News for hackers. Stuff that matters.
Re:LinkedIn: It’s illegal to scrape our website without perm... by dsacco on Monday July 31, 2017 @10:00AM (#14892016)
That's a pretty literalist, one-size fits all approach to policy. I don't think it's a good framework to use for applying ethics considerations.

If I can walk near a pool, should I also be able to run? Is running anything more than faster walking? If I'm allowed to be around the pool walking with my entry ID, should I also be allowed to place my ID on a little motorized car and make it dart around the pool really fast? Should I be able to duplicate my badge, put it on a bunch of little cars and direct them to quickly get all the floaties before anyone else? How about giving them all their own fake IDs? Now all the same questions, except there is a sign that explicitly prohibits all of these examples except for walking.

It seems disingenuous to argue that the automation and rapid increase of a thing should be allowed just because a thing is allowed. That doesn't typically match our intuitive notions of ethics in other parts of society, like driving or walking around a pool. Yes, you can walk around a pool as much as you want, but if you change to running then you have fundamentally altered your behavior through increased capability, not merely done "more of walking" to utilize more of your freedom.

I suppose a natural counterargument to this analogy might be that running around pools is unsafe, and scraping is not unsafe in the same way. But my point here is establishing that a behavior intrinsically changes into a different behavior if you increase the speed at which you're doing it or the capability at which you can do it.

Re:LinkedIn: It’s illegal to scrape our website without perm... by freehunter on Monday July 31, 2017 @10:25AM (#14892252)
The pool has the right to kick you out, same as any website. The pool cannot call the police and charge you with a felony for misusing their resources.
Re:LinkedIn: It’s illegal to scrape our website without perm... by dsacco on Monday July 31, 2017 @10:32AM (#14892317)
Does the pool have any recourse if you proceed to bypass the ban? Do you have to re-enter to pool to bypass it, or does sending in confederates with their own badges to continue your work also bypassing the ban? How about sending in new motorized cars?

The analogy is starting to break down, but I think it's still instructive for the problem of applying a simple first principles approach.

Re:LinkedIn: It’s illegal to scrape our website without perm... by freehunter on Monday July 31, 2017 @12:31PM (#14893446)
There is a legal concept known as "attractive nuisance"[1]. If I have a pool and neighborhood kids come to play and someone gets hurt, it's my fault. Even if I was away from my house and never gave permission (or explicitly forbade them from swimming), if I don't have proper access controls in place, the courts say it is too tempting for the neighbors to just come over and swim. I need to put up a locking gate to keep them out.

Likewise in some high-crime jurisdictions, if you did not lock your car you are liable for it getting stolen or broken into[2]. An unlocked car is too tempting for some people to just walk past and not take it.

I know it might sound crazy but you could make the argument that a massive pool of highly-structured and very valuable data just sitting out in the open is an attractive nuisance and steps should be taken to put it behind a locked gate. Once that requirement has been satisfied, normal trespassing laws apply.

[1] https://en.wikipedia.org/wiki/Attractive_nuisance_doctrine

[2] http://www.cbc.ca/news/canada/montreal/ndg-resident-question...

Re:LinkedIn: It’s illegal to scrape our website without perm... by enraged_camel on Monday July 31, 2017 @05:57PM (#14896238)
Laws like that are ridiculous. You can see that by looking at how the reasoning does not expand to certain areas.

For example, if a woman walks down a dark alley wearing short skirts and gets raped, it isn't her fault. I mean can you imagine if we said "well, she was just an attractive nuisance!" The judge would throw the book at you.

Re:LinkedIn: It’s illegal to scrape our website without perm... by freehunter on Monday July 31, 2017 @06:08PM (#14896318)
They're usually targeted at children who don't know better and don't have the cognitive skills to understand consequences. Usually... but not always.
Re:LinkedIn: It’s illegal to scrape our website without perm... by beobab on Tuesday August 01, 2017 @03:22AM (#14898524)
"An unlocked car is too tempting for some people to just walk past and not take it."

I am saddened by this.

Re:LinkedIn: It’s illegal to scrape our website without perm... by burkaman on Tuesday August 01, 2017 @11:27AM (#14901713)
I don't think it's true, and the source doesn't back it up. Even if it's illegal to leave your car unlocked, that doesn't mean it's your fault if someone steals it. Presumably you'd both be liable.
Re:LinkedIn: It’s illegal to scrape our website without perm... by TheCoelacanth on Monday July 31, 2017 @10:49AM (#14892475)
Bypassing the ban after you have been clearly notified of it is trespass.
Re:LinkedIn: It’s illegal to scrape our website without perm... by jdbernard on Monday July 31, 2017 @11:38AM (#14892954)
That's basically what LinkedIn is arguing here. They have explicitly send hiQ a cease-and-desist letter.
Re:LinkedIn: It’s illegal to scrape our website without perm... by dragonwriter on Monday July 31, 2017 @06:25PM (#14896416)
> The pool cannot call the police and charge you with a felony for misusing their resources.

Once they have withdrawn permission, they can call the police and you can be charged with trespass, though that's usually a misdemeanor rather than a felony.

Re:LinkedIn: It’s illegal to scrape our website without perm... by burkaman on Monday July 31, 2017 @10:32AM (#14892319)
The website can't really kick you out though, it can only kick your agent out and you can trivially create a thousand more. The website can politely ask you to stop just like the pool, but it can't actually do anything if you ignore it.
Re:LinkedIn: It’s illegal to scrape our website without perm... by beobab on Tuesday August 01, 2017 @03:17AM (#14898499)
Except block your IP address, or your user agent, or the pattern your software makes when it connects.

Yes, that will cause potential issues for other people, which is why they tend not to do that, but if you trivially create a thousand more agents, and potentially trigger a degradation of service, how are you different to the people who block junctions at traffic lights?

I'm not keen on inconveniencing people, and "it's not that bad" is a poor argument for doing something that someone has explicitly asked you not to do.

Re:LinkedIn: It’s illegal to scrape our website without perm... by burkaman on Tuesday August 01, 2017 @11:29AM (#14901733)
I think you agree with me. If someone is abusing your website, or even just doing something you've asked them not to do, you can't literally kick them out like you could in person. There's all sorts of techniques for blocking whatever they're doing, but if they're determined and your website is still accessible, they can come back.

That's why it might be reasonable for laws around this sort of thing to be different in the virtual world.

Re:LinkedIn: It’s illegal to scrape our website without perm... by type0 on Monday July 31, 2017 @10:59AM (#14892593)
Sure they can if they know who you are, that means authorization, when L-In will put their pages behind a login they would be able to kick hiQ out.
Re:LinkedIn: It’s illegal to scrape our website without perm... by smokeyj on Monday July 31, 2017 @12:37PM (#14893505)
The way HTTP works is there is a request and response. If LinkedIn does not want to provide a response, they don't have to. If they don't want to accept requests, then maybe the World Wide Web isn't for them.
Re:LinkedIn: It’s illegal to scrape our website without perm... by quickben on Monday July 31, 2017 @05:21PM (#14895995)
So was Napster. Turns out, law>technology.
Re:LinkedIn: It’s illegal to scrape our website without perm... by type0 on Monday July 31, 2017 @10:18AM (#14892181)
> I don't think it's a good framework to use for applying ethics considerations.

What does is it have to do with ethics? CFAA law does not apply here and that is what matters.

Re:LinkedIn: It’s illegal to scrape our website without perm... by dsacco on Monday July 31, 2017 @10:30AM (#14892305)
Ostensibly "ethical considerations" are a precursor to a law being ratified, and will also be used when a law is not sufficiently specified as to obviate the decision. If a party is not denying their activity in court, but rather claiming that it doesn't match existing laws, this would come into play.

But if you contest that or have an issue with the specific terminology I used, perhaps you'd prefer this terminology instead: "I don't think this is a good framework for interpreting the CFAA and establishing legal precedent."

Re:LinkedIn: It’s illegal to scrape our website without perm... by Spivak on Monday July 31, 2017 @10:24AM (#14892233)
I'm interested in this point. I was under the impression that the CFAA would apply here because they've explicitly stated what users are authorized and not authorized to do on their platform. Other than incur shame from the tech community they don't have to actually prevent the unauthorized access or use.
Re:LinkedIn: It’s illegal to scrape our website without perm... by jalfresi on Tuesday August 01, 2017 @04:17AM (#14898719)
The publisher of the information is ultimately responsible for the disclosure of the information. How it is read is of no consequence, as the information has been provided to be read. Certainly, there are issues about resource usage i.e. heavy readers, such as scrapers, but throttling is a perfectly acceptable approach to overuse of resources for both parties, as access is still available over managed resources.

The nature of the original complaint is authorised access to publicly published information. Again, if you do not want people to read publicly published information, do not publish it publicly.

And as a side note - we don't need inappropriate analogies; the web is real, we can discuss the real issue.

Re:LinkedIn: It’s illegal to scrape our website without perm... by aeorgnoieang on Tuesday August 01, 2017 @09:11AM (#14900246)
What LinkedIn is doing seems more like a pool threatening to sue people that look at the facility itself, from outside of their property. It's not clear whether viewing a public website is more (reasonably) similar to entering someone's property versus looking at their property from outside of it. To me, it seems much more like looking at it from outside. But, fortunately for LinkedIn, they can prevent people from viewing their site! (They just have to figure out for whom they want to do so.)
Re:LinkedIn: It’s illegal to scrape our website without perm... by rjp0008 on Monday July 31, 2017 @10:20AM (#14892211)
I like this analogy. I think maybe the answer would be to include technical limitations, like API limits so scrapers can only work as fast as a human. Or maybe captcha interaction like select all images of a car could be integrated? I think it should be up to the pool operator to make sure people follow the rules they put in place, not call the cops because someone is running.