Terrible analogy. A webserver is not at all like a door. It doesn't block or allow traffic to and from your file system.

A web server is more like a receptionist. It handles requests. "Can I have your basic catalog?" "Certainly, here you go."

"Can I get this item from your basic catalog?" "Certainly."

"I don't see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?" "Absolutely."

"Can I borrow your stapler?" Sure. "How about a pad of paper?" "Of Course". "Can I just have the contents of your supply closet?" "Here you go." "How about your accounting files, can I get those?" "No problem!" "How about your entire customer list?" "Consider it done!"

When you hire a receptionist and specifically tell them to give customers anything they request, that's entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.

This wasn't burglary. This was putting up signs that say "come in" and labeling everything in your house with "free" stickers.

Thank you! I feel like I'm taking crazy pills reading people's reactions to this. And if it was a business instead of your house and it was customer data you weren't protecting you should still be in trouble too. It's like people think only one side can be in the wrong in this or that because the data wasn't secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you're a homeowner your name is attached to the property and is publicly accessible.

@SpaceCowboy @JackbyDev In a legal context there's also the concept of a "reasonable expectation of privacy". The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access. A better analogy is putting your journal in a public library and getting mad when somone reads it.I'm not saying what these ass holes did was right, I'm saying that the company weakened their legal position by not protecting the data.