this time more carefully and thoughtfully.
  - soylentnewsorg 5y ago
    "push" means the data is pushed. as in without a request from you. it's mind boggling how you are not getting this. exchange is an example of this - you get email pushed to a listener on your mail client, without requesting that data. if you use pop3 however, you request the data and receive a response. you are arguing a request - a GET - the literal opposite of a push, is a push. this is something anyone who has used email would know, so you are being purposely dense, and this conversation is done - I will not read your reply. as far as the crime, it's called unauthorized access to a computer system, and many people are in jail for it. whether that system is password protected or not makes absolutely zero legal difference.
    - throwaway09223 5y ago
      We don't have to continue the discussion but I'll wrap this up regardless for the peanut gallery. As I've mentioned, my metaphor is request, response. This additional data is included, unsolicited, piggybacking on the response. I think this is clear. Regarding the crime, no, this is completely incorrect. It sounds like you're referencing 18 USC § 1030. This law cannot apply whatsoever to this situation because there is no unauthorized access. The data was pushed, unsolicited, as part of an authorized access. It's being sent to all users when they use the system in a normal authorized fashion. Viewing the data takes place on the user's own device, because the state itself put the information there. We are all authorized to access our own devices as much as we please. The suggestion that the CFAA might apply here is nothing short of absurd.

Ajedi32 5y ago

> seeing a bunch of other patient files just left on the desk in eyesight ...and then proceeding to rifle through a bunch of those files to satisfy your curiosity. Finding a vulnerability and reporting it -> Good Continuing to exploit the vulnerability after you've found it just to satisfy your curiosity -> Bad

soylentnewsorg 5y ago

> Changing a URL is not "malicious use" the law disagrees as far as your doctor's office strawman - it's a strawman. To see those files, you don't have to actively do anything, if they are left at the desk. Now, if you pick up one of those closed folders, open it, then start looking through it - you have an equivalent comparison. You also have an arrest record. But don't argue with me. What he did is literally illegal.