34 ms·

Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the serv

Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

japgolly 6y ago
Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.
- dleslie 6y ago
  Opening unlocked doors, entering and removing property is generally considered to be theft. The key here is that these services were not advertising their presence.
  - ddingus 6y ago
    Where are the locks? There are often ways to beaches and other spaces unadvertised, but otherwise OK to use. Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices. There was no lock on this at all.
  - ddingus 6y ago
    Theft requires property owners to be denied their property or the use of it. That did not happen here. Theft is not part of the discussion. Infringement could be, and is at least the right language for the discussion.
dcow 6y ago
This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".

japgolly 6y ago

Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.

dleslie 6y ago
Opening unlocked doors, entering and removing property is generally considered to be theft. The key here is that these services were not advertising their presence.
- ddingus 6y ago
  Where are the locks? There are often ways to beaches and other spaces unadvertised, but otherwise OK to use. Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices. There was no lock on this at all.
- ddingus 6y ago
  Theft requires property owners to be denied their property or the use of it. That did not happen here. Theft is not part of the discussion. Infringement could be, and is at least the right language for the discussion.

dcow 6y ago

This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".