6 ms·

Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the UR

Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)

rayiner 14y ago
It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.
- doppel 14y ago
  Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
  - jerf 14y ago
    I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
    - sneak 14y ago
      It also spoofed the user-agent of an iPad. Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.
      - fnordfnordfnord 14y ago
        I use a spoofed user agent all of the time.
    - alxndr 14y ago
      > However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. What if you did it by hand? Where's the line between what's ok and what's not?
      - rayiner 14y ago
        Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script? If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?
        wnight 14y ago
        It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".
    - warfangle 14y ago
- ghshephard 14y ago
  Okay, fair enough - so instead of Article URLs, I started typing names: https://news.ycombinator.com/user?id=paulgraham https://news.ycombinator.com/user?id=RHashem https://news.ycombinator.com/user?id=RayinerHashem To see if I could get any personal information like email addresses, profile information, etc... What if instead of usernames, they were simply integers - I.E. https://news.ycombinator.com/user?id=000001 https://news.ycombinator.com/user?id=000001, https://news.ycombinator.com/user?id=000002 https://news.ycombinator.com/user?id=000002, etc... Was that unauthorized? How about illegal? Seriously - I think Weev is a complete Troll, and he was totally hacking AT&T - but I don't think his actions came anywhere close to criminal. I"m really happy to hear he has competent representation.
- fnordfnordfnord 14y ago
  A list of a bunch of hashes of an email address and some sort of ID number? Sounds like a "White Pages" to me.
- lifeisstillgood 14y ago
  Honestly I am struggling to think of an action that is ok to do once but illegal to repeat a thousand times - you make it sound like the bad businessmans theory - we make a loss on each item but make up for it in volume
  - rayiner 14y ago
    Try dumping one coke can on someone's yard versus 10,000.
    - fnordfnordfnord 14y ago
      Do you want my physical address. I'll take your 10,000 aluminum cans.
      - mpyne 14y ago
        Not cans. The contents of the cans.
        fnordfnordfnord 14y ago
        In that case, either one may be littering, vandalism, or property destruction. While it would be wasteful and silly to pursue a prosecution for one occurrence, a single occurrence is still a crime.
        mpyne 14y ago
        Let's go to the logical extreme then: Is dripping one solitary drop of soda the exact same crime as inundating your yard continuously with soda for, say, 24 hours?
    - flyinRyan 14y ago
      Hilarious example, since both would involve trespassing and destruction of property. It's just that 10k would be enough to have it perused and one likely wouldn't.
- flyinRyan 14y ago
  Please tell me you're not in any powerful political position. You sound exactly like the kind of evil people in charge who are finding new ways to arrest people for things that weren't illegal before hand.
res0nat0r 14y ago
I'm curious as to why most technical issues on HN involving the law come down to silly black or white viewpoints? I thought this audience would be sophisticated enough to know that this type of thing isn't a binary either/or issue. Are you purposefully ignoring the fact that the law relies on context to determine if you are acting in good faith or not? Or is everyone who reduces this issue to an either/or position doing so purposefully just because they hate the fact that there is nuance to the law which is much more subtle than the science most of us are schooled in?
- ghshephard 14y ago
  I'm not sure if you are responding to me or not - tough to tell from the indent - but, I really am interested in people's viewpoints - no ulterior motive here. Some people would say typing in their own article ID values into a URL bar is unauthorized, but not illegal. Some people would say that typing username ID values to get personal email addresses, is unauthorized, but probably not illegal. Some people might say writing a script to enter all combinations of userids to get username/email addresses on HN is illegal, but probably not a felony. I was genuinely interested in hearing what people had to say, as I trust our audience here, and let their opinions shape mine.

Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)

rayiner 14y ago

It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.

doppel 14y ago
Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
- jerf 14y ago
  I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
  - sneak 14y ago
    It also spoofed the user-agent of an iPad. Still, it made a request to a webserver, and the webserver gave up the data. That's not the requester's fault.
    - fnordfnordfnord 14y ago
      I use a spoofed user agent all of the time.
  - alxndr 14y ago
    > However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. What if you did it by hand? Where's the line between what's ok and what's not?
    - rayiner 14y ago
      Ultimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script? If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?
      - wnight 14y ago
        It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".
  - warfangle 14y ago
ghshephard 14y ago
Okay, fair enough - so instead of Article URLs, I started typing names: https://news.ycombinator.com/user?id=paulgraham https://news.ycombinator.com/user?id=RHashem https://news.ycombinator.com/user?id=RayinerHashem To see if I could get any personal information like email addresses, profile information, etc... What if instead of usernames, they were simply integers - I.E. https://news.ycombinator.com/user?id=000001 https://news.ycombinator.com/user?id=000001, https://news.ycombinator.com/user?id=000002 https://news.ycombinator.com/user?id=000002, etc... Was that unauthorized? How about illegal? Seriously - I think Weev is a complete Troll, and he was totally hacking AT&T - but I don't think his actions came anywhere close to criminal. I"m really happy to hear he has competent representation.
fnordfnordfnord 14y ago
A list of a bunch of hashes of an email address and some sort of ID number? Sounds like a "White Pages" to me.
lifeisstillgood 14y ago
Honestly I am struggling to think of an action that is ok to do once but illegal to repeat a thousand times - you make it sound like the bad businessmans theory - we make a loss on each item but make up for it in volume
- rayiner 14y ago
  Try dumping one coke can on someone's yard versus 10,000.
  - fnordfnordfnord 14y ago
    Do you want my physical address. I'll take your 10,000 aluminum cans.
    - mpyne 14y ago
      Not cans. The contents of the cans.
      - fnordfnordfnord 14y ago
        In that case, either one may be littering, vandalism, or property destruction. While it would be wasteful and silly to pursue a prosecution for one occurrence, a single occurrence is still a crime.
        mpyne 14y ago
        Let's go to the logical extreme then: Is dripping one solitary drop of soda the exact same crime as inundating your yard continuously with soda for, say, 24 hours?
  - flyinRyan 14y ago
    Hilarious example, since both would involve trespassing and destruction of property. It's just that 10k would be enough to have it perused and one likely wouldn't.
flyinRyan 14y ago
Please tell me you're not in any powerful political position. You sound exactly like the kind of evil people in charge who are finding new ways to arrest people for things that weren't illegal before hand.

res0nat0r 14y ago

I'm curious as to why most technical issues on HN involving the law come down to silly black or white viewpoints? I thought this audience would be sophisticated enough to know that this type of thing isn't a binary either/or issue. Are you purposefully ignoring the fact that the law relies on context to determine if you are acting in good faith or not? Or is everyone who reduces this issue to an either/or position doing so purposefully just because they hate the fact that there is nuance to the law which is much more subtle than the science most of us are schooled in?

ghshephard 14y ago
I'm not sure if you are responding to me or not - tough to tell from the indent - but, I really am interested in people's viewpoints - no ulterior motive here. Some people would say typing in their own article ID values into a URL bar is unauthorized, but not illegal. Some people would say that typing username ID values to get personal email addresses, is unauthorized, but probably not illegal. Some people might say writing a script to enter all combinations of userids to get username/email addresses on HN is illegal, but probably not a felony. I was genuinely interested in hearing what people had to say, as I trust our audience here, and let their opinions shape mine.