Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

231–240 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#231

Post by vbo »

There are developers out there that look like you and me, use the same tools and speak the same (programming) languages, yet have absolutely no concept of access control.

I feel there's an enormous education/awareness gap when it comes to basic security practices and it's going to hurt all of us sooner or later by having our private information leaked, sold, abused, maybe ultimately deemed irrelevant in itself -- ie what would the world look like if all (or a significant chunk) of private information was leaked and you couldn't trust the old tokens of identity?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#232

Post by Shared404 »

tombert wrote: post #214
Shared404 wrote: post #162

Earlier quoted context omitted.

I think "view source" was actually invented by the Russians, then leaked by "4chan" - They're an individual, not a group. You probably got it mixed up with Lunix, that was invented by "4chan".

Completely tangential, but have you seen LUnix (Little Unix)? It's actually pretty impressive for something on the C64. Full on preemptive multitasking seems pretty impressive for something as little as the Commodore. https://en.wikipedia.org/wiki/LUnix

I hadn't, but I may be trying to rig that up in an emulator later, that seems awesome!

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#233

Post by SamPatt »

jeremyjh wrote: post #199
SamPatt wrote: post #142

Earlier quoted context omitted.

Nearly all politicians act like this when they're in power. The general public is easily mislead. HN notices it when it's a tech issue, but it happens in economics, medicine, basically everywhere. They have zero incentives to accept responsibility.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

Substitute whistleblower for reporter and yes, nearly all politicians will use the criminal justice system to silence their critics.

Was Obama a fascist? I have no desire to engage in whataboutism, they all show their true colors when they're in power and shown corrupt or incompetent.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#234

Post by bleachedsleet »

bawolff wrote: post #195
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

> After I shopped a few other companies to see how our plans compared Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore. If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential…

Language cheapens itself when spoken cheaply. Abusing over the top terminology on minute areas of controversy will ultimately lesson the impact of your outrage when something actually bad comes along. Someone browsing healthcare plans available to other employees of different companies is not something that should win you the label “malicious actor” and come associated with other implications. This data leaking harms literally nobody other than perhaps the company offering the worst coverage to its employees. Your response is the real problem here: If I had done this, reported it, and then been called a “malicious actor” on a forum titled “Hacker News” my knee jerk response would just be to shut up about it next time.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#235

Post by NullPrefix »

unethical_ban wrote: post #212
bawolff wrote: post #195

Earlier quoted context omitted.

> After I shopped a few other companies to see how our plans compared Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore. If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential…

You lost me at "maliciously". What harm was done by someone comparing prices? What organization lost money? Who got worse health service? "Unethical" and malicious is the current, profit-driven health insurance system. I know you're coming at it from an absolutist perspective, but I disagree entirely with passing judgement. Furthermore, the fact that you seem more upset with the person who glanced at a few plan price…

>What harm was done by someone comparing prices?

It removes the information asymmetry, which protect the profits of the seller.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#236

Post by bawolff »

Dylan16807 wrote: post #222
bawolff wrote: post #202

Earlier quoted context omitted.

In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.

Asking for the next file isn't false pretenses. I don't know if this analogy works quite right. Even rifling through a file cabinet wouldn't be false pretenses, it would be something else. And you have to cause injury for it to be fraud. Is "Help I was too honest to a customer." a valid injury claim?

I think the analogy would be going up to the desk and saying: my id number is X (when its really Y), can i have my file.

If you convince them that you really are X and they give you the file, i think that would be considerd fraudulent. Whether or not an injury takes place to raise it to the level of fraud i guess depends on what was in the file, but in countries with strong privacy laws, someone would probably be in a heap of trouble.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#237

Post by avereveard »

formerly_proven wrote: post #180
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

You got things the other way around it's not about the disclosure is about mitigation.

If one contacts the corrupted major for a timed disclosure, he gets time to hide crimes or can continue being corrupted, but the press running the story only damages the major.

If I run to the press with a vulnerability, everyone is empowered in exploiting it. Sure it puts lots of pressure on the devs, but devs can only work so fast, which creates a window of opportunity which damages both them and their users. A timed disclosure doesn't prevent exploitation that's already happening, but doesn't increase the problem by itself

The desired outcomes in the two cases are different, and it's no surprise different strategies are optimal.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#238

Post by MrPatan »

joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

You left out the best bit: "through a multi-step process"

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#239

Post by wonderwonder »

klyrs wrote: post #196
formerly_proven wrote: post #180

Earlier quoted context omitted.

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

Domestic abuse is pretty "normal" too. That doesn't make it tolerable.

These 2 things are not even remotely comparable.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#240

Post by jeremyjh »

SamPatt wrote: post #233
jeremyjh wrote: post #199

Earlier quoted context omitted.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

Substitute whistleblower for reporter and yes, nearly all politicians will use the criminal justice system to silence their critics. Was Obama a fascist? I have no desire to engage in whataboutism, they all show their true colors when they're in power and shown corrupt or incompetent.

>I have no desire to engage in whataboutism

Then don't.

I think Snowden should be pardoned and considered a national hero, but he unquestionably committed a very serious crime. There was no crime committed in the State of Missouri on this matter.

Post reply on HN