Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

61–70 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#61
post #4

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru

That is weird! Would you mind providing your system configuration and Firefox version info so I can file a bug? (Or you could file one here yourself if you're so inclined: https://bugzilla.mozilla.org/enter_bug.cgi?format=guided#h=b...)

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#62
post #4

Side note: this page gives me the weirdest Firefox behaviour I've ever seen: https://gfycat.com/HandyRapidJabiru

I want to emulate that behavior somehow.

So I tried but the results were... um, unexpected: https://gfycat.com/negligiblesnivelingastarte

Code:

    var db = document.body;document.onscroll = function(){db.style.transform = 'scaleY(1)'; db.style.transform = 'scaleY('+db.scrollHeight / (db.scrollHeight - db.scrollTop)+')'}

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#63
post #7

I remember coming across a serious bug in a site that belonged to a top multi-billion company. My brother also found what essentially an unrestricted privacy leak (and possibly editing access) in a top university (leaked data is sensitive personal information, not academic). Neither of us reported (or exploited) what we found. Protection from this kind of blame-shifting and misdirected retaliation should be guarantee…

I was more naive, but it worked out. Reported a vulnerability and how to fix it to a regional bank when applying for a student loan. They asked me to come in person to explain it and dropped a point off my interest rate. In hindsight it was a huge risk and I was dangerously trusting.

If you are nice and don't threaten to publish, at least without giving them any time to fix it - which for a large back is a couple of months - then I don't think it's a risk at all.

What they don't like is the publicity.

Edit: but maybe not in Hungary. It's the bad child in EU.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#64
Once there was this website which offered phone number to location service.

They had a form you could try the demo where it sent an SMS to verify and only allowed one query.

If you looked at the source of the page it had hidden fields to override the SMS verification and allow multiple queries.

I freaked out some friends for the day and nearly contacted a journalist but lost interest after some weeks.

I could have had my 15 minutes of fame or be on some list, or both.

It's alright, had some fun.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#65

Earlier quoted context omitted.

Please don't spread fake news! The metro system is owned by the city, and ultimately the government. With all its problems, it is still not a mafia. Although you are in a different part of the world, but when visiting the poor and backwards Eastern Europe, please use your common sense, or at least do some fact check.

TBH in Eastern Europe something being owned by government usually means that it's being ran (basically owned) by mafia.

Why does a group of criminals need a subway? As a local guy using the public transport on a daily basis, I highly doubt this.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#66

Earlier quoted context omitted.

TBH in Eastern Europe something being owned by government usually means that it's being ran (basically owned) by mafia.

This is simple demagogue populism. This is not a critique of the problems, and does not start any fruitful discussion, and will not lead eventually to better conditions.

Actually that is a critique of a problem. Because one of the biggest problem of Eastern Europe is corruption which leads to many different problems, that eventually result in such stories.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#67
Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#68

Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

They took him as a criminal, got his fingerprints, took a photo of him. I do not think they proceeded this in the right way. They should have fixed the bugs, protect our personal data and say sorry for this.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#69
post #68

Actually he exploited the bug and purchased a ticket for the fraction of the price and than reported it to the public transportation company. The company that runs the infrastructure (not the public transportation one) followed its internal policy and Hungarian law reported the incident to authorities. Police brought in the guy for questioning.

They took him as a criminal, got his fingerprints, took a photo of him. I do not think they proceeded this in the right way. They should have fixed the bugs, protect our personal data and say sorry for this.

No, they brought him in as a person of interest following Hungarian law. If you do not like the law please vote the next election a party that changes that or move to a country that does not require police to follow the law. Determining if he is going to be charged with a crime is at later stage in the investigation anyways. There is no such a thing as "They took him as a criminal".

Moreover, it is not only Hungarian but also European law to report incidents involving personally identifiable information leaks and there are authorities that investigate and fine companies failing to comply with the law. Any person (including you) can report such companies to authorities.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#70

Earlier quoted context omitted.

That's probably the weirdest browser behaviour I've seen on any browser! I don't even know how I would describe that to someone :/

Like it's printed on some form of mathematical hyper-rubber sheet, and scrolling pulls it down until it stretches into invisibility, rendering the next rubber page visible.

ITS A BAD CASE OF THE STRETCHIES
Post reply on HN