2 ms·

This is a perfectly reasonable analogy. Many on HN seem like to feign ignorance when it comes to intent. Have fun playing dumb in court when you try to bring o

This is a perfectly reasonable analogy. Many on HN seem like to feign ignorance when it comes to intent. Have fun playing dumb in court when you try to bring out your strictly technical argument why you should have legally downloaded all of those credit card and social security numbers since you "could".

DanBC 13y ago
It is a terrible analogy because websites have status codes defined in RFCs. All analogy is terrible if we're talking about computer access. The door analogy fails because there are two existing sets of laws covering both sets of circumstances, and how the courts interpret authorized access might have very little to do with what normal people would mean. By having a website on the public facing Internet with no access controls you are inviting anyone to view that page. You are giving implied consent to view that page. Except that's not how some courts interpret it, so my opinion means very little.
- tptacek 13y ago
  That implied invitation gets absurd quickly in the real world, like when it accompanies access to millions of stored credit card numbers. There is information that cannot possibly come with a legitimate implied consent to access. It's also a technical non-starter, because the HTTP status code that accompanies a response is an artifact, not a promise; the result of a SQL injection attempt could for instance very well have a 200 code on it.
stephen_g 13y ago
I think of it more like calling someone and asking them to send you a book. They do. Then the police come knocking on the door saying you accessed the information illegally... If you don't want someone to have something, don't have your system dispense it when they ask for it. But yes, intent does come into it - and that's often the problem - people investigating systems for curiosity or academic interest or because the system owners won't take them seriously when they have reported problems that put people's data at risk and want to demonstrate it are treated like criminals (often charged with felony offences with potential jail time worse than assault or theft)

DanBC 13y ago

It is a terrible analogy because websites have status codes defined in RFCs. All analogy is terrible if we're talking about computer access. The door analogy fails because there are two existing sets of laws covering both sets of circumstances, and how the courts interpret authorized access might have very little to do with what normal people would mean. By having a website on the public facing Internet with no access controls you are inviting anyone to view that page. You are giving implied consent to view that page. Except that's not how some courts interpret it, so my opinion means very little.

tptacek 13y ago
That implied invitation gets absurd quickly in the real world, like when it accompanies access to millions of stored credit card numbers. There is information that cannot possibly come with a legitimate implied consent to access. It's also a technical non-starter, because the HTTP status code that accompanies a response is an artifact, not a promise; the result of a SQL injection attempt could for instance very well have a 200 code on it.

stephen_g 13y ago

I think of it more like calling someone and asking them to send you a book. They do. Then the police come knocking on the door saying you accessed the information illegally... If you don't want someone to have something, don't have your system dispense it when they ask for it. But yes, intent does come into it - and that's often the problem - people investigating systems for curiosity or academic interest or because the system owners won't take them seriously when they have reported problems that put people's data at risk and want to demonstrate it are treated like criminals (often charged with felony offences with potential jail time worse than assault or theft)