> It's illegal to come into my house and take my stuff even if I forget to lock my back door.
For some reason, on HN when I've made this argument before, the resulting comments have been that the internet is somehow different, and that real-world analogies don't exist. Using equipment that you don't own in a way the owners don't intend is apparently well-accepted.
This is a business and satellite bandwidth is fairly precious.
A better analogy would be going into a restaurant with big “No Outside Food” signs with a sandwich you made at home, hiding the sandwich in a false compartment to get past a check at the door, printing the restaurant’s name on your sandwich wrapper so it looks like you bought it there, and then eating it at a table meant for paying customers.
I love these analogies, but that's wrong. A better analogy would be you use their raw ingredients to make your own food, bring your own utensils and plates, and sit at their restaurant to eat. Basically, you're leasing their bandwidth without payment. Airlines are paying viasat or some other company for access to their satellites and expecting customers to pay the cost for usage (and probably make some profit).
Regardless of the criminality a real world analog would be more akin to someone taking a chair in a starbucks without paying - maybe there's room, and maybe it doesnt burden them unduly - but the company definitely pays a cost for each table aggregated across its customers.
It's not victimless, the loser is the service provider whose bandwidth is consumed. The line many draw is that corporations aren't people and can't be the victim, this is a false analogy.
Thus: let's switch who is penalized: everyone else on the flight. Bandwidth isn't unlimited, without payment it's hard to justify increasing bandwidth if it isn't profitable.
What should the author do? Report it. If he didn't, maybe you can submit it to the company. If they have a bug bounty, you may get paid (if this happens: would you give the money to the original author?)
If you run a company: you should determine how to insensitivise reporting, it's possible in this case: not fixing it spreads awareness, most people can't/don't exploit it.
What you're describing (someone entering your property, having their lunch in your garden and cleaning up before leaving) meets all the elements of physical trespass if the owner of the property didn't grant permission, and is unlawful. Now, the damages might be minimal, but it's still unlawful.
In the U.S., property law is about the right to control access and use -- harm is a secondary concern.
Well, mentally ill people sometimes do break into houses and do harmless things, like making a sandwich or taking a shower, and this generally has severe consequences for them even though it was not malicious, and is of course experienced as a shock and/or violation by the owner who discovers it.
It's really weird that this is presented as normal so frequently in a virtual context.
Granted that's still a crime. You probably won't use the video recording of that guy to file a police report (unless you suspect he did something else on your property, which would be like the author also running aggressive nmap scans) just as viasat is probably not going to file a lawsuit.
maybe more like someone entering a restaurant, sitting down at one of their tables and eating a lunch they brought themselves, or just reading a book, taking up that table during a busy lunch period.
Equating entering buildings with communicating with computers on the internet really is an awful analogy. You can stand in front of a building and be able to tell whether it's a house or a store, i.e. a building meant for private access or for public access. You can also tell a difference between a back door and a front door by looking from afar. You can do neither of these things with computers. You can't look at it from afar to give you clues, you need to communicate with it. The way computers communicate is dictated by protocols. Protocols will tell you stuff like whether you're allowed to talk to them or not. TCP includes telling you whether you're allowed or not via its protocol. HTTP will tell you whether you're allowed or not via its protocol. If the protocols don't tell you they're unwilling to talk, and continue by talking to you, you can only assume its ok for them to talk to you.
When you first try to communicate with a computer, you can't even know it exists until it replies to you. For the analogy with entering buildings to hold, everybody must be blind and deaf and all buildings must be the same from the outside. Under these conditions, you need to lock your doors, because the only way for anyone to be able to differentiate a house from a store is whether or not the door is locked (TCP connection accepted or rejected). When they approach a door, they can't even tell if the door is really there. They might just grasp the air when they reach out with their hand (TCP timeout from lack of response).
A better analogy is people talking. Everybody is still blind but not deaf. Let's say your robot slaves are talking. Your robot, probably bored, calls out to somebody, "Robot 10?". A robot replies, "yeah?". So, now you know they exist and they're willing to talk to you; you've initiated a TCP connection. "So, how's it going?" your robot asks; HTTP GET /. "My master got married last week.", he responds; HTTP 200 OK. Then comes out his master from behind the curtain, and says "No! It was never my intention for my robot to give out this information. In fact, it was never my intention for my robot to reply to anything anyone ever said. This is your fault!", pointing at you. "You called out to Robot 10, and he replied when it was never my intention for him to reply. He should have said, 'Sorry, I don't talk to strangers' (TCP connection rejection or HTTP 403 Forbidden) or refused to talk (TCP timeout from lack of response) or something. I could have told him to keep quiet, that such things are confidential, but... but... but you should not have called out to Robot 10! You're a criminal! Don't ever do that again. I may just have configured him incorrectly to die whenever he hears a greeting and that will be your fault too if you greet him! I'll charge you with murder for greeting him! and I'll sue you for compensation for the damages I incurred from my robot not being able to do some work for me while being dead."
We could disregard a computer's configuration as indication of their master's intent. However, that doesn't mean not entering someone's house via the back door. It means not talking to anyone ever for fear of them turning around and accusing you for talking to them or for hearing stuff they willingly told you.
For some reason, on HN when I've made this argument before, the resulting comments have been that the internet is somehow different, and that real-world analogies don't exist. Using equipment that you don't own in a way the owners don't intend is apparently well-accepted.