• 0 Posts
  • 17 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle
  • I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to.

    Doesn’t work like that. With the policy you describe, anyone who ever sees a “404” error is a criminal.

    I don’t have to publish everything I am willing to offer. You are free to ask for something I may or may not have. I get to decide how to respond to your request.

    To use your analogy, I can walk up to your door and request a glass of water. You’ve never explicitly offered a glass of water to anyone; I’m still allowed to ask. If you dont want me to have your water, you can say “No” or you can ignore me.

    When you go ahead and give me a glass of water, you don’t get to claim I stole it from you. It is not theft to ask.

    You have to make some sort of effort to have your web server limit my access, and I have to make some sort of effort to convince your webserver to bypass those restrictions before you can claim I am exceeding my authorization.


  • Terrible analogy. A webserver is not at all like a door. It doesn’t block or allow traffic to and from your file system.

    A web server is more like a receptionist. It handles requests. “Can I have your basic catalog?” “Certainly, here you go.”

    “Can I get this item from your basic catalog?” “Certainly.”

    “I don’t see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?” “Absolutely.”

    “Can I borrow your stapler?” Sure. “How about a pad of paper?” “Of Course”. “Can I just have the contents of your supply closet?” “Here you go.” “How about your accounting files, can I get those?” “No problem!” “How about your entire customer list?” “Consider it done!”

    When you hire a receptionist and specifically tell them to give customers anything they request, that’s entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.

    This wasn’t burglary. This was putting up signs that say “come in” and labeling everything in your house with “free” stickers.


  • You have to do it right, but yes.

    There is a school in the US that converted stalls into actual rooms, which was good. But the way the law was written, the area outside the stalls was considered a prohibited, unisex "changing area’ because it was private rather than public. The solution was to make it a public handwashing area. But the way they did it was by cutting a window into the former “changing area” to make it public rather than private.

    So it got reported by Republicans as a Democratic attempt to spy on kids in the bathroom. And since it was one of the bathrooms intended to accommodate trans students, it got reported as Republicans trying to spy on trans kids.

    Basically, they did everything right, but pissed off everybody in the process.





  • To me, it seems like they are arguing that “testing” whether a hammer can smash your thumb doesn’t actually provide any useful information on the safety of a hammer.

    To me, it seems they are saying that Estwing makes a better hammer than Fischer-Price, even though the Fischer-Price hammer is far less likely to cause injury if you hit your thumb.

    All this article says is that we shouldn’t give a toddler a real hammer, and we shouldn’t stuff a general purpose LLM like ChatGPT into a Tickle-Me-Elmo.