Free Republic
Browse · Search
News/Activism
Topics · Post Article

To: Paul R.
It seems to me that if someone “takes apart something to see how it works”, and that something does not belong to them personally, or they do not have explicit permission to do so, from the owner, then that someone is in the wrong.

Not necessarily.

For instance, I have several machines in my server rack that run Apache web server. If I find an security problem on one of those and report it, every Apache web server of that same version on the Internet will have the same problem, just now everyone is aware of it.

Also, if a web server is publicly available, sending it commands and looking at the responses is exactly what your web browser does. Your web browser simply formats the responses into what you are used to seeing. What your web browser receives is very different to what you are used to seeing. A hacker will typically examine those raw responses directly rather than letting the web browser format them.

407 posted on 09/23/2008 6:22:46 AM PDT by Knitebane (Happily Microsoft free since 1999.)
[ Post Reply | Private Reply | To 406 | View Replies ]


To: Knitebane

If you are looking into a problem on hardware or software you own, then I have no problem with that. That is exactly what you describe. Ditto if the equipment / software belongs to someone you work for, or a customer, and they have asked you to check it out. Heck, I do THAT sort of thing (though in a much different area of electronics) all the time. If you inform the hardware / software provider that there is a problem, and then they do not respond after several such attempts, then ok: If you feel that you should alert others so that they can take appropriate safeguards, that’s fine too. What I have a problem with is people who try to “break in”, so to speak, where they have not been invited, where they have no ownership, etc.

Now, if you send commands to a web server in order to view what’s on someone’s website, such as in response to an implied invitation, of course that’s ok. Ie., “Come check out our cool products” is essentially the message if someone puts up a web site with their products listed therein. If that website generates so much legitimate traffic that it crashes, well, that’s a good problem to have! (And a better one to solve.) But if someone starts sending that website strings of data that can throw a monkey wrench into the works, INTENDING that result or possible result, uninvited, then that someone is in the wrong. So far as I know, my web browser sends out a lot of “inquiries”, but does not intentionally try to break into other’s accounts uninvited, throw that proverbial monkey wrench into the works just to see sparks fly, etc.

Put another way, it is one thing for someone to come to my door and knock, to request to come in. It’s quite another for them to pick the lock and come in without my permission.

As an aside, I would mention that not so many years ago, in probably the majority of the land area of the U.S., most people found it unnecessary to lock their house or car during the day. Robert Heinlein postulated much the same thing in a future society he described in “The Moon Is A Harsh Mistress.” I think it has to do both with self respect / honor, and with respect for others.


409 posted on 09/23/2008 7:02:33 PM PDT by Paul R. (Ok, I am ready to meet the devil. What are the details?)
[ Post Reply | Private Reply | To 407 | View Replies ]

Free Republic
Browse · Search
News/Activism
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson