5 ms·

You've been too charitable. The site gave a 200 status code. It's more like the store having a huge sign that says "OPEN, COME ON IN!"

by jMyles 11y ago

tptacek 11y ago
This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. Obviously, outside the airless void of a message board argument, this isn't how things work.
- jMyles 11y ago
  > This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation and just happened to be the first (or the first noticed) to use applications in a way unintended by the designers.
  - gph 11y ago
    >This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.
    - jMyles 11y ago
      Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.
      - tptacek 11y ago
        This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
        jMyles 11y ago
        The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.
    - msandford 11y ago
      OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?
  - Nadya 11y ago
    As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - your door is open already. Do I have permission to waltz right in?
    - tedunangst 11y ago
      I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?
      - Nadya 11y ago
        Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
        tedunangst 11y ago
        Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
        msandford 11y ago
        Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
        11y ago
  - tptacek 11y ago
    Whatever your tastes might be, that's not what the law in the US says.
    - jMyles 11y ago
      Oh, I understand that; I have no illusions otherwise. But I thought this thread was precisely about how strange the laws are?

You've been too charitable. The site gave a 200 status code. It's more like the store having a huge sign that says "OPEN, COME ON IN!"

by jMyles 11y ago

You've been too charitable. The site gave a 200 status code. It's more like the store having a huge sign that says "OPEN, COME ON IN!"

tptacek 11y ago

This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. Obviously, outside the airless void of a message board argument, this isn't how things work.

jMyles 11y ago
> This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation and just happened to be the first (or the first noticed) to use applications in a way unintended by the designers.
- gph 11y ago
  >This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.
  - jMyles 11y ago
    Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.
    - tptacek 11y ago
      This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
      - jMyles 11y ago
        The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.
  - msandford 11y ago
    OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?
- Nadya 11y ago
  As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - your door is open already. Do I have permission to waltz right in?
  - tedunangst 11y ago
    I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?
    - Nadya 11y ago
      Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
      - tedunangst 11y ago
        Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
        msandford 11y ago
        Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
        11y ago
- tptacek 11y ago
  Whatever your tastes might be, that's not what the law in the US says.
  - jMyles 11y ago
    Oh, I understand that; I have no illusions otherwise. But I thought this thread was precisely about how strange the laws are?