4 ms·

> I send requests to other machines and ask them for stuff and whether they respond or not is on them. So by this logic, SQL injection is perfectly fine? RCE i

> I send requests to other machines and ask them for stuff and whether they respond or not is on them. So by this logic, SQL injection is perfectly fine? RCE is perfectly acceptable too? After all, my machine is just asking for stuff and the other machine is responding in a way its code tells it to. The open door analogy fits pretty well here, really. Just because you see an opening doesn’t mean you’re allowed in.

makerofthings 5y ago
I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine. [ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ]
- dylan604 5y ago
  >I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine With you so far... >[ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ] WTF?! Seriously? There's a huge difference by tweaking the content in a query string of a URL vs injecting known malicious code/content.
  - makerofthings 5y ago
    Yes, seriously, and I have thought about this a lot. I appreciate it’s not a popular position and I’m not likely to win any debates on the topic. If a computer is voluntarily connected to the internet then it’s there to explore and there should be no penalties for getting into those machines and looking around by connecting remotely. Malicious outcomes in the real world, obviously this is different. Hack in, look around, fine. Hack in, explode powerstation, not fine.
    - SpikedCola 5y ago
      I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then dumping all the data and exorting the company with it, should definitely be.
    - bentcorner 5y ago
      > Malicious outcomes in the real world, obviously this is different. I definitely agree with you on this point. If someone looked in my window from the street and saw me eating breakfast, no harm no foul. If I didn't want them to see me I should have closed the blinds. But if someone sets up a camera at the exact same spot and streams it to twitch, I feel like I should have some recourse. (I don't think, legally, I would, but ianal).
yeetsfromhellL2 5y ago
This is silly. It was a publicly accessible URL. A better analogy would be leaving your window blinds open and being upset that your neighbors can see you inside your home. Your neighbors aren't at fault, you are, and you can face criminal charges if you do something lewd inside your home while visible from public property. AT&T is completely at fault here for publicly distributing private info.
- strulovich 5y ago
  For an analogy who went all the way up to the Supreme Court see: https://news.artnet.com/market/arne-svenson-neighbors-photographs-supreme-court-286916/amp-page https://news.artnet.com/market/arne-svenson-neighbors-photog...
  - yeetsfromhellL2 5y ago
    This woman was not guilty after doing this with special equipment, a telephoto lens(!). There was also that guy in another case sitting in his kitchen naked while drinking coffee and reading the morning paper. Some woman decides to walk into his back yard with her kid, sees him, and called the police on him for indecency...it took years for him to get let off and cost him a ton of money to not get any penalties. He was nearly held liable for what someone saw inside his house when they had to be trespassing to see it!
  - simiones 5y ago
    This case should be held up as a troubling indictment of current legislation, not held up as an example of freedom of expression. It also happens to be irrelevant to the case above, as it seems to have been specifically decided on the merits of the photographs as Art. It would be hard to claim that leaking the emails to Gawker was a form of art, so it may well have ended up differently.
    - ascagnel_ 5y ago
      Another major difference is that Svenson intentionally omitted faces, so determining identity is very difficult. Leaking emails to Gawker for users' AT&T accounts is partially identifying its users, so it could even be considered a hostile action (against either AT&T, its customers, or both).
djbebs 5y ago
In general, yes, absolutely.

makerofthings 5y ago

I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine. [ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ]

dylan604 5y ago
>I still disagree. Those other systems are not the web. If i can look at a url and get your secret data, that’s on you. I think the other reply who gave the analogy of leaving the blinds open was a better one than mine With you so far... >[ and just off-topic slightly, yes, I think RCE and SQL injection are perfectly fine. ] WTF?! Seriously? There's a huge difference by tweaking the content in a query string of a URL vs injecting known malicious code/content.
- makerofthings 5y ago
  Yes, seriously, and I have thought about this a lot. I appreciate it’s not a popular position and I’m not likely to win any debates on the topic. If a computer is voluntarily connected to the internet then it’s there to explore and there should be no penalties for getting into those machines and looking around by connecting remotely. Malicious outcomes in the real world, obviously this is different. Hack in, look around, fine. Hack in, explode powerstation, not fine.
  - SpikedCola 5y ago
    I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then dumping all the data and exorting the company with it, should definitely be.
  - bentcorner 5y ago
    > Malicious outcomes in the real world, obviously this is different. I definitely agree with you on this point. If someone looked in my window from the street and saw me eating breakfast, no harm no foul. If I didn't want them to see me I should have closed the blinds. But if someone sets up a camera at the exact same spot and streams it to twitch, I feel like I should have some recourse. (I don't think, legally, I would, but ianal).

yeetsfromhellL2 5y ago

This is silly. It was a publicly accessible URL. A better analogy would be leaving your window blinds open and being upset that your neighbors can see you inside your home. Your neighbors aren't at fault, you are, and you can face criminal charges if you do something lewd inside your home while visible from public property. AT&T is completely at fault here for publicly distributing private info.

strulovich 5y ago
For an analogy who went all the way up to the Supreme Court see: https://news.artnet.com/market/arne-svenson-neighbors-photographs-supreme-court-286916/amp-page https://news.artnet.com/market/arne-svenson-neighbors-photog...
- yeetsfromhellL2 5y ago
  This woman was not guilty after doing this with special equipment, a telephoto lens(!). There was also that guy in another case sitting in his kitchen naked while drinking coffee and reading the morning paper. Some woman decides to walk into his back yard with her kid, sees him, and called the police on him for indecency...it took years for him to get let off and cost him a ton of money to not get any penalties. He was nearly held liable for what someone saw inside his house when they had to be trespassing to see it!
- simiones 5y ago
  This case should be held up as a troubling indictment of current legislation, not held up as an example of freedom of expression. It also happens to be irrelevant to the case above, as it seems to have been specifically decided on the merits of the photographs as Art. It would be hard to claim that leaking the emails to Gawker was a form of art, so it may well have ended up differently.
  - ascagnel_ 5y ago
    Another major difference is that Svenson intentionally omitted faces, so determining identity is very difficult. Leaking emails to Gawker for users' AT&T accounts is partially identifying its users, so it could even be considered a hostile action (against either AT&T, its customers, or both).

djbebs 5y ago

In general, yes, absolutely.