Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

351–360 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#351

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

I'm with you. It is really hard. First big wake up call was Brexit and the election of DJT. Are my countrymen really willing to shit on dedicated public servants and throw away the foundation of our remarkably safe and prosperous world? Sadly, yes, and the europeans are just as eager; madness everywhere.

I stepped out of public engagement for a while, then moved to Portland when I was ready to get back in. That was a whole new lesson: the lefty/progressive types are just as bad at governing. And the leftist/progressive voters are just as likely as the right to treat politics like a team sport. Portland is more dangerous for black people than Chicago now #BlackLivesMatter. Developers keep pulling out of affordable housing developments because of planning bullshit, and the city thinks its a good idea to mandate that contractors be women owned. Meanwhile, thousands are sleeping rough.

The politicians are awful, but in a democracy, the fault for that lies 100% with the people. Elected office, like next-door, doesn't make people bad; it simply reflects the rotten core of 21st century civil society.

Absolutely maddening is the lack of interest in concrete policy or actually using data to analyze changes and measure success.

I think I'm about ready to stop caring and have a nice life while my species hurtles towards the great filter. Life and the universe are meaningless anyway.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#352

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

We live in a world where everyone thinks they understand computers and have an expectation of security and privacy, but they don't realize how hard it is to build these systems correctly. The best security appears to be invisible to the consumer, but requires a lot of thought by the implementer.

This is the same reason why I think most of the general public don't understand how much data social media apps can collect on them. I know a lot of average technology users, who allow every single permission whenever an App asks them, because they're like obviously its not going to do any harm. Without realizing how every action they take is recorded in a database somewhere, which will get compromised sometime in the future.

I'm not a mobile developer, but it would be interesting if iOS provided a service that allowed data to never leave the phone and provided an API for Apps to get particular types of data and showed warning levels in the App, each time more sensitive data is accessed. The App store needs to be a place where if I download an App from, I need to have the peace of mind that it won't cause more harm than good.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#353
Judging by his tweets, the governor seems under the impression that "decoding" the HTML is a multi step process and breaking it constitutes unlawful access.

He does not, however, feel like expanding on what that means. Several people tried to reach him on that, without success.

Does anyone have "lawful" access to the site? I want to see for myself how those bits of PII showed up in the markup.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#355

Earlier quoted context omitted.

If it is served via https, it is encrypted. Edit: sorry, forgot the /s

I didn't get the joke. Can anybody explain it?

Https traffic is indeed encrypted, but its encrypted for you the user.

Its like saying you stole documents from a sealed container when that container had your name on it, it was addressed to you, and you had the key.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#356

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

[deleted]

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#357
post #307

Earlier quoted context omitted.

Nearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

I used to recoil at these kinds of statements until I saw what the Trump administration was doing.

It's not an exaggeration. Stephen Miller, Steve Bannon, Richard Spencer, all these people in Trump's inner circle are self-described "alt-right," "white nationalist," or some other euphemism for ethno-fascist.

Racism and fascism in the US are very real, serious problems, and have become synonymous with the Republican party.

edit, here is a link or two:

https://www.vanityfair.com/news/2017/05/stephen-miller-duke-...

https://www.npr.org/2019/11/26/783047584/leaked-emails-fuel-...

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#358

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies this can work.

Years ago, I worked at this place, they tried to install these new core routers. The first core router worked fine, but connect the second and the whole campus network would go into meltdown.

The network team could not work it out. The vendor could not work it out. But one of the IT managers had an explanation: me. Firstly, it was due to an OpenVPN I installed on a server (with permission-as a stopgap measure so we could remotely access the “next-gen data centre” because the networking team was taking too long to get the real VPN installed and it was blocking other teams on the project.) The explanation didn’t make any technical sense: the VPN is just an application, nothing to do with the core routers; but he wasn’t technical enough to understand that. They told me to shut it down, so I did (even though doing so inconvenienced the project), and lo and behold, it made zero difference to the problem. Then, he apparently even suggested at a management meeting (I wasn’t there but I heard about it) that I was sneaking in to the data centre at night or on the weekends to sabotage things, and that was why the new routers didn’t work. Apparently they even asked campus security for my physical access logs, which revealed I hadn’t been doing any such thing.

Eventually, the vendor worked out the problem. When you install the router, there was a step you had to change the VRRP IDs to give every router a unique ID on the network. Clearly explained in the documentation, obviously essential, apparently our networking team didn’t read that part. You plug one new router in, everything is fine; plug the second one in, well it still has the OOTB default VRRP ID, so now two core routers on the campus network have the same VRRP ID, and all the other routers got confused, and the whole thing fell apart. Both our networking team and the vendor’s support team were so focused on chasing some obscure bug they didn’t see the basic config issue.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#359
post #3

From the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw: > "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."

Tell me if I'm reading this wrong. I want to be reading this wrong.

Is this saying that when you viewed a certain page (which I assume had only one person's SSN visible, or perhaps other teacher information like names), the "invisible" SSNs were just hidden with `display: none` or similar?

Post reply on HN