5 ms·

Thanks for the illustration: what is considered common behavior in one community is not necessarily considered common behavior in another and today people are d

Thanks for the illustration: what is considered common behavior in one community is not necessarily considered common behavior in another and today people are disagreeing on, among other things, even the definition of fraud (which I agree, "should" be simple) in computer networks. I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. MAC spoofing might help demonstrate mens rea to you, but that is far from universal. I don't care if Google crawls my domains, regardless of the presented user agent, so why should I presume anyone else would? (Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) Why do your presumptions win over my presumptions? We need better reasons than a legislator's "because I said so." If we are to live together, we have to come to a consensus, but at the moment there is a long distance between some pretty inflexible points of view ("just lying").

pbhjpbhj 14y ago
>(Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) // Can you expand on this. It appears you're saying that Google spoofed the origin of their traffic in order to crawl sites? Can you back that assertion up? If you allow Googlebot access using UA then someone identifying as Google in order to gain access they wouldn't otherwise have is clearly unauthorised. We all know this. It's not something [on it's own] that warrants prison time of course. Fraud is gain by deception; simple. If you have to change your apparent identity to avoid being prevented in your acquisition then it's fraud. >MAC spoofing might help demonstrate mens rea to you, but that is far from universal. // Come on lets be adult about this. Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity. Masking identity is of course not normally and generally a crime in itself. So then that repeated use of a service restricted by MAC address, after the intermediate application of MAC alteration doesn't show direct mental application (mens rea) to the task of attaining further access than that which has been authorised ... look I'm not saying he was morally wrong. But aaronsw certainly knew he was acquiring unauthorised access; if it were authorised he wouldn't have needed to hide equipment, spoof MACs, alter IPs to avoid IP blocking and such. He knew and I warrant you do too. It's a shame in many ways he didn't pull it off. >I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. // Where is the appropriation by deception in this?
- Dylan16807 14y ago
  > saying that Google spoofed the origin of their traffic The discussion was about user agents, not origins. >Fraud is gain by deception; simple. The hell it is. Let me give you an actual definition of fraud: * a representation of an existing fact; * its materiality; * its falsity; * the speaker's knowledge of its falsity; * the speaker's intent that it shall be acted upon by the plaintiff; * the plaintiff's ignorance of its falsity; * the plaintiff's reliance on the truth of the representation; * the plaintiff's right to rely upon it; and * consequent damages suffered by the plaintiff. Note in particular that if you don't harm someone there is no fraud.
- vy8vWJlco 14y ago
  TL;DR: Agree to disagree! Google has been known to present as Python-urllib (a generic Python library) with no other references to Google ( http://www.user-agents.org/cgi-bin/csv2html.pl?data=allagents.csv&template=detail.html&match=\bid_n_s_1159\b http://www.user-agents.org/cgi-bin/csv2html.pl?data=allagent... ). Their main bot currently presents itself as Mozilla and various mobile browsers ( http://googlewebmastercentral.blogspot.ca/2011/12/introducing-smartphone-googlebot-mobile.html http://googlewebmastercentral.blogspot.ca/2011/12/introducin... ), and plenty of others, albeit with a parenthetical reference (they used to actually present as Googlebot as the main agent, now they impersonate as the default). http://en.wikipedia.org/wiki/Criticism_of_Google#Cached_data http://en.wikipedia.org/wiki/Criticism_of_Google#Cached_data http://infolab.stanford.edu/~backrub/google.html http://infolab.stanford.edu/~backrub/google.html $$4.3: Crawling the web: It turns out that running a crawler which connects to more than half a million servers, and generates tens of millions of log entries generates a fair amount of email and phone calls. Because of the vast number of people coming on line, there are always those who do not know what a crawler is, because this is the first one they have seen. Almost daily, we receive an email something like, "Wow, you looked at a lot of pages from my web site. How did you like it?" There are also some people who do not know about the robots exclusion protocol, and think their page should be protected from indexing by a statement like, "This page is copyrighted and should not be indexed", which needless to say is difficult for web crawlers to understand. That about sums it up: the laws largely reflect the foot-stamping of non-technical people who wanted copies to be more like apples on a tree and less like reflections in a pool. To be sure, it is possible to commit real crimes using the Internet: securities fraud (real fraud), invasion of privacy, uttering threats, etc, but copying itself should not be criminal. >"I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose." "Where is the appropriation by deception in this?" The deception is of copying as appropriation, which I consider impossible. The appropriation on your part (the royal "you") is 1) the loss of my freedom to surf/access the net using the tools and methods of my choosing (with any user agent string or MAC I want, or by scanning an IP block, or by sending a multicast packet), and 2) your gain of copies as a store of value. "Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity." No, I am saying a MAC was not an identity to begin with. Sites use technical means to limit some access, while usually leaving others open (there has to be some way for users to get at the bits). Why should anyone assume those means left open shouldn't simply be used instead? (The discriminator could have discriminated further, to an arbitrary degree, since the rules only exist in software.) Again, it boils down to your definition of "unauthorized" which is defined firmly in one camp (not that copy, it's mine!) and equally firmly but very differently in another camp (copying is easy; copying will always be easy). The people who regularly apply access controls and maintain the networks largely assume other people could too, if they wanted to, so what feels like "security" for one person (a MAC address) isn't considered "security" for others. (I'm not speculating about Aaron's views, I'm talking about mine. I agree, I don't think he did anything wrong.) The general feeling is one of all-or-nothing access amongst those who define the locks; part of the hacker/inquisitive mindset is not wanting there to be any locks they can't bypass. That lock analogy is problematic. Using an elaborate means to copy is not the same as breaking into a building by climbing through a window. Copying (looking) doesn't cause bodily harm or deprivation, and so is not fraud. Lots of people want to claim it can cause financial harm, but I don't buy that one either. Non-commercial copyright infringement is basically free advertising: the sort of word-of-mouth you pay through the nose for. Paying up-front for a copy is absurd; you pay after you hear the minstrel, and you only pay if you liked the music. You can stop playing music for me, but you can't, with accuracy, call me a thief for listening or not paying. Keep in mind I'm describing what I think should be, not what I think the laws are. You are free to disagree, but this is the context for my comments. The Internet was, and is, and remains a copying (looking) free-for-all, where code is law. That doesn't make it a wild west that needs to be civilized either - there's nothing to civilize in the absence of copyright. It doesn't mean we have to pull in property and theft analogies... This is still exclusively about copying. As little as 10 years ago we all thought copying would bring some kind of digital salvation: access to all human knowledge. (Enter Wikipedia...) Turns out we want to monetize copying instead, so we are reducing individual freedoms and access rights. Yes, reducing. Give me a break. (For the sake of keeping up with your exasperations.) I already pay my ISP for the link. The copying is implied. Copying is only scary because you don't know the person doing it - but they aren't doing it to you; copying isn't an injury. I run an SSH server, and I prevent access to it as well. I also run a wireless access point with a pretty simple password. I don't care if someone uses the wireless if they find the password. Good on them. If they use it to commit a crime I do, but using it is not the crime. Similarly, if they find the password to the SSH server, also good for them; if they find the password to the SSH server and commit an actual crime, then there will be charges (though not from me unless I was the victim), but looking onto a property (a physical computer) is not a crime. You have to forget about that if you want to monetize information, but that's why there's a lack of common ground between the two camps: there's no property to speak of. Admittedly, there are a number of laws based on the idea that copying should be illegal (copyright as an obvious example). I'm not ignorant of them, but I challenge them. (Granted, I probably wouldn't be willing to put myself in Aaron's situation to challenge them.) I think they can only be enforced at the cost of physical ownership rights and I'm a "law-as-code" kind of guy. I want to be able to believe that if someone didn't want me to copy something, I wouldn't be able to copy it, or I at least want us to admit that making a copy can't actually hurt someone (the copy itself, not what you might proceed to do with it).

pbhjpbhj 14y ago

>(Google didn't start by presenting themselves as Googlebot... They committed your definition of fraud.) // Can you expand on this. It appears you're saying that Google spoofed the origin of their traffic in order to crawl sites? Can you back that assertion up? If you allow Googlebot access using UA then someone identifying as Google in order to gain access they wouldn't otherwise have is clearly unauthorised. We all know this. It's not something [on it's own] that warrants prison time of course. Fraud is gain by deception; simple. If you have to change your apparent identity to avoid being prevented in your acquisition then it's fraud. >MAC spoofing might help demonstrate mens rea to you, but that is far from universal. // Come on lets be adult about this. Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity. Masking identity is of course not normally and generally a crime in itself. So then that repeated use of a service restricted by MAC address, after the intermediate application of MAC alteration doesn't show direct mental application (mens rea) to the task of attaining further access than that which has been authorised ... look I'm not saying he was morally wrong. But aaronsw certainly knew he was acquiring unauthorised access; if it were authorised he wouldn't have needed to hide equipment, spoof MACs, alter IPs to avoid IP blocking and such. He knew and I warrant you do too. It's a shame in many ways he didn't pull it off. >I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose. // Where is the appropriation by deception in this?

Dylan16807 14y ago
> saying that Google spoofed the origin of their traffic The discussion was about user agents, not origins. >Fraud is gain by deception; simple. The hell it is. Let me give you an actual definition of fraud: * a representation of an existing fact; * its materiality; * its falsity; * the speaker's knowledge of its falsity; * the speaker's intent that it shall be acted upon by the plaintiff; * the plaintiff's ignorance of its falsity; * the plaintiff's reliance on the truth of the representation; * the plaintiff's right to rely upon it; and * consequent damages suffered by the plaintiff. Note in particular that if you don't harm someone there is no fraud.
vy8vWJlco 14y ago
TL;DR: Agree to disagree! Google has been known to present as Python-urllib (a generic Python library) with no other references to Google ( http://www.user-agents.org/cgi-bin/csv2html.pl?data=allagents.csv&template=detail.html&match=\bid_n_s_1159\b http://www.user-agents.org/cgi-bin/csv2html.pl?data=allagent... ). Their main bot currently presents itself as Mozilla and various mobile browsers ( http://googlewebmastercentral.blogspot.ca/2011/12/introducing-smartphone-googlebot-mobile.html http://googlewebmastercentral.blogspot.ca/2011/12/introducin... ), and plenty of others, albeit with a parenthetical reference (they used to actually present as Googlebot as the main agent, now they impersonate as the default). http://en.wikipedia.org/wiki/Criticism_of_Google#Cached_data http://en.wikipedia.org/wiki/Criticism_of_Google#Cached_data http://infolab.stanford.edu/~backrub/google.html http://infolab.stanford.edu/~backrub/google.html $$4.3: Crawling the web: It turns out that running a crawler which connects to more than half a million servers, and generates tens of millions of log entries generates a fair amount of email and phone calls. Because of the vast number of people coming on line, there are always those who do not know what a crawler is, because this is the first one they have seen. Almost daily, we receive an email something like, "Wow, you looked at a lot of pages from my web site. How did you like it?" There are also some people who do not know about the robots exclusion protocol, and think their page should be protected from indexing by a statement like, "This page is copyrighted and should not be indexed", which needless to say is difficult for web crawlers to understand. That about sums it up: the laws largely reflect the foot-stamping of non-technical people who wanted copies to be more like apples on a tree and less like reflections in a pool. To be sure, it is possible to commit real crimes using the Internet: securities fraud (real fraud), invasion of privacy, uttering threats, etc, but copying itself should not be criminal. >"I could just as easily argue it's fraud to restrict any copying via a network that functions for that purpose." "Where is the appropriation by deception in this?" The deception is of copying as appropriation, which I consider impossible. The appropriation on your part (the royal "you") is 1) the loss of my freedom to surf/access the net using the tools and methods of my choosing (with any user agent string or MAC I want, or by scanning an IP block, or by sending a multicast packet), and 2) your gain of copies as a store of value. "Are you really claiming that people don't change MAC address in order to avoid being identified with previous use under a particular MAC address, that it's not solely to mask identity." No, I am saying a MAC was not an identity to begin with. Sites use technical means to limit some access, while usually leaving others open (there has to be some way for users to get at the bits). Why should anyone assume those means left open shouldn't simply be used instead? (The discriminator could have discriminated further, to an arbitrary degree, since the rules only exist in software.) Again, it boils down to your definition of "unauthorized" which is defined firmly in one camp (not that copy, it's mine!) and equally firmly but very differently in another camp (copying is easy; copying will always be easy). The people who regularly apply access controls and maintain the networks largely assume other people could too, if they wanted to, so what feels like "security" for one person (a MAC address) isn't considered "security" for others. (I'm not speculating about Aaron's views, I'm talking about mine. I agree, I don't think he did anything wrong.) The general feeling is one of all-or-nothing access amongst those who define the locks; part of the hacker/inquisitive mindset is not wanting there to be any locks they can't bypass. That lock analogy is problematic. Using an elaborate means to copy is not the same as breaking into a building by climbing through a window. Copying (looking) doesn't cause bodily harm or deprivation, and so is not fraud. Lots of people want to claim it can cause financial harm, but I don't buy that one either. Non-commercial copyright infringement is basically free advertising: the sort of word-of-mouth you pay through the nose for. Paying up-front for a copy is absurd; you pay after you hear the minstrel, and you only pay if you liked the music. You can stop playing music for me, but you can't, with accuracy, call me a thief for listening or not paying. Keep in mind I'm describing what I think should be, not what I think the laws are. You are free to disagree, but this is the context for my comments. The Internet was, and is, and remains a copying (looking) free-for-all, where code is law. That doesn't make it a wild west that needs to be civilized either - there's nothing to civilize in the absence of copyright. It doesn't mean we have to pull in property and theft analogies... This is still exclusively about copying. As little as 10 years ago we all thought copying would bring some kind of digital salvation: access to all human knowledge. (Enter Wikipedia...) Turns out we want to monetize copying instead, so we are reducing individual freedoms and access rights. Yes, reducing. Give me a break. (For the sake of keeping up with your exasperations.) I already pay my ISP for the link. The copying is implied. Copying is only scary because you don't know the person doing it - but they aren't doing it to you; copying isn't an injury. I run an SSH server, and I prevent access to it as well. I also run a wireless access point with a pretty simple password. I don't care if someone uses the wireless if they find the password. Good on them. If they use it to commit a crime I do, but using it is not the crime. Similarly, if they find the password to the SSH server, also good for them; if they find the password to the SSH server and commit an actual crime, then there will be charges (though not from me unless I was the victim), but looking onto a property (a physical computer) is not a crime. You have to forget about that if you want to monetize information, but that's why there's a lack of common ground between the two camps: there's no property to speak of. Admittedly, there are a number of laws based on the idea that copying should be illegal (copyright as an obvious example). I'm not ignorant of them, but I challenge them. (Granted, I probably wouldn't be willing to put myself in Aaron's situation to challenge them.) I think they can only be enforced at the cost of physical ownership rights and I'm a "law-as-code" kind of guy. I want to be able to believe that if someone didn't want me to copy something, I wouldn't be able to copy it, or I at least want us to admit that making a copy can't actually hurt someone (the copy itself, not what you might proceed to do with it).