3 ms·

HTTP statuses are not a semantic description. `200 OK` means only that the transfer of a document can take place -- the legality of the request is a different m

HTTP statuses are not a semantic description. `200 OK` means only that the transfer of a document can take place -- the legality of the request is a different matter. This would be like holding DOT engineers responsible for making it possible to drive drunk, since the roads have no features to prevent offenders from entering the highway.

maxerickson 14y ago
Your analogy is extreme. A better one might be having a section of road connected to public roads that it is illegal to drive on. This is still hugely problematic, because it invites discussion of the intent of the operator and the intent of the driver and ignores the part where it is not particularly difficult to put up an effective barrier.
AnthonyMouse 14y ago
>`200 OK` means only that the transfer of a document can take place -- the legality of the request is a different matter. This would be like holding DOT engineers responsible for making it possible to drive drunk, since the roads have no features to prevent offenders from entering the highway. You're confusing violating a law with violating the law. If getting "200 OK" means you were authorized and can't be convicted of unauthorized access to a computer, but you proceed to purloin credit card numbers and make fraudulent charges to them, you're still going to jail for credit card fraud. The real issue is that "unauthorized access" is hopelessly ambiguous if you don't use the likes of protocol status codes, and totally redundant if you do. If you get "200 OK" then you haven't made unauthorized access because you were authorized. If you get "403 FORBIDDEN" then you haven't made unauthorized access because you were denied access. That interpretation makes "unauthorized access" impossible to achieve, because if access is denied then there is no access to be unauthorized and if access is granted then it is authorized access. The trouble is that the alternative interpretation is even worse: If you can't rely on what the machine tells you, how do you know when you're authorized? Some cases are really obvious (e.g. you are not authorized to places orders against just any random customer's credit card), but those situations are pretty much always separately illegal regardless of unauthorized access. What that leaves is the hopelessly ambiguous cases, which is what allows prosecutors to argue that violating terms of service or downloading too many journal articles is a federal felony. I'm still not convinced that those cases need to be illegal at all -- and if you can articulate a specific one that ought to be then by all means prohibit it explicitly and stop with the blanket prohibitions on whatever "unauthorized access" is supposed to mean if it doesn't mean what the machine allows you to do.
- deleted 14y ago
  [deleted]

maxerickson 14y ago

Your analogy is extreme. A better one might be having a section of road connected to public roads that it is illegal to drive on. This is still hugely problematic, because it invites discussion of the intent of the operator and the intent of the driver and ignores the part where it is not particularly difficult to put up an effective barrier.

AnthonyMouse 14y ago

>`200 OK` means only that the transfer of a document can take place -- the legality of the request is a different matter. This would be like holding DOT engineers responsible for making it possible to drive drunk, since the roads have no features to prevent offenders from entering the highway. You're confusing violating a law with violating the law. If getting "200 OK" means you were authorized and can't be convicted of unauthorized access to a computer, but you proceed to purloin credit card numbers and make fraudulent charges to them, you're still going to jail for credit card fraud. The real issue is that "unauthorized access" is hopelessly ambiguous if you don't use the likes of protocol status codes, and totally redundant if you do. If you get "200 OK" then you haven't made unauthorized access because you were authorized. If you get "403 FORBIDDEN" then you haven't made unauthorized access because you were denied access. That interpretation makes "unauthorized access" impossible to achieve, because if access is denied then there is no access to be unauthorized and if access is granted then it is authorized access. The trouble is that the alternative interpretation is even worse: If you can't rely on what the machine tells you, how do you know when you're authorized? Some cases are really obvious (e.g. you are not authorized to places orders against just any random customer's credit card), but those situations are pretty much always separately illegal regardless of unauthorized access. What that leaves is the hopelessly ambiguous cases, which is what allows prosecutors to argue that violating terms of service or downloading too many journal articles is a federal felony. I'm still not convinced that those cases need to be illegal at all -- and if you can articulate a specific one that ought to be then by all means prohibit it explicitly and stop with the blanket prohibitions on whatever "unauthorized access" is supposed to mean if it doesn't mean what the machine allows you to do.

deleted 14y ago
[deleted]