Abusing Amazon‘s Look Inside feature to leak unreleased content • Hacker News Board

Re: Abusing Amazon‘s Look Inside feature to leak unreleased content

#31

Post by clubm8 » Tue, Jan 01, 2019, 10:53 PM UTC

StavrosK wrote: post #18

clubm8 wrote: post #16

Earlier quoted context omitted.

Then next time someone finds an Amazon bug, they should release it 0-day on their blog for the lulz^H^H^H^H credit. Or sell it to someone who can make use of it. It's incredibly entitled for a company to not run a bug bounty program then complain when people drop 0-days on their github blogs.

If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing? I run a service that has a few users and makes about $200/mo. Someone once email…

>If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door?

Conversely, if you accuse the person who tells you the door is open of stealing from you and threaten to call the police, should you really be surprised if next time that happens they tell someone, maybe in exchange for a cut of the profit?

Re: Abusing Amazon‘s Look Inside feature to leak unreleased content

#32

Post by mpweiher » Wed, Jan 02, 2019, 4:52 PM UTC

StavrosK wrote: post #18

clubm8 wrote: post #16

Earlier quoted context omitted.

Then next time someone finds an Amazon bug, they should release it 0-day on their blog for the lulz^H^H^H^H credit. Or sell it to someone who can make use of it. It's incredibly entitled for a company to not run a bug bounty program then complain when people drop 0-days on their github blogs.

If you find that someone forgot their car door open, do you deserve money for not telling thieves where you can find a car with an open door? Bug bounties are a good incentive for hardening your security, but is exploiting flaws the moral thing to do by default? Does there need to be a monetary incentive for people to do the right thing? I run a service that has a few users and makes about $200/mo. Someone once email…

> their car door open,

Not at all similar. One is leaving open the door to your own car. The other is someone who is being entrusted with keeping something safe for third parties "leaving the door open", i.e. being in breach of that trust, and essentially saying that they don't give a frack about their infraction.

So how can Amazon be sanctioned for this infraction?

While I also don't see "breaking in" as necessarily a great option, it may be less bad than letting Amazon just get away with it. Unless there is a good way to fine or otherwise sanction Amazon, I am not sure there is an actual good option.

Re: Abusing Amazon‘s Look Inside feature to leak unreleased content

#33

Post by anoncake » Wed, Jan 02, 2019, 5:25 PM UTC

StavrosK wrote: post #26

anoncake wrote: post #20

Earlier quoted context omitted.

You can't afford aa bug bounty program. Amazon can.

Does that make it moral for someone to disclose the bug? "This parking lot leaves cars unlocked, but since they seem busy and aren't paying me not to, it's okay if I tell thieves about it".

Telling thieves in particular? Absolutely not.

Telling everyone (unfortunately including thieves)? I think it is. Such negligence should be disclosed.