Nice you got something out of it, I'm not judging you either, but it was probably not the correct way to operate. What you should've done was notify the owners of the incorrectly configured system and left it at that.
You're also not a massive international conglomerate who should know better than to read every ones code and use it to turn a profit.
I use Github like a bank, not a public library (unless I'm working on open source). I never would've allowed them to read through all my code and use it for profits without at least asking.
Illegal would imply some kind of intent or malice. I was legitimately trying to access the executed result, which I would have been authorized to do if the service was operating normally.
> What you should've done was notify the owners of the incorrectly configured system and left it at that.
Seems unrealistic to "leave it at that". I had to read the output to understand it wasn't what I expected, and once I read it I knew how to code, at least to a cursory degree. The code was simple and it was a service I used frequently, so it was immediately clear how the code translated to the results I was accustomed to.
> I use Github like a bank, not a public library (unless I'm working on open source). I never would've allowed them to read through all my code and use it for profits without at least asking.
I don't know what kind of banks you deal with, but banks normally do read through your banking records and use that information to sell services to their clients – notably loans, which require knowledge of your deposits to offer.
Misconfigured CGI handlers in Apache were very common in the late 90s, treating Perl as text/plain. There's no laws being broken, just a bad httpd.conf and no one is getting locked up for malicious intent.
What if you intentionally or unintentionally took down a server that controlled important infrastructure which people depended greatly on? Flood warning system for example ?
Grow up.
Either way, I still think you're in the wrong, kind of like checking out a naked person getting changed because they accidentally left their blind open. It was available, maybe it was clever, but it's a strange way to learn how to code. Why didn't you just buy a coding book, or borrow some from the library ? Was the code really of good quality if the server was configured so badly?
Obviously we have a difference of opinion and that's ok.
Sure, you can argue that they were not supposed to read the code, so they shouldn't have. But without some tangible harm I don't see why we're supposed to disapprove of it. Maybe allow some hacker spirit while posting on Hacker News :-)