6 ms·

That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that

That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that doesn’t mean the person didn’t just steal from me.

dcow 6y ago
You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.
- zeroimpl 6y ago
  It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
  - dcow 6y ago
    Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?
    - zeroimpl 6y ago
      Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
      - japgolly 6y ago
        Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.
        dleslie 6y ago
        Opening unlocked doors, entering and removing property is generally considered to be theft. The key here is that these services were not advertising their presence.
        ddingus 6y ago
        Where are the locks? There are often ways to beaches and other spaces unadvertised, but otherwise OK to use. Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices. There was no lock on this at all.
        ddingus 6y ago
        Theft requires property owners to be denied their property or the use of it. That did not happen here. Theft is not part of the discussion. Infringement could be, and is at least the right language for the discussion.
      - dcow 6y ago
        This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".
  - ddingus 6y ago
    For there to be theft a property owner has to lose their property and or use of said property. There is zero theft in this discussion. One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed. Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor. Bad practice does not support coercion at all. I wonder whether that word even applies to entities lacking agency. Servers are automatons. They do not make value judgements and or creative acts of agency of any kind. We need these things as a basis for coersion. There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index. Security by obscurity does not make sense. This mess is part of why.

dcow 6y ago

You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.

zeroimpl 6y ago
It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
- dcow 6y ago
  Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?
  - zeroimpl 6y ago
    Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
    - japgolly 6y ago
      Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.
      - dleslie 6y ago
        Opening unlocked doors, entering and removing property is generally considered to be theft. The key here is that these services were not advertising their presence.
        ddingus 6y ago
        Where are the locks? There are often ways to beaches and other spaces unadvertised, but otherwise OK to use. Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices. There was no lock on this at all.
        ddingus 6y ago
        Theft requires property owners to be denied their property or the use of it. That did not happen here. Theft is not part of the discussion. Infringement could be, and is at least the right language for the discussion.
    - dcow 6y ago
      This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".
- ddingus 6y ago
  For there to be theft a property owner has to lose their property and or use of said property. There is zero theft in this discussion. One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed. Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor. Bad practice does not support coercion at all. I wonder whether that word even applies to entities lacking agency. Servers are automatons. They do not make value judgements and or creative acts of agency of any kind. We need these things as a basis for coersion. There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index. Security by obscurity does not make sense. This mess is part of why.