4 ms·
If you ask the librarian to hold a book-burning party, and they do, should you get off scott-free?
by jlgreco 13y ago
If you ask the librarian to hold a book-burning party, and they do, should you get off scott-free?
- mintplant 13y agoNot if I tricked the librarian into setting fire to the library.
- jlgreco 13y agoWhat really is the line between tricked and asked? Deceit? Lets go with deceit. So is asking for book ISBN '1; DROP TABLE books; --' deceitful? Perhaps, that's not an ISBN after all. Is asking for book ISBN [some valid ISBN that you pulled out of your ass, but happens to exist] deceitful? I don't think so. If you are just asking for randomly chosen ISBNs and getting responses, I don't think there is any trickery involved. In one case you are counting on the system to correctly understand your (validly constructed) request, in the other case you are counting on the system to misinterpret your request in a dangerous fashion.
- mmatants 13y agoThe line is in the intent. If I hand the librarian a piece of paper with that SQL-injecting ISBN my culpability depends on whether I was aware of the likely gravity of my actions or whether e.g. I was told to get that piece of paper by a trusted source (e.g. my supervisor) and didn't even read it.
- icambron 13y agoI'd like to fix up the analogy a bit. The problem isn't that you're asking for a random ISBN numbers; it's that you don't have a library card. The library's electronic catalog won't let you log in without the card, so you just start asking the librarian for random ISBNs and accepting the books he gives you. He doesn't check on your card because no one trained him to do that, but you know that checking out books is meant for card-carrying library members. I sense deceit there.
- 59nadir 13y agoSane people would point out that whoever trained that librarian was an idiot.
- rmc 13y agoWhat really is the line between tricked and asked? Deceit? What you (the asker/trickster) think the askee thought of it.
- mylorse 13y agoThen that is a poor librarian. A good librarian should have just said: 400 BAD REQUEST Whomever staffed that librarian, should interview or train their staff better.
- GotAnyMegadeth 13y agoYou shouldn't have to train your staff not to burn down the building they are working in...
- mylorse 13y agoObviously. If the administrator locked access to matches, nothing could be burned. The admin is responsible for leaving matches open at the library, and allowing the librarian to do as they please.