5 ms·

Obviously deeply immoral and unethical, but illegal? No... Not unless there is a warning that what you are doing is wrong. Maybe they are test VNC servers?

Obviously deeply immoral and unethical, but illegal? No... Not unless there is a warning that what you are doing is wrong. Maybe they are test VNC servers? Scanning is definitely not illegal, nor immoral IMHO. Studying the Internet is a valid exercise when done responsibly.

tptacek 11y ago
I would be willing to put some money on you being very, very wrong about it being legal to tinker with passwordless VNC server simply because there was no explicit warning.
- jsprogrammer 11y ago
  Why do you (and everyone else) get to tinker with passwordless HTTP servers?
  - tptacek 11y ago
    Because every reasonable Internet user believes they're allowed to do that, whereas when you get access to a passwordless VNC server, it's so newsworthy that it immediately gets voted onto the front page of Hacker News.
    - jsprogrammer 11y ago
      I've seen plenty of links (including this one) to passwordless HTTP servers on the front page. A reasonable person would assume that a server with no password, intentionally has no password.
      - tptacek 11y ago
        Yeah good luck with that.
      - girvo 11y ago
        The legal system really doesn't like "cute", "technically-correct" arguments, as a general rule. If you fell afoul of the CFAA on this and were dragged in front of a judge, I'd put good money on that argument being laughed out of court for this particular case. An HTTP server is very different to a VNC server. Misconfiguration doesn't typically grant right to access, in a legal sense anyway.
        jsprogrammer 11y ago
        The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.
        girvo 11y ago
        > but there is no indication that a system is misconfigured merely because it does not have password protection And there is no indication it's not a misconfiguration. Look, I completely agree with what you're saying, but judges won't (and don't).
      - ori_b 11y ago
        Would they? Or would they assume that a VNC server was left open either through malice or incompetence, and it's presence therefore not an invitation to be accessed? This is the difference between a storefront being left unlocked, versus a private home being left unlocked. An unlocked storefront is likely to be open for business, so entering is reasonable. An unlocked house is a security mistake, and entering is trespassing.
      - bradleyland 11y ago
        You might think you're clever. Hell, you probably are clever. Unfortunately, that's not what matters. What matters is how the owner of the server will react, and how important they are. If you're identified and charged, the DA will levy absurdly burdensome charges against you. You'll be forced to spend thousands of dollars on defense. You'll spend months distracted by the proceedings, and will inevitably be asked about it by peers/employers when the news hits the streets. But you're right. You may never be convicted. Go ahead and try your luck.
- jen729w 11y ago
  IANAL but I'd have to agree. It reminds me of the time I got money deposited in to my bank account that I knew wasn't mine. I asked my girlfriend's dad - a lawyer - if I could keep it. Of course not, he said. It's like someone parking their car in your driveway, he said, and leaving the keys in the ignition. Are they trespassing on your driveway? Sure. Does that mean this car belongs to you now and you can do with it whatever you please? Of course not.
  - aminorex 11y ago
    Nonsense. People put up open systems because they want others to enter them. That's why public wifi is public. That's why public http servers are public. That's why public restrooms are public. Et cetera, ad nauseam.
    - hobs 11y ago
      Just because you can enter someone's home because the door is unlocked does not mean you are invited. Similarly you will find that trespassing on a system you do not have authorized use of (and no login is not implicit authorized use) is going to get you in trouble pretty much everywhere.
      - alexandre_m 11y ago
        The difference is the degree of knowledge you have of doing something wrong while transgressing the law. It's like if my grand-mother with alzheimer accidentally entered the wrong apartment room or house where the door was unlocked. It's not like she should go to jail or get shot by the owner pretending she was a threat. I haven't seen the website, but if they made it really easy to enter remote systems then someone could defend himself saying he didn't know what it was all about. One could probably argue that some Popcorn Time users would enter this gray zone. However, the providers of those kind of services are mostly aware of the illegality of their users behaviour, so they are infringing the law clearly.
    - deleted 11y ago
      [deleted]
vacri 11y ago
You don't have a right to mess with things just because they're "in public". If someone's front gate is open, that doesn't mean that you can just walk in and start chopping up their rosebush.

tptacek 11y ago

I would be willing to put some money on you being very, very wrong about it being legal to tinker with passwordless VNC server simply because there was no explicit warning.

jsprogrammer 11y ago
Why do you (and everyone else) get to tinker with passwordless HTTP servers?
- tptacek 11y ago
  Because every reasonable Internet user believes they're allowed to do that, whereas when you get access to a passwordless VNC server, it's so newsworthy that it immediately gets voted onto the front page of Hacker News.
  - jsprogrammer 11y ago
    I've seen plenty of links (including this one) to passwordless HTTP servers on the front page. A reasonable person would assume that a server with no password, intentionally has no password.
    - tptacek 11y ago
      Yeah good luck with that.
    - girvo 11y ago
      The legal system really doesn't like "cute", "technically-correct" arguments, as a general rule. If you fell afoul of the CFAA on this and were dragged in front of a judge, I'd put good money on that argument being laughed out of court for this particular case. An HTTP server is very different to a VNC server. Misconfiguration doesn't typically grant right to access, in a legal sense anyway.
      - jsprogrammer 11y ago
        The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet. I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.
        girvo 11y ago
        > but there is no indication that a system is misconfigured merely because it does not have password protection And there is no indication it's not a misconfiguration. Look, I completely agree with what you're saying, but judges won't (and don't).
    - ori_b 11y ago
      Would they? Or would they assume that a VNC server was left open either through malice or incompetence, and it's presence therefore not an invitation to be accessed? This is the difference between a storefront being left unlocked, versus a private home being left unlocked. An unlocked storefront is likely to be open for business, so entering is reasonable. An unlocked house is a security mistake, and entering is trespassing.
    - bradleyland 11y ago
      You might think you're clever. Hell, you probably are clever. Unfortunately, that's not what matters. What matters is how the owner of the server will react, and how important they are. If you're identified and charged, the DA will levy absurdly burdensome charges against you. You'll be forced to spend thousands of dollars on defense. You'll spend months distracted by the proceedings, and will inevitably be asked about it by peers/employers when the news hits the streets. But you're right. You may never be convicted. Go ahead and try your luck.
jen729w 11y ago
IANAL but I'd have to agree. It reminds me of the time I got money deposited in to my bank account that I knew wasn't mine. I asked my girlfriend's dad - a lawyer - if I could keep it. Of course not, he said. It's like someone parking their car in your driveway, he said, and leaving the keys in the ignition. Are they trespassing on your driveway? Sure. Does that mean this car belongs to you now and you can do with it whatever you please? Of course not.
- aminorex 11y ago
  Nonsense. People put up open systems because they want others to enter them. That's why public wifi is public. That's why public http servers are public. That's why public restrooms are public. Et cetera, ad nauseam.
  - hobs 11y ago
    Just because you can enter someone's home because the door is unlocked does not mean you are invited. Similarly you will find that trespassing on a system you do not have authorized use of (and no login is not implicit authorized use) is going to get you in trouble pretty much everywhere.
    - alexandre_m 11y ago
      The difference is the degree of knowledge you have of doing something wrong while transgressing the law. It's like if my grand-mother with alzheimer accidentally entered the wrong apartment room or house where the door was unlocked. It's not like she should go to jail or get shot by the owner pretending she was a threat. I haven't seen the website, but if they made it really easy to enter remote systems then someone could defend himself saying he didn't know what it was all about. One could probably argue that some Popcorn Time users would enter this gray zone. However, the providers of those kind of services are mostly aware of the illegality of their users behaviour, so they are infringing the law clearly.
  - deleted 11y ago
    [deleted]

vacri 11y ago

You don't have a right to mess with things just because they're "in public". If someone's front gate is open, that doesn't mean that you can just walk in and start chopping up their rosebush.