4 ms·

So: MAC spoofing doesn't really help prove mens rea (that Aaron thought he was trespassing, but did so anyways). From another comment: "People fear magic they d

So: MAC spoofing doesn't really help prove mens rea (that Aaron thought he was trespassing, but did so anyways). From another comment: "People fear magic they don't understand, and distrust those who wield that magic. Things that seem reasonable to technical geeks seem illegal to the non-technical." ( http://news.ycombinator.com/item?id=5067146 http://news.ycombinator.com/item?id=5067146 ) There is a chasm between what "normal"/non-tech people might consider proof of mens rea (and probably explains some of the history of the laws) and what technical people would consider proof. Technical people do stuff like MAC spoofing all the time, as in the article. I run Tor because I can always reach my SSH server as a hidden service, even through firewalls. I strip my HTTP headers with an HTTP proxy because I don't like having to constantly configure all my browsers to throw out adnet cookies. I set curl and wget to spoof a more common user agent, because some things simply don't work otherwise. This sort of remedial stuff literally scares non-tech people, and having to constantly explain and justify such network magic to anyone who doesn't know how technology and networks work just to make them feel better is tantamount to bending over for a TSA screening because you're brown (OK, not quite that bad). It's increasingly demoralizing, and doesn't feel like freedom in a supposedly free country (Canada). I have nothing to hide; I'm still not willing to bend over like that. No one should. It's the new McCarthyism. Lawmakers and non-techs are afraid of us, and so we're treated differently, and it's becoming scarier (just because SOPA was stopped in one country doesn't mean there won't be more). I don't want to work to help people who fear my knowledge rather than celebrate it and, while I hardly think "web apps" represent anything like the future of the Internet, I'm a little afraid to work on much else if I intended to release it. (The person who made bitcoin didn't want his identity on it.) We're already paying the price.

pbhjpbhj 14y ago
>Technical people do stuff like MAC spoofing all the time, as in the article. // Yes to gain access to material they are not authorised to access, for example. >I set curl and wget to spoof a more common user agent, because some things simply don't work otherwise. // But you know that spoofing a useragent, eg Googlebots, to crawl a domain is unauthorised access. You do. From what I've read recently Aaron Swartz was quite brilliant. He also appears to have acted morally in attempting to free JSTOR data (IMO a noble cause), but I very much doubt he was so naive as to believe he was acting legally in doing so. It seems to me to require suspension of rational thought to come to this conclusion. MAC spoofing does really help prove mens rea. Authorisation was restricted to content based on MAC; a person spoofed MACs to gain access, that person knew that spoofing MAC was something that would gain access that wasn't authorised. An analogy: If someone is offering free samples in the street, you may well be able to get lots of free samples by wearing different disguises, you may even be giving the samples to the needy, but claiming you didn't appropriate those samples by deception (ie fraud) is just lying.
- vy8vWJlco 14y ago
  Thanks for the illustration: what is considered common behavior in one community is not necessarily considered common behavior in another and today people are disagreeing on, among other things, even the definition of fraud (which I agree, "should" be simple) in computer networks. I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. MAC spoofing might help demonstrate mens rea to you, but that is far from universal. I don't care if Google crawls my domains, regardless of the presented user agent, so why should I presume anyone else would? (Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) Why do your presumptions win over my presumptions? We need better reasons than a legislator's "because I said so." If we are to live together, we have to come to a consensus, but at the moment there is a long distance between some pretty inflexible points of view ("just lying").
  - pbhjpbhj 14y ago
    >(Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) // Can you expand on this. It appears you're saying that Google spoofed the origin of their traffic in order to crawl sites? Can you back that assertion up? If you allow Googlebot access using UA then someone identifying as Google in order to gain access they wouldn't otherwise have is clearly unauthorised. We all know this. It's not something [on it's own] that warrants prison time of course. Fraud is gain by deception; simple. If you have to change your apparent identity to avoid being prevented in your acquisition then it's fraud. >MAC spoofing might help demonstrate mens rea to you, but that is far from universal. // Come on lets be adult about this. Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity. Masking identity is of course not normally and generally a crime in itself. So then that repeated use of a service restricted by MAC address, after the intermediate application of MAC alteration doesn't show direct mental application (mens rea) to the task of attaining further access than that which has been authorised ... look I'm not saying he was morally wrong. But aaronsw certainly knew he was acquiring unauthorised access; if it were authorised he wouldn't have needed to hide equipment, spoof MACs, alter IPs to avoid IP blocking and such. He knew and I warrant you do too. It's a shame in many ways he didn't pull it off. >I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. // Where is the appropriation by deception in this?

pbhjpbhj 14y ago

>Technical people do stuff like MAC spoofing all the time, as in the article. // Yes to gain access to material they are not authorised to access, for example. >I set curl and wget to spoof a more common user agent, because some things simply don't work otherwise. // But you know that spoofing a useragent, eg Googlebots, to crawl a domain is unauthorised access. You do. From what I've read recently Aaron Swartz was quite brilliant. He also appears to have acted morally in attempting to free JSTOR data (IMO a noble cause), but I very much doubt he was so naive as to believe he was acting legally in doing so. It seems to me to require suspension of rational thought to come to this conclusion. MAC spoofing does really help prove mens rea. Authorisation was restricted to content based on MAC; a person spoofed MACs to gain access, that person knew that spoofing MAC was something that would gain access that wasn't authorised. An analogy: If someone is offering free samples in the street, you may well be able to get lots of free samples by wearing different disguises, you may even be giving the samples to the needy, but claiming you didn't appropriate those samples by deception (ie fraud) is just lying.

vy8vWJlco 14y ago
Thanks for the illustration: what is considered common behavior in one community is not necessarily considered common behavior in another and today people are disagreeing on, among other things, even the definition of fraud (which I agree, "should" be simple) in computer networks. I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. MAC spoofing might help demonstrate mens rea to you, but that is far from universal. I don't care if Google crawls my domains, regardless of the presented user agent, so why should I presume anyone else would? (Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) Why do your presumptions win over my presumptions? We need better reasons than a legislator's "because I said so." If we are to live together, we have to come to a consensus, but at the moment there is a long distance between some pretty inflexible points of view ("just lying").
- pbhjpbhj 14y ago
  >(Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) // Can you expand on this. It appears you're saying that Google spoofed the origin of their traffic in order to crawl sites? Can you back that assertion up? If you allow Googlebot access using UA then someone identifying as Google in order to gain access they wouldn't otherwise have is clearly unauthorised. We all know this. It's not something [on it's own] that warrants prison time of course. Fraud is gain by deception; simple. If you have to change your apparent identity to avoid being prevented in your acquisition then it's fraud. >MAC spoofing might help demonstrate mens rea to you, but that is far from universal. // Come on lets be adult about this. Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity. Masking identity is of course not normally and generally a crime in itself. So then that repeated use of a service restricted by MAC address, after the intermediate application of MAC alteration doesn't show direct mental application (mens rea) to the task of attaining further access than that which has been authorised ... look I'm not saying he was morally wrong. But aaronsw certainly knew he was acquiring unauthorised access; if it were authorised he wouldn't have needed to hide equipment, spoof MACs, alter IPs to avoid IP blocking and such. He knew and I warrant you do too. It's a shame in many ways he didn't pull it off. >I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. // Where is the appropriation by deception in this?