17 ms·

Reporter likely to be charged for using “view source” feature on web browser

368 points by denysvitali 5y ago

hyiltiz 5y ago
Sounds like we must better educate people about what is public about the web.
- skywal_l 5y ago
  I don't think it's about education. It's about bad faith and cynical politicians abusing the justice system to intimidate reporters. There is nothing to be done about it but vote those people out.
- peanut_worm 5y ago
  At this point they definitely understand how it works but they are choosing to prosecute anyways to cover their asses
RappingBoomer 5y ago
stunning..and scary... the root problem here (or at least one of the root problems) is that government workers are not hired or promoted on merit. That leads to people of lesser intelligence being bosses. As evidenced here. That is a bad thing, in my opinion. You want smart people in charge. That's a good thing!
- skywal_l 5y ago
  Has I said in another comment, it is not about education or intelligence. Read the article. The politicians trying to intimidate the St Louis Post Dispatch have a history of intimidation against journalists. Demagoguery is unfortunately a chronic condition of democracy.
  - pbhjpbhj 5y ago
    Any thoughts on how to tailor political systems to work around demagoguery but maintain functioning democracy?
    - denton-scratch 5y ago
      What's democracy? Is that when stuff gets done to you by corrupt politicians, and you have to shut up and suck it, except that every few years you get to swap one bunch of corrupt politicians for another bunch?
      - bjornsing 5y ago
        Yes. You pretty much nailed it.
    - skywal_l 5y ago
      If only I knew... Might be worth reading de Tocqueville[0] again I guess. [0] https://en.wikipedia.org/wiki/Democracy_in_America https://en.wikipedia.org/wiki/Democracy_in_America
    - MR4D 5y ago
      We already have it - it’s the 3 branches of government that provide for an independent judiciary.
      - skywal_l 5y ago
        In theory. I believe the system was setup to ensure that the judicial system is independent from the executive branch. However, we have seen the nefarious influence of money in politics which is now starting to encroach on the judicial system too: https://www.wsj.com/articles/federal-judges-brokers-traded-stocks-of-litigants-during-cases-walmart-pfizer-11634306192 https://www.wsj.com/articles/federal-judges-brokers-traded-s... https://iadllaw.org/2020/09/more-than-200-lawyers-file-judicial-complaint-against-judge-lewis-a-kaplan-over-abusive-targeting-of-human-rights-advocate-steven-donziger/ https://iadllaw.org/2020/09/more-than-200-lawyers-file-judic...
- johnorourke 5y ago
  Let's not equate "lack of understanding of a specific piece of technology" with "lesser intelligence", that is not a healthy way to think.
  - hermitcrab 5y ago
    That no offence was comitted here should be apparent to 10 year old of average intelligence. The governor is either very stupid, very ignorant or very cynical. Or some combination of the 3.
  - xigoi 5y ago
    That's true, but insisting that you're right about something that you know nothing about is a sign of lesser intelligence.
    - pbhjpbhj 5y ago
      Maybe, but there a possibility they know it's not a valid argument but believe they can still use it effectively. Just because someone supports a position doesn't mean they know it's valid, not that they know it's moral. Plenty of people, and especially politicians of some persuasions, are happy to spout known lies and deceptions to get to their preferred outcome.
- goldcd 5y ago
  There's the original IT screw-up - but I think the body of the sory is around the ineptitude of the elected governor. Not specifically that he doesn't understand how the web works - more that he didn't care to find out before opening his mouth. Or worse is aware, but is disengenuously pushing for a prosecution of somebody he disagrees with.
- ratww 5y ago
  > the root problem here is that government workers are not hired or promoted on merit. That leads to people of lesser intelligence being bosses That's hardly exclusive to government work.
- rsynnott 5y ago
  This is nothing to do with government worker competence. Undoubtedly, the governor has been advised that there is no case. It's legal harassment, and a sign of (a) a structurally flawed system (the executive should be in no position to make this sort of threat in the first place) and (b) a sick political system (even if the executive is legally able to make such a threat, it should be politically impossible for them to do so).
jimnotgym 5y ago
Am I to understand that a state governer has the power to instruct some lacky-lawyer to charge someone with a crime, and to prosecute them for that crime? In the land of the free, this is not an independent process?
- Broken_Hippo 5y ago
  You are surprised? We already know that a prosecutor will try for higher sentences near an election and... well, they are elected. It isn't hard to imagine that an elected official works with other elected officials, especially if they want to do other things in government.
  - jimnotgym 5y ago
    I live in the UK. I am very suprised yes
    - Ekaros 5y ago
      As European, I find it insane that I could elect the prosecutor or even the police. And in some ways that politicians would have any word on this apart from deciding the funding and laws...
      - skywal_l 5y ago
        I don't disagree with your point but how a prosecutor must be selected then? If someone is not chosen by a public and popular vote, it must be chosen differently. Any mechanism of choice will have an inherent bias. For example, you could decide that a prosecutor is the best at knowing the law, so let's have a law exam where the one with the best score is named prosecutor. However, being a good prosecutor can't always be reduced to a technical know-how. And those good at laws might be those who were able to pay to go to the best universities, buy the textbooks, be allowed to study for years without working, etc. So you also have a bias on wealthy families. I don't think that the problem of allocation of power in our modern societies is a solved problem...
TameAntelope 5y ago
This smells like clickbait. No charges have been filed, just a statement from a governor who has a history of bloviating about the press. “Likely to be charged” is a huge stretch.
- sigmaprimus 5y ago
  Having watched a few of the sessions held by congress questioning social media CEOs and the like, I think this story is quite plausible. In between the grandstanding some of the politicians asked such odd questions, I think an introduction to digital safety should be a requisite course for all public servants along side antidiscrimination and inclusivity. I wouldn't be surprised if there is someone already in jail who has been charged and convicted to a similar action. Here is a Canadian example of a similar event. https://edmontonjournal.com/news/politics/covid-19-records-webpage-ndp-mla-thomas-dang-steps-down-after-rcmp-search-warrant-executed-on-his-home https://edmontonjournal.com/news/politics/covid-19-records-w...
  - TameAntelope 5y ago
    “Plausible” is exactly where misinformation and fake news thrives. It’s news if he’s actually charged, it’s much less news if a frustrated governor blows off steam about it. This is, so far, nothing more than the latter.
    - watwut 5y ago
      Frustrated governor blows off steam is news, because that is literally governor harrassing journalists and abusing position.
      - TameAntelope 5y ago
        Yeah (less news isn’t not news), just not the news being reported in the title. And this isn’t harassment yet. This is just a statement, nothing has actually happened. If you want to see where this could go, check out the story of the data scientist who whistleblew on the Florida government hiding COVID deaths [0]. But none of that’s happened here, yet. [0] https://www.beckershospitalreview.com/healthcare-information-technology/fired-florida-covid-19-data-scientist-receives-whistleblower-status.html https://www.beckershospitalreview.com/healthcare-information...
AtNightWeCode 5y ago
Nothing will happen. Just politicians trying to intimidate media.
- kypro 5y ago
  If I were to guess they probably know nothing will happen. It seems like the point here might just be to send a message -- sure, perhaps nothing will happen this time, but are you going to take that chance next time?
pyrale 5y ago
I don't really like the framing that the reporter is framed for using "view source". This reinforces the idea that the people responsible for this are just uneducated. I'm sure, at this point, someone already explained them. That reporter is a victim of harassment, and that if it wasn't for "view source", it could be for some unrelated stuff. It's the same as protesters being arrested for all kinds of bogus reasons, or random people being arrested with planted evidence. The goal is to deter someone you don't like from exercising their legal right (journalism, protesting, standing in the street in the wrong neighbourhood), by weaponizing unrelated laws. The only reason "view source" is being talked about is because that looked like the best case when the book was thrown at that journalist. I hope that case remains at threats and doesn't get to actual charges.
- netizen-936824 5y ago
  They might prosecute, but I bet a jury would throw it out
  - sgjohnson 5y ago
    It probably won’t even get to jury. It might get dismissed with prejudice before it goes to trial.
    - rchaud 5y ago
      For a case that could potentially embarrass the state, I'd think the prosecution would try hard to make sure the case appears on the right judge's docket.
      - jbullock35 5y ago
        What ability do prosecutors have to maneuver their case onto a particular judge's docket? How would they do that?
        pixl97 5y ago
denton-scratch 5y ago
> If somebody picks your lock on your house It's not like picking a lock. It's more like turning over a sheet of paper to read what's on the other side. If this guy gets convicted, I'll eat my hat (I wear a fedora). "Thy just thow their fedora wherever the floor is And start doing horas and taps".
- ThrustVectoring 5y ago
  The process is the punishment here. The only adequate protection against capricious prosecution is that in principle you can make a stink and vote out the elected officials abusing their power.
  - DarylZero 5y ago
    >The only adequate protection against capricious prosecution That isn't adequate protection at all. It allows the voters to elect officials who will persecute the minorities that those voters want persecuted. Most especially, black people in the USA definitely need protection beyond that.
- mattwilsonn888 5y ago
  "A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?" This was only a few lines below that.
  - denton-scratch 5y ago
    That's not a better analogy. The implication is that somehow the raw HTML is more valuable than the rendered webpage. You don't get to publish a "rendered webpage"; what you publish is raw HTML. If you didn't want people to read it, you didn't ought to have published it. [Edit] Also, taking a copy of the HTML isn't like taking keys and a purse. If you take keys and a purse, the owner has been deprived of them. That's not the case with taking a copy of a webpage.
actually_a_dog 5y ago
Related: Reporter may be prosecuted for using “view source” (currently 151 comments): https://news.ycombinator.com/item?id=29737412 https://news.ycombinator.com/item?id=29737412
albertopv 5y ago
Seen from abroad USA seems like a parody of themselves, not a one particularly funny. Greatest country for greatest opportunities, still many politicians seem incredibly dumb, or ar least as dumb as italian ones, which are really really dumb, on average.
- sixothree 5y ago
  Just remember the US isn't exactly one entity, but a collection of 50 states. Still it's sad that the least educated states seem to have so much power lately.
  - batch12 5y ago
    Which states are these that should have less power than the states with the "smart" people?
    - sixothree 5y ago
      I mean you could start with the abuse of power mentioned in the article.
FDSGSG 5y ago
Blogspam for https://www.stltoday.com/news/local/govt-and-politics/missouri-officials-planned-to-thank-post-dispatch-before-threatening-newspaper-emails-show/article_0f6c5288-cd11-569c-804e-9b280e9c1e68.html https://www.stltoday.com/news/local/govt-and-politics/missou...
kbsspl 5y ago
2 birds, one stone. Politicians can get away doing what they want with whatever reason. And politicians are being used to make the internet more opaque. Since 'view source' is being made a scapegoat, expect it to disappear soon.
- nunez 5y ago
  Disappearing View Source is stupid in a world in which you can curl or use dev tools to get at the same data. Wouldnt even be shocked if some applications/workflows depended on it.
jollybean 5y ago
I hope they charge him, because it's going to be very hard to prosecute I believe, and a victory would enshrine legal rights to 'Right Click' and view source. I think the trial would come under enormous scrutiny. If the reporter lost the case in local banana republic courts, I do believe it would go up to Federal or Supreme and it would win.
- denysvitali 5y ago
  Think about how happy would the NFT owners be!
- coldcode 5y ago
  If I was the lawyer for the reporter I'd ask Tim Berners-Lee to testify. What a great testimony that would be.
- rchaud 5y ago
  The case being hard to prosecute doesn't mean that paying for a legal defense will be cheap. The same goes for suing the state for damages afterwards; lawyers will require retainers to investigate the likelihood of a settlement. Suing the government is not a simple matter, by design. The goal of threatening reporters with prosecution is to intimidate others and prevent them from investigating areas that could embarrass the state government.
eskathos 5y ago
You can not trespass my eyes...
asimpletune 5y ago
I wonder what the lock picking lawyer would say about this view source = illegally picking an albeit crappy lock?
rookderby 5y ago
A person should be able to email security@domain without legal ramifications. They should encourage these good guys with bounties as well. Edit: I would guess its much cheaper in the long run, although i dont have a source.
huffmsa 5y ago
If a government clerk brings you a stack of papers with SSNs on it and you read it and tell them, it's not your fault. Just because the browser only renders certain parts of the returned document doesn't mean that the government site didn't send you the whole document
nijave 5y ago
I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"
- damagednoob 5y ago
  > The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1]. [1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb386448(v=vs.100)#encrypting-view-state https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...
  - tragictrash 5y ago
    Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.
    - ceejayoz 5y ago
      To be fair, leaving a SQL injection hole makes it pretty dynamic.
      - tragictrash 5y ago
        Wow. That's the real 10x developer play. New api? Why, we have that one endpoint!
        chewbacha 5y ago
        That’s basically what Postgraphql is.
literallyaduck 5y ago
It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter should have notified them directly, anonymously, or kept their mouth shut. If you send information to the client, it is your responsibility to make sure it doesn't contain private information. The reporter should probably not be prosecuted, pardoned if convicted, and we should repeal the laws that make using anything sent to client illegal. If you are sent something you didn't order in the mail the FTC says you don't have to pay: https://www.consumer.ftc.gov/articles/what-do-if-youre-billed-things-you-never-got-or-you-get-unordered-products https://www.consumer.ftc.gov/articles/what-do-if-youre-bille... "By law, companies can’t send unordered merchandise to you, then demand payment. That means you never have to pay for things you get but didn’t order. You also don’t have to return unordered merchandise. You’re legally entitled to keep it as a free gift." This reporter was gifted some viewstate because it came to his computer. Edit: To the person claiming it is "another language", I don't know anyone that does Base64 decoding in their head, and this is clearly not meant for human consumption. Here is what viewstate is: http://www.nullskull.com/articles/20060208.asp http://www.nullskull.com/articles/20060208.asp There are many tools for consuming it through decoding and deserializing but that doesn't make it legal. There are tools for decoding DVDs which meet this same category.
- jazzyjackson 5y ago
  What is this “encoded viewstate” of which you speak? It’s my impression that the reporter didn’t have to go so far as thumbing over to the network tab or otherwise open any envelopes, the social security numbers were instead embedded in HTML, just not visible in the painted layout. Kudos for attempting a framing for the prosecution, but I don’t think there are laws against opening mail addressed to me. Edit: just saw the comment about .net using base64 encoded state, so I understand your argument better now. In that case, if a ROT13 encrypted message was sent to me without the key, being trivial to crack doesn’t imply I have the right to share state secrets… agreed the case is a little more complicated than journalists have made it appear, go figure.
nijave 5y ago
I think a lot of analogies miss the point that data was copied and transmitted to the client and accessed client side. I think it'd be more accurate to compare to a barcode Imagine requesting a voter registration form and you receive a letter in the mail with all previous residents social security numbers encoded in QR codes that were added as a "convenience feature" for the voting office In that case, it'd be ridiculous to claim you "hacked the voting office"
- mind-blight 5y ago
  A similar example could be credit card strips. They actually had people's SSNs encoded in them for a while. Anyone with a reader and physical access to a card could grab them. Dateline did a report on it back in the day without having to deal with anything like this
- deleted 5y ago
  [deleted]
nunez 5y ago
> The reporter discovered that the source code of the website contained Social Security numbers of educators. The reporter alerted the state about the social security numbers. After the state removed the numbers from the web page, the Post-Dispatch reported the vulnerability. I really hate the idea that trying to do the right thing (reporter telling MO DoE about SSNs being in their HTML) results in prosecution to save face instead of reflection and congratulations. This is how you get more crime. Also, REALLY?! That means that Google indexed those SSNs!
- mind-blight 5y ago
  I'm also wondering if they're hanging out in the wayback machine
- addingnumbers 5y ago
  > That means that Google indexed those SSNs! Not necessarily. The SSNs were returned in search results from an HTML form. Last I checked, google's crawlers don't POST forms.
josefrichter 5y ago
This is a fascinating question. I can see strong arguments on both sides. Just because something is publicly accessible, it doesn't make it free to take or use. Of course there will never be a strict line, so one needs to take into account the intent, intensity, and the usual parameters.
- Nihilartikel 5y ago
  Another perspective is that the private data was extracted and conveyed by the state website to the end user completely without their request or consent! I find it reasonable that the government should be held legally liable for introducing users to the hazard of accidental exposure to confidential data.
  - josefrichter 5y ago
    I find the question interesting from the general point of view. I don't really know enough details of this specific case to form any opinion.
- w-j-w 5y ago
- ki9 5y ago
  Well the reporter didn't "take or use" the SSNs. He found them without looking for them and reported them.
  - josefrichter 5y ago
    I don't really know what happened there, but the underlying topic is fascinating.
- remram 5y ago
  The reporter didn't use it, but signaled it so it could be fixed.
gefhfffh 5y ago
account-5 5y ago
State makes the personal information of state employees freely available to anyone with an internet connection and a web browser. Reporter notices, reports it to the state, waits for it to be fixed, then runs the story. State governor goes after reporter. The state governor is either an idiot, or trying to cover up iltheir incompetence, or both. And doing so in a way that makes him look like more of an idiot. If the prosecutor takes this up then either they're an idiot or being pressured to do so, by the idiot in charge.
- gaws 5y ago
  > The state governor is either an idiot, or trying to cover up iltheir incompetence, or both. He's both, in addition to trying to "stand up to the fake news" for his voter base.
CoastalCoder 5y ago
Is there a legal defense fund? I'd gladly contribute.
wonderwonder 5y ago
We are very much on the slippery slope of elected officials making prosecutors punish people they don't like. Short hop and a jump to Putin like rule. We are not going in the right direction in the US.
- gaws 5y ago
  > We are very much on the slippery slope of elected officials making prosecutors punish people they don't like. Are you living under a rock? This has been happening for a while.
  - wonderwonder 5y ago
    Appreciate the insult, hope it makes you feel good about yourself.
    - gaws 5y ago
      Makes me sad that you're not the only one.
      - wonderwonder 5y ago
        Have an upvote and a good day :)
agar 5y ago
I find it overly amusing that the article is tagged with "CHRIST WHAT AN ASSHOLE". After clicking through to see other stories with the same tag, it's...apt.
- gaws 5y ago
  What did you expect? It's BoingBoing. Not really at the pinnacle of American journalism.
SSShupe 5y ago
The HTML document revealed by "view source" isn't something "behind" the web page -- it IS the web page. The State effectively made a document containing the confidential info available to everyone and is now complaining because someone looked at it. I agree with the prior commentators that this is more about politics than law.
kthejoker2 5y ago
From a tort perspective, it seems like the client assumes all the risk of an HTTP request: I made a request for this URI - without (obviously) knowing its contents - and you send me some contents. Even if I as the client attempt to send a malicious payload, etc. the server can transmit back whatever it would like any time - that's the rules of the game. So the server holds all the power, and as long as I got a "200 OK" response with whatever contents you sent me, you have absolved the client of wrongdoing without a much bigger burden of proof of fraud, identity theft, etc... Otherwise, the Internet literally becomes unusable - if even submitting this comment might result in me receiving illegal content, how does one proceed? Sidenote: this is tangentially similar to the CitiGroup Revlon case, where Citi accidentally paid out the full principal on a loan to Revlon to a bunch of small lenders, and the lenders refused to return the money. https://www.npr.org/transcripts/1019909860 https://www.npr.org/transcripts/1019909860 The court ruling is interesting, in that as long as the lenders assumed the money was sent on purpose - that that was the intention of CitiGroup - then there was no reason to send the money back. But if they assumed the money was sent on accident, then it was illegal to keep it. The court ruled that under good faith argumentation ("discharge of value") that if someone owes you money and they pay it back, even "on accident" or otherwise, you have no obligation to return it. And again, it hinged not on the individual case per se but the effect of ruling otherwise - that you could never truly spend money that was sent to you because someone might come later and claw it back, which would just grind the financial industry to a halt. I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them.
- badRNG 5y ago
  >I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them. Disclaimer: I don't work with web tech, but wouldn't that also permit a lot of activities we would absolutely consider unethical, like SQL injection? It seems like you could certainly craft a request to circumvent security controls to receive a 200 response back that we'd absolutely consider to be unethical.
  - kthejoker2 5y ago
jbjbjbjb 5y ago
The lock analogy is completely false. A better analogy is state sending this person a letter with all the social security numbers.
gethoht 5y ago
Ignorance + fascism tends to lead to these kind of results. The stark reality of redhat america.
rboes 5y ago
People really nees to understand web development before they start making analogies. Checking view source is not like unlocking a door.

368 points by denysvitali 5y ago

hyiltiz 5y ago

Sounds like we must better educate people about what is public about the web.

skywal_l 5y ago
I don't think it's about education. It's about bad faith and cynical politicians abusing the justice system to intimidate reporters. There is nothing to be done about it but vote those people out.
peanut_worm 5y ago
At this point they definitely understand how it works but they are choosing to prosecute anyways to cover their asses

RappingBoomer 5y ago

stunning..and scary... the root problem here (or at least one of the root problems) is that government workers are not hired or promoted on merit. That leads to people of lesser intelligence being bosses. As evidenced here. That is a bad thing, in my opinion. You want smart people in charge. That's a good thing!

skywal_l 5y ago
Has I said in another comment, it is not about education or intelligence. Read the article. The politicians trying to intimidate the St Louis Post Dispatch have a history of intimidation against journalists. Demagoguery is unfortunately a chronic condition of democracy.
- pbhjpbhj 5y ago
  Any thoughts on how to tailor political systems to work around demagoguery but maintain functioning democracy?
  - denton-scratch 5y ago
    What's democracy? Is that when stuff gets done to you by corrupt politicians, and you have to shut up and suck it, except that every few years you get to swap one bunch of corrupt politicians for another bunch?
    - bjornsing 5y ago
      Yes. You pretty much nailed it.
  - skywal_l 5y ago
    If only I knew... Might be worth reading de Tocqueville[0] again I guess. [0] https://en.wikipedia.org/wiki/Democracy_in_America https://en.wikipedia.org/wiki/Democracy_in_America
  - MR4D 5y ago
    We already have it - it’s the 3 branches of government that provide for an independent judiciary.
    - skywal_l 5y ago
      In theory. I believe the system was setup to ensure that the judicial system is independent from the executive branch. However, we have seen the nefarious influence of money in politics which is now starting to encroach on the judicial system too: https://www.wsj.com/articles/federal-judges-brokers-traded-stocks-of-litigants-during-cases-walmart-pfizer-11634306192 https://www.wsj.com/articles/federal-judges-brokers-traded-s... https://iadllaw.org/2020/09/more-than-200-lawyers-file-judicial-complaint-against-judge-lewis-a-kaplan-over-abusive-targeting-of-human-rights-advocate-steven-donziger/ https://iadllaw.org/2020/09/more-than-200-lawyers-file-judic...
johnorourke 5y ago
Let's not equate "lack of understanding of a specific piece of technology" with "lesser intelligence", that is not a healthy way to think.
- hermitcrab 5y ago
  That no offence was comitted here should be apparent to 10 year old of average intelligence. The governor is either very stupid, very ignorant or very cynical. Or some combination of the 3.
- xigoi 5y ago
  That's true, but insisting that you're right about something that you know nothing about is a sign of lesser intelligence.
  - pbhjpbhj 5y ago
    Maybe, but there a possibility they know it's not a valid argument but believe they can still use it effectively. Just because someone supports a position doesn't mean they know it's valid, not that they know it's moral. Plenty of people, and especially politicians of some persuasions, are happy to spout known lies and deceptions to get to their preferred outcome.
goldcd 5y ago
There's the original IT screw-up - but I think the body of the sory is around the ineptitude of the elected governor. Not specifically that he doesn't understand how the web works - more that he didn't care to find out before opening his mouth. Or worse is aware, but is disengenuously pushing for a prosecution of somebody he disagrees with.
ratww 5y ago
> the root problem here is that government workers are not hired or promoted on merit. That leads to people of lesser intelligence being bosses That's hardly exclusive to government work.
rsynnott 5y ago
This is nothing to do with government worker competence. Undoubtedly, the governor has been advised that there is no case. It's legal harassment, and a sign of (a) a structurally flawed system (the executive should be in no position to make this sort of threat in the first place) and (b) a sick political system (even if the executive is legally able to make such a threat, it should be politically impossible for them to do so).

jimnotgym 5y ago

Am I to understand that a state governer has the power to instruct some lacky-lawyer to charge someone with a crime, and to prosecute them for that crime? In the land of the free, this is not an independent process?

Broken_Hippo 5y ago
You are surprised? We already know that a prosecutor will try for higher sentences near an election and... well, they are elected. It isn't hard to imagine that an elected official works with other elected officials, especially if they want to do other things in government.
- jimnotgym 5y ago
  I live in the UK. I am very suprised yes
  - Ekaros 5y ago
    As European, I find it insane that I could elect the prosecutor or even the police. And in some ways that politicians would have any word on this apart from deciding the funding and laws...
    - skywal_l 5y ago
      I don't disagree with your point but how a prosecutor must be selected then? If someone is not chosen by a public and popular vote, it must be chosen differently. Any mechanism of choice will have an inherent bias. For example, you could decide that a prosecutor is the best at knowing the law, so let's have a law exam where the one with the best score is named prosecutor. However, being a good prosecutor can't always be reduced to a technical know-how. And those good at laws might be those who were able to pay to go to the best universities, buy the textbooks, be allowed to study for years without working, etc. So you also have a bias on wealthy families. I don't think that the problem of allocation of power in our modern societies is a solved problem...

TameAntelope 5y ago

This smells like clickbait. No charges have been filed, just a statement from a governor who has a history of bloviating about the press. “Likely to be charged” is a huge stretch.

sigmaprimus 5y ago
Having watched a few of the sessions held by congress questioning social media CEOs and the like, I think this story is quite plausible. In between the grandstanding some of the politicians asked such odd questions, I think an introduction to digital safety should be a requisite course for all public servants along side antidiscrimination and inclusivity. I wouldn't be surprised if there is someone already in jail who has been charged and convicted to a similar action. Here is a Canadian example of a similar event. https://edmontonjournal.com/news/politics/covid-19-records-webpage-ndp-mla-thomas-dang-steps-down-after-rcmp-search-warrant-executed-on-his-home https://edmontonjournal.com/news/politics/covid-19-records-w...
- TameAntelope 5y ago
  “Plausible” is exactly where misinformation and fake news thrives. It’s news if he’s actually charged, it’s much less news if a frustrated governor blows off steam about it. This is, so far, nothing more than the latter.
  - watwut 5y ago
    Frustrated governor blows off steam is news, because that is literally governor harrassing journalists and abusing position.
    - TameAntelope 5y ago
      Yeah (less news isn’t not news), just not the news being reported in the title. And this isn’t harassment yet. This is just a statement, nothing has actually happened. If you want to see where this could go, check out the story of the data scientist who whistleblew on the Florida government hiding COVID deaths [0]. But none of that’s happened here, yet. [0] https://www.beckershospitalreview.com/healthcare-information-technology/fired-florida-covid-19-data-scientist-receives-whistleblower-status.html https://www.beckershospitalreview.com/healthcare-information...

AtNightWeCode 5y ago

Nothing will happen. Just politicians trying to intimidate media.

kypro 5y ago
If I were to guess they probably know nothing will happen. It seems like the point here might just be to send a message -- sure, perhaps nothing will happen this time, but are you going to take that chance next time?

pyrale 5y ago

I don't really like the framing that the reporter is framed for using "view source". This reinforces the idea that the people responsible for this are just uneducated. I'm sure, at this point, someone already explained them. That reporter is a victim of harassment, and that if it wasn't for "view source", it could be for some unrelated stuff. It's the same as protesters being arrested for all kinds of bogus reasons, or random people being arrested with planted evidence. The goal is to deter someone you don't like from exercising their legal right (journalism, protesting, standing in the street in the wrong neighbourhood), by weaponizing unrelated laws. The only reason "view source" is being talked about is because that looked like the best case when the book was thrown at that journalist. I hope that case remains at threats and doesn't get to actual charges.

netizen-936824 5y ago
They might prosecute, but I bet a jury would throw it out
- sgjohnson 5y ago
  It probably won’t even get to jury. It might get dismissed with prejudice before it goes to trial.
  - rchaud 5y ago
    For a case that could potentially embarrass the state, I'd think the prosecution would try hard to make sure the case appears on the right judge's docket.
    - jbullock35 5y ago
      What ability do prosecutors have to maneuver their case onto a particular judge's docket? How would they do that?
      - pixl97 5y ago

denton-scratch 5y ago

> If somebody picks your lock on your house It's not like picking a lock. It's more like turning over a sheet of paper to read what's on the other side. If this guy gets convicted, I'll eat my hat (I wear a fedora). "Thy just thow their fedora wherever the floor is And start doing horas and taps".

ThrustVectoring 5y ago
The process is the punishment here. The only adequate protection against capricious prosecution is that in principle you can make a stink and vote out the elected officials abusing their power.
- DarylZero 5y ago
  >The only adequate protection against capricious prosecution That isn't adequate protection at all. It allows the voters to elect officials who will persecute the minorities that those voters want persecuted. Most especially, black people in the USA definitely need protection beyond that.
mattwilsonn888 5y ago
"A better analogy would be you're walking in the street past a neighbor's house and notice their front door wide open with no one around. You can see a purse and car keys near the door. You phone that neighbor, and tell them their door is open and their purse and keys are easily visible from the street. Would Parson consider this breaking and entering?" This was only a few lines below that.
- denton-scratch 5y ago
  That's not a better analogy. The implication is that somehow the raw HTML is more valuable than the rendered webpage. You don't get to publish a "rendered webpage"; what you publish is raw HTML. If you didn't want people to read it, you didn't ought to have published it. [Edit] Also, taking a copy of the HTML isn't like taking keys and a purse. If you take keys and a purse, the owner has been deprived of them. That's not the case with taking a copy of a webpage.

actually_a_dog 5y ago

Related: Reporter may be prosecuted for using “view source” (currently 151 comments): https://news.ycombinator.com/item?id=29737412 https://news.ycombinator.com/item?id=29737412

albertopv 5y ago

Seen from abroad USA seems like a parody of themselves, not a one particularly funny. Greatest country for greatest opportunities, still many politicians seem incredibly dumb, or ar least as dumb as italian ones, which are really really dumb, on average.

sixothree 5y ago
Just remember the US isn't exactly one entity, but a collection of 50 states. Still it's sad that the least educated states seem to have so much power lately.
- batch12 5y ago
  Which states are these that should have less power than the states with the "smart" people?
  - sixothree 5y ago
    I mean you could start with the abuse of power mentioned in the article.

FDSGSG 5y ago

Blogspam for https://www.stltoday.com/news/local/govt-and-politics/missouri-officials-planned-to-thank-post-dispatch-before-threatening-newspaper-emails-show/article_0f6c5288-cd11-569c-804e-9b280e9c1e68.html https://www.stltoday.com/news/local/govt-and-politics/missou...

kbsspl 5y ago

2 birds, one stone. Politicians can get away doing what they want with whatever reason. And politicians are being used to make the internet more opaque. Since 'view source' is being made a scapegoat, expect it to disappear soon.

nunez 5y ago
Disappearing View Source is stupid in a world in which you can curl or use dev tools to get at the same data. Wouldnt even be shocked if some applications/workflows depended on it.

jollybean 5y ago

I hope they charge him, because it's going to be very hard to prosecute I believe, and a victory would enshrine legal rights to 'Right Click' and view source. I think the trial would come under enormous scrutiny. If the reporter lost the case in local banana republic courts, I do believe it would go up to Federal or Supreme and it would win.

denysvitali 5y ago
Think about how happy would the NFT owners be!
coldcode 5y ago
If I was the lawyer for the reporter I'd ask Tim Berners-Lee to testify. What a great testimony that would be.
rchaud 5y ago
The case being hard to prosecute doesn't mean that paying for a legal defense will be cheap. The same goes for suing the state for damages afterwards; lawyers will require retainers to investigate the likelihood of a settlement. Suing the government is not a simple matter, by design. The goal of threatening reporters with prosecution is to intimidate others and prevent them from investigating areas that could embarrass the state government.

eskathos 5y ago

You can not trespass my eyes...

asimpletune 5y ago

I wonder what the lock picking lawyer would say about this view source = illegally picking an albeit crappy lock?

rookderby 5y ago

A person should be able to email security@domain without legal ramifications. They should encourage these good guys with bounties as well. Edit: I would guess its much cheaper in the long run, although i dont have a source.

huffmsa 5y ago

If a government clerk brings you a stack of papers with SSNs on it and you read it and tell them, it's not your fault. Just because the browser only renders certain parts of the returned document doesn't mean that the government site didn't send you the whole document

nijave 5y ago

I saw in a thread somewhere else a while ago a bit more detailed explanation: The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side The reporter had to view source and base64 decode the data Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"

damagednoob 5y ago
> The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1]. [1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb386448(v=vs.100)#encrypting-view-state https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...
- tragictrash 5y ago
  Someone interviewed for my company last month. One of his previous experiences was listed as "dynamic SQL". My third question was how do you prevent SQL injection attacks. He didn't know.
  - ceejayoz 5y ago
    To be fair, leaving a SQL injection hole makes it pretty dynamic.
    - tragictrash 5y ago
      Wow. That's the real 10x developer play. New api? Why, we have that one endpoint!
      - chewbacha 5y ago
        That’s basically what Postgraphql is.

literallyaduck 5y ago

It was more than "View Source". It was decoding viewstate. Reading someone's postcard in the mailbox is like looking at the source. He opened the letter that was in the encoded viewstate. The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know. The reporter should have notified them directly, anonymously, or kept their mouth shut. If you send information to the client, it is your responsibility to make sure it doesn't contain private information. The reporter should probably not be prosecuted, pardoned if convicted, and we should repeal the laws that make using anything sent to client illegal. If you are sent something you didn't order in the mail the FTC says you don't have to pay: https://www.consumer.ftc.gov/articles/what-do-if-youre-billed-things-you-never-got-or-you-get-unordered-products https://www.consumer.ftc.gov/articles/what-do-if-youre-bille... "By law, companies can’t send unordered merchandise to you, then demand payment. That means you never have to pay for things you get but didn’t order. You also don’t have to return unordered merchandise. You’re legally entitled to keep it as a free gift." This reporter was gifted some viewstate because it came to his computer. Edit: To the person claiming it is "another language", I don't know anyone that does Base64 decoding in their head, and this is clearly not meant for human consumption. Here is what viewstate is: http://www.nullskull.com/articles/20060208.asp http://www.nullskull.com/articles/20060208.asp There are many tools for consuming it through decoding and deserializing but that doesn't make it legal. There are tools for decoding DVDs which meet this same category.

jazzyjackson 5y ago
What is this “encoded viewstate” of which you speak? It’s my impression that the reporter didn’t have to go so far as thumbing over to the network tab or otherwise open any envelopes, the social security numbers were instead embedded in HTML, just not visible in the painted layout. Kudos for attempting a framing for the prosecution, but I don’t think there are laws against opening mail addressed to me. Edit: just saw the comment about .net using base64 encoded state, so I understand your argument better now. In that case, if a ROT13 encrypted message was sent to me without the key, being trivial to crack doesn’t imply I have the right to share state secrets… agreed the case is a little more complicated than journalists have made it appear, go figure.

nijave 5y ago

I think a lot of analogies miss the point that data was copied and transmitted to the client and accessed client side. I think it'd be more accurate to compare to a barcode Imagine requesting a voter registration form and you receive a letter in the mail with all previous residents social security numbers encoded in QR codes that were added as a "convenience feature" for the voting office In that case, it'd be ridiculous to claim you "hacked the voting office"

mind-blight 5y ago
A similar example could be credit card strips. They actually had people's SSNs encoded in them for a while. Anyone with a reader and physical access to a card could grab them. Dateline did a report on it back in the day without having to deal with anything like this
deleted 5y ago
[deleted]

nunez 5y ago

> The reporter discovered that the source code of the website contained Social Security numbers of educators. The reporter alerted the state about the social security numbers. After the state removed the numbers from the web page, the Post-Dispatch reported the vulnerability. I really hate the idea that trying to do the right thing (reporter telling MO DoE about SSNs being in their HTML) results in prosecution to save face instead of reflection and congratulations. This is how you get more crime. Also, REALLY?! That means that Google indexed those SSNs!

mind-blight 5y ago
I'm also wondering if they're hanging out in the wayback machine
addingnumbers 5y ago
> That means that Google indexed those SSNs! Not necessarily. The SSNs were returned in search results from an HTML form. Last I checked, google's crawlers don't POST forms.

josefrichter 5y ago

This is a fascinating question. I can see strong arguments on both sides. Just because something is publicly accessible, it doesn't make it free to take or use. Of course there will never be a strict line, so one needs to take into account the intent, intensity, and the usual parameters.

Nihilartikel 5y ago
Another perspective is that the private data was extracted and conveyed by the state website to the end user completely without their request or consent! I find it reasonable that the government should be held legally liable for introducing users to the hazard of accidental exposure to confidential data.
- josefrichter 5y ago
  I find the question interesting from the general point of view. I don't really know enough details of this specific case to form any opinion.
w-j-w 5y ago
ki9 5y ago
Well the reporter didn't "take or use" the SSNs. He found them without looking for them and reported them.
- josefrichter 5y ago
  I don't really know what happened there, but the underlying topic is fascinating.
remram 5y ago
The reporter didn't use it, but signaled it so it could be fixed.

gefhfffh 5y ago

account-5 5y ago

State makes the personal information of state employees freely available to anyone with an internet connection and a web browser. Reporter notices, reports it to the state, waits for it to be fixed, then runs the story. State governor goes after reporter. The state governor is either an idiot, or trying to cover up iltheir incompetence, or both. And doing so in a way that makes him look like more of an idiot. If the prosecutor takes this up then either they're an idiot or being pressured to do so, by the idiot in charge.

gaws 5y ago
> The state governor is either an idiot, or trying to cover up iltheir incompetence, or both. He's both, in addition to trying to "stand up to the fake news" for his voter base.

CoastalCoder 5y ago

Is there a legal defense fund? I'd gladly contribute.

wonderwonder 5y ago

We are very much on the slippery slope of elected officials making prosecutors punish people they don't like. Short hop and a jump to Putin like rule. We are not going in the right direction in the US.

gaws 5y ago
> We are very much on the slippery slope of elected officials making prosecutors punish people they don't like. Are you living under a rock? This has been happening for a while.
- wonderwonder 5y ago
  Appreciate the insult, hope it makes you feel good about yourself.
  - gaws 5y ago
    Makes me sad that you're not the only one.
    - wonderwonder 5y ago
      Have an upvote and a good day :)

agar 5y ago

I find it overly amusing that the article is tagged with "CHRIST WHAT AN ASSHOLE". After clicking through to see other stories with the same tag, it's...apt.

gaws 5y ago
What did you expect? It's BoingBoing. Not really at the pinnacle of American journalism.

SSShupe 5y ago

The HTML document revealed by "view source" isn't something "behind" the web page -- it IS the web page. The State effectively made a document containing the confidential info available to everyone and is now complaining because someone looked at it. I agree with the prior commentators that this is more about politics than law.

kthejoker2 5y ago

From a tort perspective, it seems like the client assumes all the risk of an HTTP request: I made a request for this URI - without (obviously) knowing its contents - and you send me some contents. Even if I as the client attempt to send a malicious payload, etc. the server can transmit back whatever it would like any time - that's the rules of the game. So the server holds all the power, and as long as I got a "200 OK" response with whatever contents you sent me, you have absolved the client of wrongdoing without a much bigger burden of proof of fraud, identity theft, etc... Otherwise, the Internet literally becomes unusable - if even submitting this comment might result in me receiving illegal content, how does one proceed? Sidenote: this is tangentially similar to the CitiGroup Revlon case, where Citi accidentally paid out the full principal on a loan to Revlon to a bunch of small lenders, and the lenders refused to return the money. https://www.npr.org/transcripts/1019909860 https://www.npr.org/transcripts/1019909860 The court ruling is interesting, in that as long as the lenders assumed the money was sent on purpose - that that was the intention of CitiGroup - then there was no reason to send the money back. But if they assumed the money was sent on accident, then it was illegal to keep it. The court ruled that under good faith argumentation ("discharge of value") that if someone owes you money and they pay it back, even "on accident" or otherwise, you have no obligation to return it. And again, it hinged not on the individual case per se but the effect of ruling otherwise - that you could never truly spend money that was sent to you because someone might come later and claw it back, which would just grind the financial industry to a halt. I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them.

badRNG 5y ago
>I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them. Disclaimer: I don't work with web tech, but wouldn't that also permit a lot of activities we would absolutely consider unethical, like SQL injection? It seems like you could certainly craft a request to circumvent security controls to receive a 200 response back that we'd absolutely consider to be unethical.
- kthejoker2 5y ago

jbjbjbjb 5y ago

The lock analogy is completely false. A better analogy is state sending this person a letter with all the social security numbers.

gethoht 5y ago

Ignorance + fascism tends to lead to these kind of results. The stark reality of redhat america.

rboes 5y ago

People really nees to understand web development before they start making analogies. Checking view source is not like unlocking a door.