Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

241–250 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#241
post #222

Earlier quoted context omitted.

Sounds kinda mean spirited to mock of the accent of someone who is presenting in their second language.

I believe it isn't about mocking but making the point about US / Russia and nuclear weapons

It's a Star Trek quote:

https://www.youtube.com/watch?v=MdSJFrhb-HM

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#242

We've seen two[1] cases[2] of this in Denmark in the last couple of years surrounding systems that kindergartens are using. The second one is currently (still) being investigated, but the first one was rightfully concluded earlier this year with the "hacker" being acquitted. In both cases, it was dads of children in the institution that noticed the bugs when they were rightfully using the system and were ignored when…

Translated to English:

1: https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...

2: https://translate.google.com/translate?hl=en&sl=da&tl=en&u=h...

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#243
post #194

Although deeply unfair, this is not unusual, there have been many reported cases of companies shooting the messenger. Unless the company concerned has a well documented and trusted bug bounty procedure, it can be very risky to report a bug in a system, if it involves any kind of hacking. What happens is once the "bug" is reported, someone inside the company asks "How did this happen?". Now the person responsible has…

One thing that solves this is stating the obvious, something getting hacked means someone was incompetent.

Indeed, I fail to see the distinction. Perhaps "hackers" have some kind of mythical superpowers in the eyes of the common folk.

"There was nothing I could do boss! He's a hacker!"

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#244

> someone found out that the admin password was adminadmin and managed to log in using that. Wtf ,I thought I was bad at my job.

Conversely, the person who set it to adminadmin probably thought they were doing a great job.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#246

Earlier quoted context omitted.

Such companies are usually extremely shady and unethical, I would not consider it evil at all to delete all of their recorded debts via tor or something.

Would you gladly go to prison for it?

An interesting moral query: how much debt erased is worth a prison sentence of X years?

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#247
post #90

Earlier quoted context omitted.

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

There's a saying that democracy is not when a government gets installed by fair elections, democracy is when a government gets removed by fair elections. Hitler was democratically elected as well, that is not sufficient to label his regime as democracy.

> Hitler was democratically elected as well

No he wasn't, it is not that simple. His party at that time had no majority despite being the largest one. He got appointed chancellor not by democratic vote but by backroom negotiations - mostly because he was expected to be easy to control.

From this state he went for the dictatorship but again not by democratic election but rather by scaring the other parties into voting him the Enabling Act in 1933 after the supposedly communist-inspired Reichstag Fire.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#248

In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single repl…

If they use Google's GSuite for their emails, I think that prefetches all content and makes beacons pretty useless (by design).

They don't, usually companies in my country opt for a home rolled solution, or Microsoft Outlook.

That aside, Streak.com's beacons work even in Gsuite readers! They're awesome. It's essentially just a unique image included in the email body.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#249

Earlier quoted context omitted.

My understand was that you just threaten to do those things but don't actually follow through on those threats. Then it's grey hat and ethical but still not legal. If they actually pay the bitcoins and don't fix the issue then you despair and go on with your life. It's hard to spend the bitcoins without deanonymising yourself, but you can try to give them to charity or something.

No, simply making that threat ("send Bitcoins to , or I your database") is very definitely a crime (and black hat, and unethical) even without any followup. That's as classic as it can be, there's nothing new or technology related about this - for example, sending an anonymous message "Send cash or I'll burn your house" is a crime (and unethical) even if you don't burn anything. It is a crime (and unethical) even if…

Like I said above, it is a crime. But it's ethical because it's intended to force them to fix their system before someone does something much worse.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#250

Earlier quoted context omitted.

Has it? Can you link to it?

General info: https://en.wikipedia.org/wiki/Anti-circumvention#European_Un... More about the directive: https://en.wikipedia.org/wiki/Copyright_Directive Actual text of the directive: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:320... (see Chapter III, containing things like "Member States shall provide adequate legal protection against the circumvention of any effective technological measures" and then…

Thanks!
Post reply on HN