Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

191–200 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#191

Earlier quoted context omitted.

If it is served via https, it is encrypted. Edit: sorry, forgot the /s

I knew u forgot the /s. If the Governor understood https and encryption, he wouldn't be penalizing the reporter for "View Source". Clearly he got caught at being incompetent and he is doubling down on "how dare you"

nono - 'view source' is really the 'hack this website' button, it's just called 'view source' to keep the bad guys from knowing about it.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#192

Earlier quoted context omitted.

If it is served via https, it is encrypted. Edit: sorry, forgot the /s

I knew u forgot the /s. If the Governor understood https and encryption, he wouldn't be penalizing the reporter for "View Source". Clearly he got caught at being incompetent and he is doubling down on "how dare you"

Well you see the Internet is not something that you just dump something on. It's not a big truck. It's a series of tubes!

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#193
I commented days ago about a state website that was returning all kinds of nicely formatted NPI in JSON from an API response, but the NPI was not displayed. I donned my black hat and other hacker attire and pressed F12 to open the browser's developers tools (a tool created by a shifty company named Google most people have never heard of), and there it was, plain as day, SSNs, addresses, etc. I closed the page and never touched it again. I knew what's happening in this story could happen to me. I knew my side of the story would rarely be told and that my fate would lie in the hands of a judge who views the F12 key with distrust and fear and a jury of my "peers" who are not actually my peers in any skill or know-how related to the case.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#194
post #34

I don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.

I can't stress how differently power works in the Southern States (EDIT: Missouri is a midwestern state officially, but I've always considered it part of the South). It's a very traditional place, where you do not dare contradict, let alone correct, your boss. There is none of this "avoid surrounding yourself with sycophants because they will only tell you what you want to hear" business. There is no upside to speaki…

Missouri is not even remotely considered to be in "the south". At least not by those who live there or in neighboring states.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#195

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

> After I shopped a few other companies to see how our plans compared

Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore.

If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential info for your own gain or curiosity, that's not so cool.

> Perhaps it's more difficult to hold yourself accountable than it is to assume that others who've found your shoddy work are malicious actors.

You literally just admited to being a malicious actor in the paragraph above.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#196

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

Domestic abuse is pretty "normal" too. That doesn't make it tolerable.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#197
post #166

Earlier quoted context omitted.

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?

the web isn't a collection of personal apartments

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#198

FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…

What is the source of the pasted quote? I have no idea what kind of person the Governor is (outside of being technically illiterate) and am not interested in a partisan bickering match, but despite disagreeing with some points there, some of the actions listed there are arguably great moves (with the devil being in a lot of nuanced details that your list didn't go into)

[deleted]

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#199

Why is everyone here acting like the governor is merely stupid? He is not arguing from ignorance, he is arguing in bad faith. Mike Parson wants to feed the narrative that the American free press is the "enemy of the people" because it suits his politics, nothing more. The only message here is "be careful embarrassing fascists."

Nearly all politicians act like this when they're in power. The general public is easily mislead. HN notices it when it's a tech issue, but it happens in economics, medicine, basically everywhere. They have zero incentives to accept responsibility.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#200

Earlier quoted context omitted.

It's ok, the disclosure is also encrypted.

No it's not, you forgot to wrap it in an " " tag.

Don't forget the tag or else the rest of the internet's traffic will be encrypted forever.
Post reply on HN