3 ms·

As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - y

by Nadya 11y ago

As long as your door is unlocked, do I have permission to enter your home? An unlocked door is essentially a 200 response when I try to open it. Better yet - your door is open already. Do I have permission to waltz right in?

tedunangst 11y ago
I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?
- Nadya 11y ago
  Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
  - tedunangst 11y ago
    Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
    - msandford 11y ago
      Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
      - tptacek 11y ago
        Sneaking into an R rated movie. Stealing hundreds of millions of dollars from pension funds. Yep, pretty much the same thing.
        msandford 11y ago
        If justice is blind, then they are the same thing! They are willfully ignoring or choosing not to obey the rules that society has agreed upon for all people. If you want to argue that different crimes are different I'm all for it. But if you're going to do that, then please explain to me how Weev not releasing the information publicly is so heinous as to deserve years in prison and a fine worth a substantial fraction of a house.
  - tptacek 11y ago
    Why does it matter whether he'd be angry at the hotel? We're talking about the person who exploits the hotel's lax security to steal from him. Impose civil liability on people with terrible security. Fine. That's an orthogonal issue, though. There's no reason you can't do both things, and most reasonable people can imagine a variety of things people might do with computers that they'd expect and want to be criminalized.
jMyles 11y ago
Twice in one thread? This started because I objected to that analogy as toxic. You can't possible think that sending an HTTP packet to an HTTP server is morally tantamount to walking into a stranger's house?!
- Nadya 11y ago
  >> This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. Nobody is forcing you to use a door. If you decide to, and you provide access to your home via door, and you allow me to open the door and do things you don't like, you are welcome to stop me by locking the door. It's your house, after all. You cannot say that issuing a 403 instead of a 200 is OK but turn around and say unpermitted access (what should give a 403) is okay so long as you are given a 200 in response, even if by accident. If door is locked > return 403 else return 200 The only difference is that the 403 and 200 are implicit with the door being locked or not, rather than an explicit response from door since door is incapable of giving a response (unlike server). Although both server and door are handled by a human. The shared point of failure is how the human configured the server//door to return a 403/200//unlocked/locked status to individuals other than itself. Forgetting to lock your door, failing to set -NOACCESS for ${Robber}, is exactly like forgetting to disable the -READ flag for ${User}. Therefore, the configuration is not reasonable.
  - jMyles 11y ago
    It's the entire metaphor that's broken, so the fact that you can vaguely map "locked" to a properly functioning auth system and "unlocked" to an unintentional 200 response is irrelevant. My neighborhood is not the internet. There is no written, unambigous protocol which my door implements in order to accept or reject guests. In fact, my door isn't programmed to issue responses of any kind; a human or even an answering system might do that, and yes, they might plausibly grant access. More important is the reverse: the internet is not your neighborhood, and mapping the laws (both legal and social) on a 1-to-1 basis in an effort to recreate the norms of your neighborhood on a worldwide telecommunications system is really inane. I can't for a second make sense of it, much less what lessons it provides us for the proper legal and moral framework to accompany HTTP.
msandford 11y ago
Given that we already have hundreds or thousands of years of convention and understanding of property rights, no. Please point me to the long and well worn case law regarding robots that do what you tell them, but not what you actually intend.

by Nadya 11y ago

tedunangst 11y ago

I leave my wallet in my hotel room. You go to the front desk, tell them you're me and get a key to my room. Do you have permission to take my wallet?

Nadya 11y ago
Your analogy doesn't really compare as it involves identity fraud. >You go to the front desk, tell them you're me and get a key to my room. This would be the equivalent to using an Admin username/password to login to the server at which point you are given permission flags (-access wallet). Logging in with the Admin username/password without permission is against the law - so regardless if you take the wallet or not you broke the law. You leave your wallet in your hotel room. I go to the front desk and ask them for a key to your room. They don't question me or verify my identity and simply hand over the key. Would you be angry at the hotel for not verifying who the person is or why they need a key to your room?
- tedunangst 11y ago
  Are we agreed then that telling a web site your username is ";update users set passwd = ''--" counts as fraud?
  - msandford 11y ago
    Only if you're willing to federally prosecute every person who ever told a website that they were over 18 or 21 if they were not in fact over 18 or 21. Fraud is fraud and justice is blind, right?
    - tptacek 11y ago
      Sneaking into an R rated movie. Stealing hundreds of millions of dollars from pension funds. Yep, pretty much the same thing.
      - msandford 11y ago
        If justice is blind, then they are the same thing! They are willfully ignoring or choosing not to obey the rules that society has agreed upon for all people. If you want to argue that different crimes are different I'm all for it. But if you're going to do that, then please explain to me how Weev not releasing the information publicly is so heinous as to deserve years in prison and a fine worth a substantial fraction of a house.
- tptacek 11y ago
  Why does it matter whether he'd be angry at the hotel? We're talking about the person who exploits the hotel's lax security to steal from him. Impose civil liability on people with terrible security. Fine. That's an orthogonal issue, though. There's no reason you can't do both things, and most reasonable people can imagine a variety of things people might do with computers that they'd expect and want to be criminalized.

jMyles 11y ago

Twice in one thread? This started because I objected to that analogy as toxic. You can't possible think that sending an HTTP packet to an HTTP server is morally tantamount to walking into a stranger's house?!

Nadya 11y ago
>> This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. Nobody is forcing you to use a door. If you decide to, and you provide access to your home via door, and you allow me to open the door and do things you don't like, you are welcome to stop me by locking the door. It's your house, after all. You cannot say that issuing a 403 instead of a 200 is OK but turn around and say unpermitted access (what should give a 403) is okay so long as you are given a 200 in response, even if by accident. If door is locked > return 403 else return 200 The only difference is that the 403 and 200 are implicit with the door being locked or not, rather than an explicit response from door since door is incapable of giving a response (unlike server). Although both server and door are handled by a human. The shared point of failure is how the human configured the server//door to return a 403/200//unlocked/locked status to individuals other than itself. Forgetting to lock your door, failing to set -NOACCESS for ${Robber}, is exactly like forgetting to disable the -READ flag for ${User}. Therefore, the configuration is not reasonable.
- jMyles 11y ago
  It's the entire metaphor that's broken, so the fact that you can vaguely map "locked" to a properly functioning auth system and "unlocked" to an unintentional 200 response is irrelevant. My neighborhood is not the internet. There is no written, unambigous protocol which my door implements in order to accept or reject guests. In fact, my door isn't programmed to issue responses of any kind; a human or even an answering system might do that, and yes, they might plausibly grant access. More important is the reverse: the internet is not your neighborhood, and mapping the laws (both legal and social) on a 1-to-1 basis in an effort to recreate the norms of your neighborhood on a worldwide telecommunications system is really inane. I can't for a second make sense of it, much less what lessons it provides us for the proper legal and moral framework to accompany HTTP.

msandford 11y ago

Given that we already have hundreds or thousands of years of convention and understanding of property rights, no. Please point me to the long and well worn case law regarding robots that do what you tell them, but not what you actually intend.