4 ms·

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you c

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a computer and understand the implications…

ravenstine 5y ago
I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech, but if you asked them if webpages are encrypted they would have no idea and would probably assume they are not. We are headed for a more authoritarian future if those making law or making judgments only see privacy tech as fringe and criminal, or have little meaningful underatandiing of it.
- baktubi 5y ago
  Hmm. You could also argue that not having understanding of the technology is a good thing. For instance, the judge can remove themselves from the details and look at it on a higher level. It’s the job of the attorneys to make the case for or against using subject matter experts etc.
  - wizzwizz4 5y ago
    You could argue that. However, it means that people can basically lie to the judges, and the judges don't have the background to call them out on it.
    - baktubi 5y ago
      Pretty sure they lie to the judges anyway.
- willis936 5y ago
  The alternative to encryption really is totaltarian control of the internet. In order to have any level of confidence that the data is not tampered with you need strict security on every meter of cabling, every line of code, every transceiver, and every person involved with the design and fabrication of those things.
- edejong 5y ago
  It would start with us software engineers to be more exact in our communications. For an engineering discipline, we’re terrible at it. Take your example. I don’t know whether a web page is encrypted. I do however know whether the transmission of one request of some website contents to a specific web browser is. But that won’t yet tell me whether the communication between me and the website has stayed confidential between the intended parties (which is probably what you’re interested in).
  - ravenstine 5y ago
    Whether data through an encrypted channel remains confidential isn't really relevant to my point. I didn't say "confidential", I said "encrypted". The distinction you are making with encryption and confidentiality seems conflated; if the channel is uses encryption, then the data is by virtue encrypted. It's another story if we are talking about data arriving from any channel with another layer of encryption for confidentiality.
    - Dylan16807 5y ago
      It's basically meaningless to talk about whether something is encrypted without the "from who" factor. Otherwise you might as well rot-13 it. If you want to use such a narrow definition of 'encrypted', then it doesn't matter if the lawyer knows the answer.
      - ravenstine 5y ago
        No, the answer is way simpler than you are making it out to be. Is the data in a TLS connection transformed in such a way that it would make it difficult for an intermediary to figure out the plain information being sent? If so, the data is in fact encrypted. Where are you getting this idea that encryption is more than that? That is by definition what encryption is, and everything else is just approaches and security layers on top of it. You don't have to like the encryption method, you don't have to care who it's from, you don't have to care about anything else. Encryption is encryption even if it's as pointless as a caesar cipher. And yeah, there's things like certificates and CAs with HTTPS, but that's totally secondary to the encryption part. No one would bother with HTTPS if it couldn't establish encrypted connections. If a lawyer or a judge doesn't understand that they themselves are frequently using encryption when they use the internet, that's a problem. They don't need to care about the nitty gritty details that you and others bring up. If they view encryption as something that only bad guys use, why should they be a part of the judicial system in the year 2021?
- tsimionescu 5y ago
  I don't like this line of thinking at all. Legal professionals are supposed to know the law and to ask experts for other things. Just like a judge and jury in a murder case are unable to understand how DNA analysis works, they don't have to understand how computer systems work. The only thing worse than a judge who doesn't understand the first thing about computers would be a judge who thinks they understand computers but doesn't.
janmo 5y ago
You are right, the actual wording they used was : "on an otherwise publicly accessible website". I've edited my submission accordingly. In law every word even every comma counts.
nobody9999 5y ago
>But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. IIUC, there was no attempt to "bypass security." Rather, HiQ Labs was scraping unrestricted (i.e., not restricted by user ACLs) portions of Linkedin's web platform. If any random user can access a particular web page, it's (IMHO) publicly available and using automated tools to scrape those pages is perfectly legal. In fact, such scraping is done all the time on airline, hotel and other websites without issue. As for VPNs, I'm guessing that LinkedIn blocked HiQ Labs' IP range, so they used a VPN to continue scraping the public pages. If my assumption isn't valid, please correct me. That IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners. However, that doesn't seem to be the case here. If (again, this is my understanding) LinkedIn is just blocking HiQ Labs' IP range, but no one else's, that seems (as the 9th Circuit originally ruled[1]) like a targeted attempt to interfere with HiQ Labs' business: The Ninth Circuit held that there was no abuse of discretion by the district court where the court had found that even if some LinkedIn users retained their privacy despite their public status, as they were not scraped, such privacy interests did not outweigh hiQ's interest in maintaining its business. Given that the issue here is publicly accessible content as compared to, say, geo-blocking of unlicensed (for that particular region) content, there is no basis to disallow such access. I say this because I (or HQ Labs) could manually enter all publicly accessible URLs at LinkedIn and copy-paste the returned contents. While that would be an arduous process, it's not only perfectly legal, it's LinkedIn's intent to provide those pages without requiring a login -- validated by the fact they don't require logins to access those pages, while they do require logins to access others. IANAL, but it seems to me that worrying about using VPNs becoming a criminal act is a tempest in a teapot. I guess we'll just have to wait and see. [0] https://en.wikipedia.org/wiki/Geo-blocking https://en.wikipedia.org/wiki/Geo-blocking [1] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn Edit: Corrected company name (HiQ vs. HiQ Labs).
- AnthonyMouse 5y ago
  > IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners. The entire thing is a farce. There has never been any way to know where an endpoint device is And VPNs are often necessary to prevent the service from detecting it wrong. Suppose I'm currently near an international border and my phone picks up a tower on the other side of the border. Now the IP address my phone gets is listed as being in the wrong country. A lot of companies route all their traffic through a head office somewhere so they can inspect the traffic in a central location. It's not always in the same country where the users are. Suppose I'm using a VPN for privacy reasons, not to bypass geographic restrictions, but I want it to be in a different country to maximize the inconvenience to anyone trying to violate my privacy, so now the country listed is the wrong one. I would have to use another VPN to get it back to being where I actually am. The obvious solution to all of this is to forget about trying to tie locations to IP addresses, since that has never worked, and just ask the user's device what country it's in. The user can set it to a different one but that's no different than the status quo.
grumple 5y ago
If I mail you a letter and you send a letter back, have I hacked your house? Let's say you don't respond, and I send my letter with a different return address and then you respond. That's basically what is happening here. If you don't want people sending you letters, get rid of the mailbox. For tech, close your ports. If you don't want to send information out, stop responding to the letters (or packets).

ravenstine 5y ago

I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech, but if you asked them if webpages are encrypted they would have no idea and would probably assume they are not. We are headed for a more authoritarian future if those making law or making judgments only see privacy tech as fringe and criminal, or have little meaningful underatandiing of it.

baktubi 5y ago
Hmm. You could also argue that not having understanding of the technology is a good thing. For instance, the judge can remove themselves from the details and look at it on a higher level. It’s the job of the attorneys to make the case for or against using subject matter experts etc.
- wizzwizz4 5y ago
  You could argue that. However, it means that people can basically lie to the judges, and the judges don't have the background to call them out on it.
  - baktubi 5y ago
    Pretty sure they lie to the judges anyway.
willis936 5y ago
The alternative to encryption really is totaltarian control of the internet. In order to have any level of confidence that the data is not tampered with you need strict security on every meter of cabling, every line of code, every transceiver, and every person involved with the design and fabrication of those things.
edejong 5y ago
It would start with us software engineers to be more exact in our communications. For an engineering discipline, we’re terrible at it. Take your example. I don’t know whether a web page is encrypted. I do however know whether the transmission of one request of some website contents to a specific web browser is. But that won’t yet tell me whether the communication between me and the website has stayed confidential between the intended parties (which is probably what you’re interested in).
- ravenstine 5y ago
  Whether data through an encrypted channel remains confidential isn't really relevant to my point. I didn't say "confidential", I said "encrypted". The distinction you are making with encryption and confidentiality seems conflated; if the channel is uses encryption, then the data is by virtue encrypted. It's another story if we are talking about data arriving from any channel with another layer of encryption for confidentiality.
  - Dylan16807 5y ago
    It's basically meaningless to talk about whether something is encrypted without the "from who" factor. Otherwise you might as well rot-13 it. If you want to use such a narrow definition of 'encrypted', then it doesn't matter if the lawyer knows the answer.
    - ravenstine 5y ago
      No, the answer is way simpler than you are making it out to be. Is the data in a TLS connection transformed in such a way that it would make it difficult for an intermediary to figure out the plain information being sent? If so, the data is in fact encrypted. Where are you getting this idea that encryption is more than that? That is by definition what encryption is, and everything else is just approaches and security layers on top of it. You don't have to like the encryption method, you don't have to care who it's from, you don't have to care about anything else. Encryption is encryption even if it's as pointless as a caesar cipher. And yeah, there's things like certificates and CAs with HTTPS, but that's totally secondary to the encryption part. No one would bother with HTTPS if it couldn't establish encrypted connections. If a lawyer or a judge doesn't understand that they themselves are frequently using encryption when they use the internet, that's a problem. They don't need to care about the nitty gritty details that you and others bring up. If they view encryption as something that only bad guys use, why should they be a part of the judicial system in the year 2021?
tsimionescu 5y ago
I don't like this line of thinking at all. Legal professionals are supposed to know the law and to ask experts for other things. Just like a judge and jury in a murder case are unable to understand how DNA analysis works, they don't have to understand how computer systems work. The only thing worse than a judge who doesn't understand the first thing about computers would be a judge who thinks they understand computers but doesn't.

janmo 5y ago

You are right, the actual wording they used was : "on an otherwise publicly accessible website". I've edited my submission accordingly. In law every word even every comma counts.

nobody9999 5y ago

>But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. IIUC, there was no attempt to "bypass security." Rather, HiQ Labs was scraping unrestricted (i.e., not restricted by user ACLs) portions of Linkedin's web platform. If any random user can access a particular web page, it's (IMHO) publicly available and using automated tools to scrape those pages is perfectly legal. In fact, such scraping is done all the time on airline, hotel and other websites without issue. As for VPNs, I'm guessing that LinkedIn blocked HiQ Labs' IP range, so they used a VPN to continue scraping the public pages. If my assumption isn't valid, please correct me. That IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners. However, that doesn't seem to be the case here. If (again, this is my understanding) LinkedIn is just blocking HiQ Labs' IP range, but no one else's, that seems (as the 9th Circuit originally ruled[1]) like a targeted attempt to interfere with HiQ Labs' business: The Ninth Circuit held that there was no abuse of discretion by the district court where the court had found that even if some LinkedIn users retained their privacy despite their public status, as they were not scraped, such privacy interests did not outweigh hiQ's interest in maintaining its business. Given that the issue here is publicly accessible content as compared to, say, geo-blocking of unlicensed (for that particular region) content, there is no basis to disallow such access. I say this because I (or HQ Labs) could manually enter all publicly accessible URLs at LinkedIn and copy-paste the returned contents. While that would be an arduous process, it's not only perfectly legal, it's LinkedIn's intent to provide those pages without requiring a login -- validated by the fact they don't require logins to access those pages, while they do require logins to access others. IANAL, but it seems to me that worrying about using VPNs becoming a criminal act is a tempest in a teapot. I guess we'll just have to wait and see. [0] https://en.wikipedia.org/wiki/Geo-blocking https://en.wikipedia.org/wiki/Geo-blocking [1] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn Edit: Corrected company name (HiQ vs. HiQ Labs).

AnthonyMouse 5y ago
> IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners. The entire thing is a farce. There has never been any way to know where an endpoint device is And VPNs are often necessary to prevent the service from detecting it wrong. Suppose I'm currently near an international border and my phone picks up a tower on the other side of the border. Now the IP address my phone gets is listed as being in the wrong country. A lot of companies route all their traffic through a head office somewhere so they can inspect the traffic in a central location. It's not always in the same country where the users are. Suppose I'm using a VPN for privacy reasons, not to bypass geographic restrictions, but I want it to be in a different country to maximize the inconvenience to anyone trying to violate my privacy, so now the country listed is the wrong one. I would have to use another VPN to get it back to being where I actually am. The obvious solution to all of this is to forget about trying to tie locations to IP addresses, since that has never worked, and just ask the user's device what country it's in. The user can set it to a different one but that's no different than the status quo.

grumple 5y ago

If I mail you a letter and you send a letter back, have I hacked your house? Let's say you don't respond, and I send my letter with a different return address and then you respond. That's basically what is happening here. If you don't want people sending you letters, get rid of the mailbox. For tech, close your ports. If you don't want to send information out, stop responding to the letters (or packets).