Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

181–190 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#181

Post by natechols »

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

Read more history! (Especially read what the Wilson administration did to the Socialists - the origin of the phrase "yelling fire in a crowded theater." Many of us would riot if this happened today.) Stories like this have been happening since long before I was born, and will continue to happen long after I die, because voters will continue to elect stupid people some fraction of the time. The correct response isn't nihilism, but constant vigilance, and constant shaming of elected officials who abuse their powers.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#184

Post by frumper »

throwaway894345 wrote: post #173
solveit wrote: post #171

Earlier quoted context omitted.

Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down ! Monitoring IP addresses? Really? First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?

It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.

If he can monitor ip addresses to make sure this guy isn't browsing anymore, then he should be able to check those same logs to answer his own question. If you want people that have zero obligation to help you then you should probably be nice to them. The nefarious criminal isn't going to report things like this to you.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#185

Post by josefresco »

mmmpop wrote: post #109
josefresco wrote: post #27

FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…

Soapbox much? The dude's clearly a moron but this isn't a thread about any of the topics mentioned in your quote. You're actively making HN a shittier place with comments like this.

The title only said "Governor" so I was like "gee, who is this guy/gal?" and so I RTFA and went back to the comments. Many were still referring to him as "Governor" and not by name so I thought it would be useful to mention his name. I then started reading his Wikipedia page and discovered he's a real piece of crap (IMHO) and decided to include that summary in my post. Am I starting crap? Maybe, but I think some background on his recent decisions in his role as Governor would be relevant to an article questioning a recent decision in his role as Governor.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#187

Post by kamkazemoose »

klyrs wrote: post #166
mcguire wrote: post #148

Earlier quoted context omitted.

I don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#188

Post by dzhiurgis »

formerly_proven wrote: post #180
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

Local CERT is sometimes happy to be a proxy, still best do anonymously tho

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#189

Post by thepete2 »

formerly_proven wrote: post #180
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

That comparison is a bit off though, because exposing the mayor's corruption doesn't put other people and their data at risk.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#190

Post by vageli »

throwaway894345 wrote: post #173
solveit wrote: post #171

Earlier quoted context omitted.

Being wary of the guy, sure. But it's a terrible response in general. The correct response is to take the site down ! Monitoring IP addresses? Really? First, it's trivial to just use a different IP address. Second, even if you could track people perfectly, which you can't, who the hell thinks it's okay for data to get leaked as long as you know who it gets leaked to?

It’s not a nice response, but IT needs to be able to answer questions about the extent of a given breach (what info was accessed by whom and when). This is a legal requirement in the case of health information. Ideally people could be courteous while fulfilling their legal obligations, but IT folks aren’t generally chosen for their public relations or customer service skills.

In those situations you get a third-party in for forensics, you don't typically ask the people who breached how large the breach is (why would you take them at their word anyway? aren't they incentivized to downplay, etc).
Post reply on HN