Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

171–180 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#171

Post by solveit »

mcguire wrote: post #148
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down! Monitoring IP addresses? Really?

First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#172

Post by merpnderp »

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

It isn't stupidity. Government officials know this kind of thing will ultimately be a loser for them. But they know the mere threat of putting someone through the process of prosecution is punishment enough.

This is what we need to work on correcting. If a judge laughs your case out of court, there should be a severe penalty, especially if you're the government.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#173

Post by throwaway894345 »

solveit wrote: post #171
mcguire wrote: post #148

Earlier quoted context omitted.

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down ! Monitoring IP addresses? Really? First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?

It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#174

Post by idworks1 »

joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

> echo json_encode($search_results);

This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed.

Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took place, but why miss an opportunity to show you take the privacy of Missourians to heart.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#175

Post by Sebb767 »

theandrewbailey wrote: post #113
tombert wrote: post #75

Earlier quoted context omitted.

I think "view source" is a hacking tool invented by the notorious hacker group "4chan". I say we start a change.org petition to get Google to remove it from Chrome.

In all seriousness, considering Google's track record of discontinuing useful services and features, I expect Chrome to drop View Source any release now. It will be a sad day.

That would also be the day people would have a far harder time optimizing for Chrome. So they'd probably actually help the browser market by doing so.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#176

Post by comeonseriously »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

> ... someone from their IT department rang me on the phone and started grilling me about how many other plans I browsed, and insisted that I clear my cache and browsing history, and notified me that they would be watching to make sure nobody at our IP address didn't access any other plans while the issue was being fixed.

An IT employee who doesn't know about VPNs. Sigh.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#177

Post by mindcrime »

_0ffh wrote: post #34

I don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.

I don't think I can blame a politician for being technically illiterate, especially one that old.

I don't think age should excuse this guy at all, nor do I buy into the meme that age has much of anything to do with technical literacy. Consider that Brian Kernighan is ~78, Tim Berners-Lee is 66 (the same age as Governor Parsons here), James Gosling is also 66, Rob Pike is 65, Steve Wozniak is 71, Geoffrey Hinton is 73, and so on. And that's not even considering folks who were around so early they've already passed away, like Marvin Minsky, Dennis Ritchie, John McCarthy, etc.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#178

Post by josefresco »

logicalmonster wrote: post #112
josefresco wrote: post #27

FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…

What is the source of the pasted quote? I have no idea what kind of person the Governor is (outside of being technically illiterate) and am not interested in a partisan bickering match, but despite disagreeing with some points there, some of the actions listed there are arguably great moves (with the devil being in a lot of nuanced details that your list didn't go into)

It's from his Wikipedia page.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#179

Post by sophacles »

mmmpop wrote: post #109
josefresco wrote: post #27

FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…

Soapbox much? The dude's clearly a moron but this isn't a thread about any of the topics mentioned in your quote. You're actively making HN a shittier place with comments like this.

> You're actively making HN a shittier place with comments like this.

Please find your way to the nearest mirror and take a very hard, long look.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#180

Post by formerly_proven »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator.

It's pretty obvious that when you find a flaw you simply don't approach the people responsible for it, unless they have an EXCELLENT reputation of dealing with this. Otherwise do an anonymous full disclosure (edit: if you have an entity that routinely handles this sort of thing and has an EXCELLENT reputation, that would work too). If nothing happens, provide a PoC.

Of course people, even in IT, are kind of weird here. Somehow responsible disclosure got into people's minds as The Good And Proper Thing to do, and full disclosure being somehow irresponsible. Analogy: Some guy finds out the mayor is completely corrupt or does some illegal stuff. What do you do? a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf?

Post reply on HN