Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

341–350 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#341

Post by dataviz1000 »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I did that once a long, long time ago with the organization that monitors maritime piracy around the world. They have a mailing list which I accidentally stumbled on that included I assume since I only saw the one page of email addresses that ended in top level domains like un.org and navy.mil thousands of email addresses. I contacted through email the people running the organization that I accidentally stumbled on the page and they should probably hide it which they responded thank you. If you have ever been to Washington DC you would know the amount of money military contractors spend to show the latest navy vessel to everyone at the Foggy Bottom metro station and other places where such ads seem unlikely. That was the mother of all B2B email lists for militaries and shipping companies around the world. I didn't want to play any games with it.

EDIT: Remembering it now, there were also email addresses with the Iranian navy as they coordinate with other navies to fight piracy too. Perhaps instead of sending a Rickroll I could have sent a mass email with Lennon's "Give Peace a Chance."

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#343

Post by switch007 »

iggldiggl wrote: post #102
mhh__ wrote: post #66

Earlier quoted context omitted.

This could actually become illegal in the UK. The official secrets act might be amended to make it illegal to embarrass the state...

To quote Yes Minister: "The Official Secrets Act is not there to protect secrets, it is there to protect officials."

It is amazing how much truth they stuffed in to that show

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#344

Post by jaywalk »

dylan604 wrote: post #154
theandrewbailey wrote: post #113

Earlier quoted context omitted.

In all seriousness, considering Google's track record of discontinuing useful services and features, I expect Chrome to drop View Source any release now. It will be a sad day.

Who browses the web without the DevTools exposed by default? I don't know how to make the web work without "fixing" web pages before attempting to read them.

Who browses the web with Dev Tools exposed by default? Why do you feel the need to "fix" every web page you look at?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#345

Post by marcellus23 »

bawolff wrote: post #284
formerly_proven wrote: post #245

Earlier quoted context omitted.

The closest real-life equivalent to asking a computer server for a document and getting it is asking a human server (e.g. office clerk, archivist) for a document and getting it. If I go to the IRS to do some paperwork and notice it says "File #7881991" in the top right corner and I go to the clerk and ask them "Hey, can I have files 7881992 and 7881993, too?" and they give them to me , who is liable for that? It's qu…

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

A closer analogy would be that you keep the name as your name, but change the # of the document you're requesting. It's the IRS's job to ensure you're allowed to retrieve that doc.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#346

Post by rossdavidh »

The usefulness of having state legislators from a variety of backgrounds:

Republican state Rep. Tony Lovasco, who according to his legislative biography has worked in software deployment and maintenance, tweeted Thursday that “it’s clear the Governor’s Office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities.

“Journalists responsibly sounding an alarm on data privacy is not criminal hacking,” he said.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#347

Post by CountDrewku »

handrous wrote: post #275
jeremyjh wrote: post #194

Earlier quoted context omitted.

Missouri is not even remotely considered to be in "the south". At least not by those who live there or in neighboring states.

I know a lot of people who regard it as a hybrid southern/midwestern state. Plenty of confederate flags to be found in Missouri, certainly, and the MU/KU rivalry is, on our side at least, heavy on "bleeding Kansas" rhetoric and imagery, which keeps Missouri's Southern-sympathizing role in the war alive in our popular culture (such as it is). Lots and lots of our local icons, oft-mentioned historical figures, et c., r…

You can find Confederate flags in northern states and all over the US. That doesn't suddenly make it more "southern". I live in CO now and I see more confederate flags than I ever saw in MO.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#348

Post by prox »

coliveira wrote: post #314
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies this can work.

Lots of these folks (like the governor) don’t even know the basics of IT. Zero knowledge. You can tell them anything and it will stick.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#349

Post by cortesoft »

heavymark wrote: post #337

"In a press release Wednesday, the Office of Administration Information Technology Services Division said that through a multi-step process, a “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.” Ha, or summarized a user clicked "View Source" in their browser. Well I guess the first of the multi-set process is open said…

I mean, everything is a multistep process if you are pedantic enough.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#350

Post by walrus01 »

dataviz1000 wrote: post #341
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I did that once a long, long time ago with the organization that monitors maritime piracy around the world. They have a mailing list which I accidentally stumbled on that included I assume since I only saw the one page of email addresses that ended in top level domains like un.org and navy.mil thousands of email addresses. I contacted through email the people running the organization that I accidentally stumbled on t…

Huge missed opportunity for mass email of URL shortener link to the youtube Rick Astley video.
Post reply on HN