undefined | Better HN

0 pointscortesoft12y ago0 comments

I don't think it is like walking into a private home because the door is unlocked... this is more like someone walking into a store, looking around, and then getting in trouble for looking at a specific display shelf that was in the back corner. The shelf wasn't labeled as off limits, you just were wondering around where you were supposed to and happen to see it. The store can't get mad and say "well yeah, but we put it in the back corner where most people don't go... and we put sensitive stuff back there! How dare you look at it!"

Well it was right in the same store you invited me in to! There was no sign or lock or anything saying not to look at the shelf.

This was a PUBLIC website... you are supposed to be able to visit it. If you make a request to a server without providing authentication and it returns data, that is not your fault. That is what you are SUPPOSED to do to servers. If it asks for authentication and tells you you are unauthorized, but you brute force the password or find an exploit, then THAT is a crime. There was not authentication in this case.

0 comments

res0nat0r12y ago

>This was a PUBLIC website... you are supposed to be able to visit it. If you make a request to a server without providing authentication and it returns data, that is not your fault. That is what you are SUPPOSED to do to servers. If it asks for authentication and tells you you are unauthorized, but you brute force the password or find an exploit, then THAT is a crime. There was not authentication in this case.

Unfortunately none of these excuses are valid. He knew he was accessing something he shouldn't have been. If he did it once or twice and stopped that is one thing, intent is a major part of the law, and he intended to exploit something he knew he should not have been. That is why he is being found guilty.

msandford12y ago

If I find a $50 bill on a sidewalk I can INTEND to steal it as much as I want. But no matter how badly I WANT to steal it I cannot because at that point it's not a thing that can be stolen. There is no way to trace it back to it's former owner and as such, the first person to find it is legitimately the new owner.

Weev might have said that he "stole" the information or that he "intented" to perform an unauthorized access but ultimately that doesn't matter. There was no access control to prevent the internet's default of "everything is visible" so that's precisely what happened. It's not a hack no matter how badly he or the government want it to be. Intent matters not one iota.

res0nat0r12y ago

Of course intent matters. If I run over someone with my car and kill them and it was deemed just a terrible but unfortunate accident, that is 100% different than if I drove over them because I intended to run them down and kill them.

The same applies to this case. He intended to access something he knew he shouldn't have had access to. Thus why he is guilty.

1 more reply

tedunangst12y ago

Depending on what you find and where you find it, actually, you may have a legal obligation to attempt to return it to the owner. The law is not quite as simple as finders, keepers.

Robin_Message12y ago

Ahem, http://en.wikipedia.org/wiki/Theft_by_finding

1 more reply

bigiain12y ago

If we want to stretch analogies beyond sense, how about this.

You walk into a cake shop that has cupcakes with names written on the icing:

You say "Can I have a cupcake with 'Iain' written on it?" They say "200 OK, here's a cupcake with Iain on it."

You say "Can I have that wedding cake?" They say "401 Unauthorized, Sorry that's someone elses' cake." You don't get a wedding cake.

You say "Can I have a cupcake with 'Alice' written on it?" They say "200 OK, here's a cupcake with "Alice' written on it."

You say "Can I have a birthday cake?" They say "402 Payment required, That'll be $15" You don't get a birthday cake.

You say "Can I have a cupcake with 'Bob' written on it?" They say "404 Not Found, sorry we don't have any cupcakes with 'Bob'."

You say "Can I have a cupcake with 'Carol' written on it?" They say "200 OK, here's a cupcake with 'Carol' in it."

You say "Can I have a cupcake with 'Dave' written on it?" They say "200 OK, here's a cupcake with 'Dave' on it."

You walk out with 4 cupcakes. Then the cake shop owner comes out and says "You stole the three cupcakes! I didn't intend for you to have them!"

Did you do anything wrong? Do you deserve to go to jail for it?

IanCal12y ago

> Did you do anything wrong?

Possibly, it depends on intent. Add in:

    You: Hahaha, guys I can get anybodies cake!
    You: Looool their security is awful!
    You: Hahah, we could short this companies stock!

Then you clearly knew what you were doing and therefore did something wrong.

bigiain12y ago

But an equally valid interpretation of what's going on is:

Cool, free cupcakes! They want you to pay for birthday cakes and pre-order wedding cakes, but they'll give you any cupcake you ask for if they've got one available!

1 more reply

victorf12y ago

If knowing that you are doing something immoral makes it a crime why isn't all of Wall Street in prison?

1 more reply

j / k navigate · click thread line to collapse