HTTP Status Code for Legally-restricted Resources

http://tools.ietf.org/html/draft-tbray-http-legally-restricted-status-00

by tete • 14 years ago

174 57 14 years ago

tools.ietf.org

solox3• 14 years ago

> The use of the 451 status code implies neither the existence nor non-existence of the resource named in the request.

If something didn't exist at all, why would I send a 451?

> The 451 status code is optional; clients cannot rely upon its use

So... everybody can ignore 451?

phoboslab• 14 years ago

> If something didn't exist at all, why would I send a 451?

You just don't acknowledge the existence.

> So... everybody can ignore 451?

The status code is optional in the sense that you don't have to use it if a resource is unavailable for legal reasons. You can use it if you want to inform the user what exactly is going on.

schiffern• 14 years ago

>You can use it if you want to inform the user what exactly is going on.

That's exactly the purpose.

>The 4xx class of status code is intended for cases in which the client seems to have erred. Except when responding to a HEAD request, the server SHOULD include an entity containing an explanation of the error situation, and whether it is a temporary or permanent condition. These status codes are applicable to any request method. User agents SHOULD display any included entity to the user.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

delinka2• 14 years ago

If you're trying to "hide" something on the web, there's 401 Unauthorized and 404 Not found. If you cannot acknowledge the existence of a resource, either of these status codes would be fine. If, however, you feel the need to correctly communicate that a resource is legally unavailable (whether or not it exists), then 451 is an alternative.

But, no one ever said status codes had to tell the truth.

sequoia• 14 years ago

requesting info on a real, existing user on illegal-in-USA.ru

    -> GET /users/real-user-name HTTP/1.1 Host: illegal-in-USA.ru
    <- HTTP/1.1 451 Unavailable For Legal Reasons

requesting info on a fake, nonexistent user on illegal-in-USA.ru

    -> GET /users/no-such-user HTTP/1.1 Host: illegal-in-USA.ru
    <- HTTP/1.1 451 Unavailable For Legal Reasons

If the .ru site sent 404s for nonexistent users and 451s for real ones, you'd be able to gather potentially useful information. It's like if I go to bad-porn.com and type your email into "forgot my password", it should neither confirm nor deny the existence of your account, simply tell me the request was received. In any event if delivery of the requested resource is legally prohibited, why would I go to the trouble to determine whether the resource exists?

A final analogy: 10 year old enters US gas station: "Have you Marlboro 100s, menthol?" gas station attendant (without checking whether or not he has this particular brand/style of cigarette): "get out of here, kid. [HTTP/1.1 451 Unavailable For Legal Reasons]."

unwind• 14 years ago

Interesting to see Tim Bray (http://en.wikipedia.org/wiki/Tim_Bray) still being active at this level of the web's development.

Not sure I see the applications of this, but I guess more high-level error messaging is something that is in general a good thing so I guess that should hold for the web, too.

popee• 14 years ago

Application will be www.google.com, www.youtube.com, etc. They'll get censorship instruction from gov bodies. There are two things that are obvious now, fight google vs facebook is like who will be big brothers right hand and other is that RMS was right. Sad thing is that it is first time in human history that evil oligarchy can be beaten by engineers (google, facebook, ...). Too bad they don't get it :-(

junto• 14 years ago

Can we rename this to the "MPAA/RIAA HTTP Status Code"

wmf2• 14 years ago

No, because the MPAA/RIAA don't run the Great Firewall or other government censorship systems.

JaimeDiamond• 14 years ago

They don't run it... they just dictate how it should run and hire believers to run it.

bashzor• 14 years ago

Is this a troll or something?

sgift• 14 years ago

Maybe, but if I have to guess differently than you think: They probably want to use this to "troll" governments and heavy users of DMCA take-down notices. These people usually don't like it if users notice that they were responsible, so this is against their interests.

Reminds me of this: http://news.ycombinator.com/item?id=4048828

delinka2• 14 years ago

I think it's a fabulous idea. Request and item that been the subject of a takedown notice, receive the details of who produced the takedown.

jaachan• 14 years ago

There are situations where a resource is blocked, but transparently. For example, the pirate bay is blocked in some countries. However, it's done publicly, and that the site exists isn't denied. The ISPs that effect the blocking could use this status code to inform people who try to visit it that the site does exist, but they can't access it because the government says so. This could, in theory, divert activity towards the ISP (which has nothing to gain from implementing such blocks) to the government. That is, instead of spamming the ISP's helpdesk, they could petition their representatives.

Of course, in some situations the block is supposed to be also denying the existence of the site, and in such cases this status code wouldn't apply. That's mentioned in the RFC (section 4.1).

sanxiyn• 14 years ago

I love the example.

FYI, 755 AUC is 2 AD, so the example is referring to the time of Jesus.

zedr• 14 years ago

It's a joke reference to Monty Python's "Life of Brian".

rmc2• 14 years ago

In 2 AD Jesus wasn't really doing much.

Given the references to "Judean Liberation Front", it's almost certainly a reference to Monty Python's "The Life of Brian" film.

ChuckMcM• 14 years ago

Which was the Judean People's Front, or their arch enemy the People's Front of Judea.

cagenut• 14 years ago

This can't be a coincidence right? Its a way of saying that DMCA/lawsuit takedowns are digital book burning.

pavel_lishin• 14 years ago

Except there are plenty of legitimate DMCA takedowns.

jlgreco• 14 years ago

A 451 could be used in a lot more cases than just DMCA takedown'd documents.

gue5t• 14 years ago

There have been plenty of "legitimate" book burnings.

ktizo3• 14 years ago

Destruction of 'counterfeit' media. Because after all, just because you have a vast zero-scale network on which to distributively backup the collected artistic works of society in real time, doesn't mean you should, obviously. I mean, that would amount to the most complete open library of knowledge ever created in history, which would make so many existing business models obsolete that we just can't justify doing it, for the sake of the economy, cos y'know, money works, right?

mfer• 14 years ago

It seems some inspiration behind this is in the blog post at http://shkspr.mobi/blog/index.php/2012/06/there-is-no-http-c...

rickard2• 14 years ago

And specifically the referenced slashdot discussion and comment: http://yro.slashdot.org/comments.pl?sid=2906113&cid=4027... Indeed, very amusing and to the point.

marquis• 14 years ago

Fahrenheit 451, drafted in the last couple of days in honour of Mr. Bradbury? I do find it fitting that if this passes, we have a cultural reference to remind of its significance. I look forward to seeing some interesting error pages in the future.

ktizo3• 14 years ago

Was only the other day that my mate pointed out to me that 451 is DEA if you transcribe it. And after all, there are all kinds of paper and they don't all catch fire at one given temperature, do they?

fennecfoxen• 14 years ago

If I recall correctly, Mr. Bradbury called a firehouse and asked the guy there "what temperature does paper ignite at?" and they thought about it for a moment and looked up some value in a reference manual. So don't go reading too much into the number. Also, note that the (US) DEA was founded in 1973, while _451_ was published in 1953.

Also, casual Internet browsing suggests values closer to 450 celsius for the autoignition point of typical paper, so don't go relying too much on any one number you get from the title of a book (or from a hacker news post, for that matter)

drivingmenuts4• 14 years ago

The 400 series implies that there was an error on the client side, when there clearly isn't one. The client has made a valid request that a middleman refuses to honor.

This better fits into the 300 series as a permanent addition.

rada• 14 years ago

300s indicate that client must take a follow-up action to fulfill the request. This would be misleading as the request is denied permanently.

Further, the closest match among the currently implemented statuses is a 403. As per the "Acknowledgements" section:

Thanks to Terence Eden, whose blog observed that the existing status code 403 was not really suitable for this situation, and suggested the creation of a new status code.

strictfp• 14 years ago

Fill out a petition? :)

rickard2• 14 years ago

Isn't it quite close to both 403 Forbidden, "request was a legal request, but the server is refusing to respond to it" and 401 Unauthorized? And now it's on the wikipedia http://en.wikipedia.org/wiki/HTTP_status_codes , and that equates with being approved, right?

kijin• 14 years ago

TIL Microsoft uses 450 for parental control. And now 451 for legal censorship. Perhaps we could use the 450-459 range to signify various censorship scenarios. The 450s is also a nice middle ground between 400s and 500s.

xorbyte• 14 years ago

The argument against 403 is that the server might not get to the resource at all, so it doesn't get a chance to refuse the response. A router with filtering capabilities might also terminate the connection and return 451 if the target server is censored and won't be reached. (wether that's practically likely to happen—e.g., at the Great Firewall, or for ICE seizures—is a different matter entirely)

RyanMcGreal• 14 years ago

The client's 'error' was in requesting an illegal document.

Anyway, status code 451 was picked for a particular reason.

drivingmenuts4• 14 years ago

Propaganda is a poor excuse for a technical decision. Such decisions should be made on a rational basis, not because someone got their feeling bent out of shape or for political reasons.

Yes, I understand the rationale. I agree that there needs to be a code to denote "Access denied due to legal reasons". But I also know that personal is not the same as important, and in this case, a decision is being made that we'll be stuck with for quite some time to come and the choice of the code is purely a propaganda play.

At any rate, the client has not made an error. The client is the requesting entity (ie., browser or other program). The client in the error message does not refer to the potential human that may have caused the client to initiate the request.

Unless you can magically plug an ethernet connection into your mouth and spew http requests.

EdiX• 14 years ago

401 Unauthorized, 402 Payment Required, 403 Forbidden, 410 Gone are all 4xx error codes. I could see an argument for just using 305...

SoftwareMaven2• 14 years ago

300s are about telling the client where to really find the content.

400 is about an error the client may be able to do something about (eg log in, move to a new country).

500 is about something going wrong on the server that you have no control over at all.

This belongs in th 400 range and, as such, using the symbolic 451 is not only OK, it is a great idea.

moe• 14 years ago

Following your description I'd put it in the 500 range.

noblethrasher• 14 years ago

3xx is the server telling the client to do something.

4xx is the server telling the client about the world. 5xx is the server telling the client about itself.

gouranga• 14 years ago

The fact that this even has to exist saddens me.

However, I'm glad there is a distinction between not available and not there.

inlined• 14 years ago

I'd believe the Bradbury conspiracy theories since this should otherwise be a 5xx error code for server errors. The client certainly didn't do anything wrong (4xx)

recursive2• 14 years ago

Isn't this analagous to a 403?

jsprinkles• 14 years ago

Technically, the client did err, as it performed a request that is not legally permitted in its jurisdiction. For example, this response could be used for geographically-limited resources (such as BBC iPlayer), which means your client erred by not being in Britain.

If it's a takedown of some kind, your client erred by being subject to a government that ordered you unable to see the resource that you requested. The 4xx code fits, in this case, as 5xx implies the server made a mistake (it didn't).

scotty79• 14 years ago

There should be optional(?) "Location" header pointing to url where you can download the restricted document from. Might be magnet link.

HTTP Status Code for Legally-restricted Resources

Related Stories