4 ms·
I was addressing your ideas, not you. But everything you say comes with an aura of wizard and that's why I'm taking issue to you saying things that would merely
by wnight 14y ago
I was addressing your ideas, not you. But everything you say comes with an aura of wizard and that's why I'm taking issue to you saying things that would merely be opinion from someone else.
The idea that incrementing a URL is hacking goes against the designing principles of the web. Intended behavior isn't hacking. By either definition. Telling people that this is special creates a culture of ignorance where they think there's magic under the hood and never try to learn.
The idea that URL manipulation is hacking is factually incorrect and you hurt people by saying it.
This doesn't mean it's not an exploit, depending on circumstances. Many exploits don't require hacking. For instance, item cloning in a mmorpg. That something is exploitable doesn't mean you need to hack it. A "take a penny" dish is exploitable but taking the pennies isn't hacking.
As for emotional arguments, you responded to me with one. I know many sites do things their maintainers wouldn't want them to do, but sympathy doesn't justify bad laws.
I'm not arguing for decriminalization of hacking, but that this isn't hacking.
- tptacek 14y agoI feel like I was pretty clear, so I'm puzzled by this response. Let me distill my last comment. There are applications with human-readable URL schemes that will, with trivial manipulation of URLs, cough up arbitrary files from the server filesystem. Are those URLs OK to play with because of the "design principles of the web"?
- wnight 14y agoPlaying with those URLs is not hacking, even if it was illegal. Trying a key in a door isn't lock-picking, trying an obvious URL isn't hacking.
- tptacek 14y agoIf you get caught by a cop opening my unlocked front door, or trying random keys in it, you will sure as shit be arrested for B&E.
- wnight 14y agoBut not lock-picking. Why are you trying so hard to label this hacking? Earlier you argued by fear, that a badly configured server could send private data, and therefore editing URLs is hacking. Hell, I've seen servers with private data in the root dir. This is disconcerting, and bad for the company, but not hacking if you view the documents. Similarly, incrementing as number, turning a page, clicking next, those are the expected, default, uses. They don't magically become a cyber attack simply because your software does exactly what you told it to. Why are you unwilling to separate questions of legality long enough to make it clear that anyone in the world who can place one number after another could have done exactly the same? Someone who unintentionally released private documents but thought they were hacked wouldn't have any incentive to change, or idea how. But if we were honest with them, they would.
- deleted 14y ago[deleted]