Hacker News Reader

Comment by matheusmoreira | Hacker News Reader

It's just network connections. Why would they make a computer accessible to me if they don't want me connecting to it?

Because your incompetent enterprise hired incompetent contractors (on an eye watering day rate) to migrate firewall rules from an old firewall to a new one, and they did so by running an incompetently-implemented automated tool in an in incompetent manner such that 4000 'allow' rules were moved over but that the source and destination address were set to 0.0.0.0/0...

There are two "they"s involved in the conversation but generally when using someone else's stuff the more apt question is "why should I have an expectation I can use their stuff however I want without limit".

For the "they" of your provider, who is held accountable for allowing abusive traffic, the goal is to provide you outbound connectivity but to do that they also need to ensure they don't get de-peered or their network ranges blocked for hosting abusive traffic. Even for things which don't transit a 4th party there is negative incentive to let your customers abuse each other just because the addresses are reachable. This almost always results in automated systems with limited incentive for good uses of port scanning to be allowed.

For the "they" of the end system is (most likely) they didn't make the entire system available to you, just some select services for use in a certain way (e.g. loading their website). Doing that does not provide them an obligation to continuously allow all traffic received at the address to be processed and it's very likely they'll just block you entirely as another layer of defense.

This is not how authorization to use other people's services work. In practice you're vanishingly unlikely (in the US at least) to get into legal trouble for port scanning, but if you take this logic to its conclusion --- a service exposes some capability without authentication, ergo you're authorized to use it --- you very definitely can get prosecuted.

> a service exposes some capability without authentication, ergo you're authorized to use it

How is this different from scraping publicly available websites? i.e. why would you get in trouble for one, but not the other?

It's not different in any way. "Corporation doesn't like it when you do it" is apparently the number one cause of "trouble". Especially in the US where they can bankrupt you with legal fees even if they have no actual leg to stand on. Less so in other countries.

Who's getting bankrupted by legal fees over scraping these days--which has time and time again be declared not illegal.

Anyone can be bankrupted by corporations over literally any bullshit claim. They can afford to lose in court and still win because their objective never was to win in the first place, it was to burn your money through legal fees. It's essentially abuse of the legal system by the rich to keep the poors in line.

Big companies with deep pockets will even bankrupt other companies this way. For an example, look at how Sony sued playstation emulator companies over the most bullshit claims possible, got an injunction, killed their profits and then it didn't matter that they lost in court afterwards. In my country, the judge would have estimated the profits the smaller player lost as a result of Sony's frivolous lawsuit and forced them to pay it all back on top of the legal fees.

Yes, your examples make sense in their own context, but are not relevant to the case of scraping publicly available data.

In short, who's getting put out of business for redisplay or derived data uses of publicly available data?

Because the offense turns on intent, not on a simple factual case you can rattle off on a message board.

“It’s just jiggling a door handle. Why would they make a door accessible to me if they don’t want me jiggling the handle?”

More like a knock on the door to see if anyone answers.

Welcome to the age-old conversation which can well be analog'd as why would someone leave the front door of their house open if they didn't want you walking in? Or checking door knobs?

Except I didn't walk into anyone else's servers. I tried to talk to them. They can simply not answer. There's a clear boundary: the network.

Because they're making it available to someone else, who (unlike you) is authorized to connect from anywhere in the world.

Then just reject the connection unless I can prove I'm that person.

> It's just network connections.

Stealing someone's bitcoin? It's just network connections. Logging in to some admin portal with default passwords? It's just network connections.

> Why would they make a computer accessible to me if they don't want me connecting to it?

Why would they write bugs in software if they don't want to write bugs?

None of your examples have anything to do with nmap though which in its most basic form is just connecting to ports to see if it works.

You didn't understand my comment. It's not about the specific thing (be it nmap or some other tool), it's about the intention behind using the tool.

The administrator of the network didn't intend to allow port scanning, but there were no technical measures (firewalls) to prevent it, and you did port scanning => you're wrong.

The writer of the access control software intended to have no bugs, but a bug slipped in to allow you to exploit it => you're wrong.

> it's about the intention behind using the tool

I just want to know what's out there.

> exploit

How is this exploitation in any way?

DDoS attacks are “just network connections” too.

The alerts tend to be geared more toward attempts to reach a secured system that isn't accessible to you.

Have you tried seriously answering your own question?

Reply on news.ycombinator.com