Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

251–260 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#251

Post by handrous »

josefresco wrote: post #27

FYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missou…

I am reliably informed by people with some insight into Missouri government that Parson is exceptionally terrible. Incompetent or malicious, depending on the day.

I gather the previous (also Republican) governor, Greitens, who may or may not have been into some weird/illegal sex stuff and was forced out over it, was actually pretty good. Seemed to truly care about governing well and improving the functions of state government, at least, which Parson does not.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#252

Post by WkndTriathlete »

solveit wrote: post #150
daviddever23box wrote: post #56

Earlier quoted context omitted.

Imagine if we had credentialing requirements for elected office…

We do. It's called an election. What you want is credentialing requirements for voting.

I'm pretty sure I want credentialing requirements for anyone running for any public office. I'd settle for automatic exclusion of anyone displaying narcissistic, psychopathic, or sociopathic tendencies and inclusion of rational pragmatists.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#253

Post by Buttons840 »

codegeek wrote: post #43
dylan604 wrote: post #12

Earlier quoted context omitted.

We've always known that using DevTools was a criminal activity. In fact, the sheer number of people using them places this at criminal conspiracy levels. Better start filing those RICO cases against the browser devs. /s

How dare you did "View Source", you hacker.

> you hacker

What a "hacker" is is a matter of definition.

But, the fact is the state was using "encryption" with such a level of security that pressing one button on any computer with a browser is all that is required to defeat it.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#254

Post by cowsup »

0x262d wrote: post #246
idworks1 wrote: post #174

Earlier quoted context omitted.

> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed. Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took pla…

wow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?

Careful, son, you're quickly entering elite hacker turf.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#255

Post by formerly_proven »

b3morales wrote: post #243
formerly_proven wrote: post #180

Earlier quoted context omitted.

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

> a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf? Huh? This analogy doesn't really make sense. The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's be…

That's not the point of the analogy (some other siblings got it wrong, too, so the fault is likely mine). The point is that it's inherently very risky for you to contact someone about a problem they created accidentally, negligently or possibly intentionally in order to get it fixed (and that might result in them being fined or otherwise punished when the issue becomes known). So you should not do that. You should either seek a trustworthy intermediary for you to handle the interaction (this might be difficult / non-existent in your locale) or reveal the issues anonymously.

Again, it's not about Optimally Mitigating Corporate Security Fuckups, it's much more basic than that: it's about keeping you safe. This should obviously be priority #1. Anyone telling anyone else to do responsible disclosure by default because That's What Good Guys Do And You're Not A Good Guy If You Don't is quite clearly not putting the safety of the reporter at #1.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#256

Post by Keyframe »

pwillia7 wrote: post #216
kamkazemoose wrote: post #187

Earlier quoted context omitted.

Say you are invited to your friends apartment in an apartment building, but none of the apartments have locks. So you decide to open up some other random apartments and look through their things, who is responsible?

I was thinking of a similar analogy but I don't think it holds. The right analogy would be if I was in the apartment complex and I said to a door not mine "I'm home open up!" If the door opened and I did it intentionally, am I liable? I still feel like yes but since you have to request the document and receive it I think it's different than just checking locks.

I think we're all gronw-ups here and don't need analogies here.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#258

Post by handrous »

_0ffh wrote: post #34

I don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.

It is my understanding that Parson is not the kind of fellow to give a shit what a state bureaucrat tells him, if it's not what he wants to hear, assuming he'd listen to them in the first place.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#259

Post by b3morales »

formerly_proven wrote: post #255
b3morales wrote: post #243

Earlier quoted context omitted.

> a) Disclose this through e.g. the press b) Approach the mayor and try to get him to fix his stuff. Somehow, when it comes to IT security, people wanna see hackers do b) because a) would clearly be irresponsible. Wtf? Huh? This analogy doesn't really make sense. The difference for software is extremely basic: if you publicize a vulnerability immediately, you give more opportunity for it to be exploited while it's be…

That's not the point of the analogy (some other siblings got it wrong, too, so the fault is likely mine). The point is that it's inherently very risky for you to contact someone about a problem they created accidentally, negligently or possibly intentionally in order to get it fixed (and that might result in them being fined or otherwise punished when the issue becomes known). So you should not do that. You should ei…

I see, yes -- I certainly agree with disclosing safely/anonymously.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#260

Post by A4ET8a8uTh0 »

solveit wrote: post #150
daviddever23box wrote: post #56

Earlier quoted context omitted.

Imagine if we had credentialing requirements for elected office…

We do. It's called an election. What you want is credentialing requirements for voting.

And US used to have them too. The basic approach was that if you have land, you have a stake in the future of the republic. It was debated as to whether landless would have the same stake.
Post reply on HN