> Security research is my hobby.
Yet you are not prepared for an important consequence of the results of your research.
Perhaps you should consider changing hobbies.
Ask HN: Found a leak of US citizens personal data. Should I report it?
61–70 of 85 posts
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#62EFF perhaps. They have lawyers.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#63Nothing. Burn all the evidence (literally or figuratively as appropriate, use common sense) and walk away. If you're expecting gratitude, if you expect the company to say "my goodness, thank you for finding our security hole", you are setting yourself up for bitter disappointment. Better if you were never here and knew nothing.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#64Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#65Earlier quoted context omitted.
I don't understand your question. Care to elaborate?
Then I probably don't understand your first response.
I'm just pointing out the cognitive dissonance of seeing something that's literally happening in the US and saying it sounds like China.
It doesn't sound like China. It sounds like the US, because it is.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#66Earlier quoted context omitted.
Then I probably don't understand your first response.
I'm just pointing out the cognitive dissonance of seeing something that's literally happening in the US and saying it sounds like China. It doesn't sound like China. It sounds like the US, because it is.
Well I hope its just overthinking of users of HN that guess what would happen.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#67These comments are doom and gloom from people who have read articles but haven't been there. I've reported over a dozen medium size leaks and not once has the company tried to come after me. They haven't all fixed them, and for those I haven't pushed, but most of the time they're grateful. If you're worried, contact Troy Hunt and have him be an intermediary for you, as others have suggested.
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#68Maybe frame it as a regular bug in a legitimate use context? Lead them to their own discovery of the vulnerability, and they'll think they found it all on their own.
"Oh I used your sample API call but I keep getting out of memory errors."
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#69These comments are doom and gloom from people who have read articles but haven't been there. I've reported over a dozen medium size leaks and not once has the company tried to come after me. They haven't all fixed them, and for those I haven't pushed, but most of the time they're grateful. If you're worried, contact Troy Hunt and have him be an intermediary for you, as others have suggested.
At best you get a pat on your back, at worst you go to jail: why should anyone take the chance?
Re: Ask HN: Found a leak of US citizens personal data. Should I report it?
#70These comments are doom and gloom from people who have read articles but haven't been there. I've reported over a dozen medium size leaks and not once has the company tried to come after me. They haven't all fixed them, and for those I haven't pushed, but most of the time they're grateful. If you're worried, contact Troy Hunt and have him be an intermediary for you, as others have suggested.
These comments are doom and gloom from people who have read articles but haven't been there. I've crossed the local railway tracks, blindfolded and earmuffed, for over a dozen times, and not once has a train hit me. If you're worried, contact a random australian dude working for one of the biggest cybersecurity threats on the planet, who also seems to pass time by counting cars that pass over a nearby bridge, and have him be an intermediary for you, as others have suggested. It will be great!