6 ms·
If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 w
by streetnigga 13y ago
If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called.
If someone subverts an authentication system to get authed, then they were clearly never authorized no matter the granted access to the data.
Seems unauthorized or not is baked into the web already. It is the humans behind corporations and their lawyers trying to stretch the definition or create new mechanics. The AT&T case shows this for sure.
- aaronem 13y ago> If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called. If I leave my apartment door unlocked, and you go in while I'm at work and steal my television, you are still liable for unlawful entry and burglary. There is no legally admissible argument that my not having locked the door confers upon you authorization to go through it. Of course, that's a much clearer case than API access tends to be, but the point I make from it is that "nobody stopped me from getting to this" does not imply "it must be lawful for me to make use of this".
- wtbob 13y agoYeah, but with HTTP API access, it's much more like someone who goes up to your apartment, knocks on your door, his knock is answered by your butler, he asks the butler for something, and the butler gives him it. It's not his fault that you hired a cretin for a butler.
- aaronem 13y agoNo, but it's his fault that he exploited the butler's cretinism to gain access he knew or suspected he shouldn't have. If you're still unclear on the concept, your Google query for today is the Latin phrase mens rea; I'm no lawyer, but the impression I have is that that's the legal concept of import here.
- streetnigga 13y agoWho said anything about exploit? You made the API and it has open access. If it is private don't make it public. Absolutely no analogies are needed for that. Slap on some authentication before calling the lawyers. Lawyers are needed for when such systems have been subverted. Seems the reality distortion of blaming anyone that touches something a corporation doesn't want touched is catching on. Persons behind corporations that dispatch lawyers with great zeal are responsible for conflating their own mistakes for exploitation. For those having a hard time, just think like the NSA: Public unencrypted data will be used, but not always in the way the persons who made it public contemplated.
- aaronem 13y agoYes, and expecting that no one will try my doorknob to see if I forgot to lock it is relying on security by obscurity, and if someone exploits my having forgotten to lock my door, both the exploit, and whatever harm comes to me by it, are entirely my own fault and no one else is liable.
- streetnigga 13y agoApologize for injecting insults and vitriol into this thread if wish for a contextual reply.
- tptacek 13y agoI know that when you're in the middle of an argument it feels like you're having a 1-1 conversation, but you're not: you're writing messages to everyone on HN. This kind of "apologize first" stuff is really boring. If you don't think the person you're talking to is arguing in good faith, stop responding to them.
- streetnigga 13y agoI only caught on about the bad faith after noticing several comments in a row that included insults or slights. You are right, best course is just to totally disengage.
- streetnigga 13y agoNo one is stealing TVs by reading data being firehosed out of an open API. Just like your Wifi network name being broadcast is not theft of televisions.
- aaronem 13y agoI just knew some shallow oaf was going to take his finger out of his nose long enough to pick on my having included a stolen television in my example. True, no theft of a physical object occurs. But one would have to be either deliberately obtuse or abjectly stupid to ignore the legal commonality I used that example to demonstrate.
- streetnigga 13y agoWhat the fuck is your problem? You are calling people "children" and "shallow oafs." Stop being such a negative jerk when communicating with others. Edit: Thanks whoever down-voted the guy saying "fuck" but not the user injecting insults and slights. This HN community feels healthy and mature.
- aaronem 13y agoOh, dear. "Streetnigga" just can't deal with such an unfriendly tone.
- streetnigga 13y agoWhy would I? I didn't come here for unfriendly and insulting tones.
- tptacek 13y agoBoth of you could do the rest of us a favor by not responding to each other anymore.
- sneak 13y ago> If I leave my apartment door unlocked Oh god, this again
- aaronem 13y agoI see the children are home from school. Did you have an argument to make?
- sneak 13y agoThe physical analogy is completely inapplicable as you don't "enter" a webserver, you send it a request. Putting things into a state wherein they get auto-served to any request is something akin to posting documents inside your front window for passerby on the sidewalk to see. The whole thing's a fucking terrible analogy though, and every time I see it trotted out to support some "if I leave my doors unlocked" argument I die a little bit inside.
- tptacek 13y agoIf you "request" that the doorman of a building let you in and then subsequently rob the place, the doorman's complicity does not lessen the severity of your offense. People like to make this debate more complicated than it really is, what with the warring analogies. Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it? Your argument is, "if the webserver says it's OK, then my belief that I'm authorized is reasonable". That's a sane argument, but has any court ever agreed with it?
- streetnigga 13y agoI think there is a lack of distinction over exploiting to obtain data or exploiting data obtained. In the web-server case I would argue access was allowed unfettered but authorization for the data was not. This is how more than a few cases have gone down. Gotchas don't really cut it in court. Edit: My original comment further up in this thread hinted at this difference and how lawyers seem to be trying to shift the line so unwanted access by a user is treated the same as exploitation of the data within even if the data was not exploited upon.
- patmcc 13y agoIf you leave your blinds open, can I look through them?
- tptacek 13y agoNot necessarily.