4 ms·
> If those documents were not supposed to be viewable, the server should reject the request. It certainly should, but it also should be obvious that this was n
by mokus 13y ago
> If those documents were not supposed to be viewable, the server should reject the request.
It certainly should, but it also should be obvious that this was not information that he was authorized to have, and he was prosecuted for intentionally scraping it after noticing the misconfiguration - not for making an HTTP GET request.
The idea that a GET request is like asking a clerk for an item under a counter is appealing, but doesn't really work because granting access is not the same as granting authorization. Authorization requires intent, and an HTTP server is incapable of intent (at this point in history, anyway). The fact that the server can be misconfigured and is fundamentally incapable of realizing it means it makes a lot more sense to think of it as the counter rather than the clerk, and items with 403 responses as items that are under a glass counter. For this same reason, the FOIA request example doesn't work either. A human (or many of them) processes that request.
Additionally, the items he took were not items the store sells, they were clearly items the store should not have out in a public place (so yes, the "store" is absolutely not blameless).
In light of these observations, I think a better analogy is this:
A man walks into a store. He spots a binder on the back counter, just close enough he can reach it without actually stepping behind the front counter. It contains a printout of the store's mailing/cold-calling list that they use for [whatever silly purpose]. The clerk is busy elsewhere, so he starts flipping through it page by page, taking a photo of each one with his smart phone.
Now, I'm still not sure what I think of the legality or morality of the situation, especially when you try to factor in intent. I'm also not a legal professional of any kind, so I know even less about what a court would think about all that. But I do think that these details are relevant, and leaving them out of an analogy creates a false impression that there's nothing even debatable about the situation.
Edited to add: FWIW I do agree that AT&T is very much at fault, mainly for the reasons phaus gave in the comment sibling to yours. I just don't think it is obviously the case that their guilt excuses the person that takes advantage of that negligence.
- macspoofing 13y ago>A man walks into a store. He spots a binder on the back counter,.. Your analogy, for the record is wrong. Completely wrong in fact. But enough with the analogies. We have 20 years of mainstream HTTP usage. We know how it works. Authorization over HTTP is a solved problem and can be done in multitudes of ways, trivially. If he's breaking the law than so is Google millions times over because there are a shit ton of indexed pages that technically Google wasn't authorized to crawl. If your web server is configured to fulfill all anonymous requests, then you are implicitly granting the authorization to access this data. This is the way HTTP was designed. That's the only way this all makes sense, otherwise youtube can change their TOS to make every person who views a video a criminal.
- gamblor956 13y agoIntent intent intent. The analogy of grabbing the binder on the back counter fits perfectly, because it shows the intent. Googlebot is incapable of intent. It is a computer program that simply crawls accessible pages. It cannot distinguish between a website for which access is obviously not intended (i.e., Weev's case of accessing *other people's private information) and a website for which access is intended (i.e., a public Facebook or LinkedIn page).
- nocipher 13y agoSomeone has to use Googlebot though. Google is therefore liable for what it does. Just because a machine or a piece of software is the main actor does not mean there is no culpability. Google is trying to index as much of the web as possible so that it can provide a better service, attract more customers, and make more money from its advertisements. Therefore, the use of a program that scans the web and accesses documents which Google does not have permission to view makes Google responsible for routinely and intentionaly breaking the law. Also, that your tool cannot filter content particularly well does not mean you get a free pass. It means you were negligent. ...or at least that is one way to interpret the law. The law is bad. You can't just say it's illegal when its illegal. It should be as cut-and-dry as possible (e.g. killing someone is always illegal, even when it is an accident a la accidental manslaughter).