3 ms·

> while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever

> while complying with de-facto implementation of rules. If someone leaves their front door unlocked, does that give you permission to enter and take whatever you want? There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works.

3np 3y ago
I didn't and wouldn't go that far. Logging in to a remote server with default credentials and wiping remote data after exfiltration would be a closer example to that than the ones I gave, and to answer the rhetorical question: no. There's a big difference when you start talking about destruction of data for others, faking credentials in interactions with a third-party, and/or knowingly causing remote unavailability. > There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works. What my previous comment is trying to challenge is the rules-for-thee-and-not-for-me dogma which means that publicly exposing private records of others on an unprotected S3 bucket is an oopsie-daisie while an individual doing a request for it risks ending up in jail. https://arstechnica.com/tech-policy/2022/02/missouri-governor-rebuffed-journalist-wont-be-prosecuted-for-viewing-html https://arstechnica.com/tech-policy/2022/02/missouri-governo... > Gov. Parson's office continues to insist that the journalist committed a crime. "The hacking of Missouri teachers' personally identifiable information is a clear violation of Section 569.095, which the state takes seriously." > "It is unlawful to access encoded data and systems in order to examine other people's personal information, and we are coordinating state resources to respond and utilize all legal methods available," Parson said in October. https://en.wikipedia.org/wiki/Ola_Bini https://en.wikipedia.org/wiki/Ola_Bini

3np 3y ago

I didn't and wouldn't go that far. Logging in to a remote server with default credentials and wiping remote data after exfiltration would be a closer example to that than the ones I gave, and to answer the rhetorical question: no. There's a big difference when you start talking about destruction of data for others, faking credentials in interactions with a third-party, and/or knowingly causing remote unavailability. > There is this insane notion that if you can accomplish something in cyber space, then you are allowed to. That's not how society works. What my previous comment is trying to challenge is the rules-for-thee-and-not-for-me dogma which means that publicly exposing private records of others on an unprotected S3 bucket is an oopsie-daisie while an individual doing a request for it risks ending up in jail. https://arstechnica.com/tech-policy/2022/02/missouri-governor-rebuffed-journalist-wont-be-prosecuted-for-viewing-html https://arstechnica.com/tech-policy/2022/02/missouri-governo... > Gov. Parson's office continues to insist that the journalist committed a crime. "The hacking of Missouri teachers' personally identifiable information is a clear violation of Section 569.095, which the state takes seriously." > "It is unlawful to access encoded data and systems in order to examine other people's personal information, and we are coordinating state resources to respond and utilize all legal methods available," Parson said in October. https://en.wikipedia.org/wiki/Ola_Bini https://en.wikipedia.org/wiki/Ola_Bini