71–80 of 454 posts
Were cookies shared across sites in 2008? It seems pretty odd..
Images are loaded with the cookies of their own site. Example: go to google.com, then open the console and type the following: var i = document.createElement('img'); i.src= " http://news.ycombinator.com/y18.gif "; Then look at the cookies sent over the network.
Would he not have a case of gross negligence against Zecco if he were a customer? Is there something preventing a lawsuit, outside of the possibly non-binding NDA?
No damages, assuming no unauthorized trades were executed in his account as a result of the unpatched vulnerability.
Earlier quoted context omitted.
Is this a test? Are we allowed to use Wikipedia? Because Wikipedia has a lot on it.
This was a test for understanding that a person not familiar with a particular field (e.g. GP and common law) will not be easily able to find a source on a particular aspect of that field and at the same time verify the information are more-less complete. Therefore, it's much easier for someone familiar with the field to provide a link to appropriate source. You, sir, have unfortunately failed that test.
Earlier quoted context omitted.
This deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.
Better yet: Short their stock, then write a scary blog post about the problem.
Although I guess it could help align customer and business goals, since no one wants to lose money
Earlier quoted context omitted.
No. But I can read.
Are you a heart surgeon? No but I can read. I'll stick to advice from subject matter experts, not self appointed experts.
Were cookies shared across sites in 2008? It seems pretty odd..
Earlier quoted context omitted.
This deserves more than an upvote. This is exactly the right attitude. It puts the incentives in the right place and will let the market do what she does best: work.
Better yet: Short their stock, then write a scary blog post about the problem.
http://www.pcworld.com/article/3155990/security/stock-tankin...
A company discovered vulnerabilities in some medical devices, then shorted the stock of the company before disclosing them.
The NDA is not a valid contract because there is no consideration. For a contract to be valid each party has to gain something. This is why many contracts include a token consideration of $1. This one didn't, so it's invalid.
Lesson learned: when reporting a vulnerability, record all discussions from first contact with the vendor. At least in cases where the vendor doesn't have a clear, easy to find policy and/or bounty for disclosures. I think it's totally fair to reject an NDA but I don't blame him for fearing an overzealous reaction on their part. Even being on the right side of criminal and civil law, you really do have to be willing…
I believe that you'd need to tell them that they were being recorded or you could get yourself into trouble. Edit: looks like this could be possible without getting into trouble depending on the state you're in: http://lifehacker.com/5491190/is-it-legal-to-record-phone-ca...
Earlier quoted context omitted.
Tell us what bank so we can avoid them.
I don't think it's HSBC, but they do similarly horrific stuff. Almost all banks have a truly terrible online service. I'm a happy user of N26. I very, very highly recommend it to all european customers. I'm never dealing with shitty bank service again. https://n26.com/ (Email me if you want a referral invite).